-
Notifications
You must be signed in to change notification settings - Fork 253
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
✨ pkg/cloud/services/networking/securitygroups.go reimplement reconcilation #773
✨ pkg/cloud/services/networking/securitygroups.go reimplement reconcilation #773
Conversation
Welcome @chrischdi! |
Hi @chrischdi. Thanks for your PR. I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
Build failed.
|
I had to remove the Otherwise the reconcilation is getting a |
/ok-to-test |
Build failed.
|
recheck |
Build failed.
|
I'll debug it in a local devstack setup. From our environment I can see that the environment does not save the description. |
I was able to fix the issue. By default there are already security group rules inside the security groups which have another description. Because of that I changed the order to first delete not needed rules and create the new ones afterwards |
Build succeeded.
|
reasonable change just curious about following statement, why are we creating an exactly same rule if we know
|
/retitle ✨ pkg/cloud/services/networking/securitygroups.go reimplement reconcilation |
I think the problem is that the deep equal does not detect that it's the same because the server will return something else compared to what we created before. |
@chrischdi please rebase so that the tests are run against the new v1alpha4 master version |
Exactly: on our OpenStack (which is "VMware Integrated OpenStack") the following happens:
I can see the same result when using the openstack cli and checking the output of However: I think the response of the API is still okay, because
It is also ok for me to revert the removal of |
6c41df5
to
a977e09
Compare
rebased to master :-) |
Build failed.
|
/retest |
recheck |
Build failed.
|
…tion Reimplements the security group reconcilation by only creating and/or deleting the rules desired / not desired. Signed-off-by: Schlotter, Christian <christian.schlotter@daimler.com>
… when matching 0.0.0.0/0 A RemoteIPPrefix of 0.0.0.0/0 is equal to the default (""/None). Because of that we do not set it to not trigger reconcilations.
…elete then create By default there are already rules which exist and do not match by name. Therefor we first delete not-matching rules and create the desired ones afterwards.
a977e09
to
98ecc10
Compare
rebased to master again to have gcp based tests |
/test help |
/test pull-cluster-api-provider-openstack-make-conformance |
@chrischdi: The specified target(s) for
Use
In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
Build failed.
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
conformance test green now :)
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: chrischdi, sbueringer The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
recheck |
Build failed.
|
no need, just want to understand the logic here, all good :_) |
/lgtm |
wait for zuul job to merge |
@sbueringer looks like we don't want to run openstack/check anymore as the playbook is missing |
/hold cancel |
@jichenjc Yes we have to ignore the OpenLab failures for now. I'll try to remove the OpenLab ASAP after we have the ProwJob on release-0.3 |
What this PR does / why we need it:
Reimplements the security group reconcilation by only creating and/or
deleting the rules desired / not desired instead of deleting all and creating all rules.
Which issue(s) this PR fixes (optional, in
fixes #<issue number>(, fixes #<issue_number>, ...)
format, will close the issue(s) when PR gets merged):Fixes #771
Special notes for your reviewer:
Release note:
/hold