gvforwarder as a systemd service

[vyasgun]

• Create a tap device using nmcli with a hardcoded mac address
• Start gvforwarder systemd service which will use this device

Based on the following code:
#673
cfergeau@03a4054

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign gbraad for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[vyasgun]

/test all

[cfergeau]

I'd recommend also picking up the changes from https://github.com/cfergeau/snc/commits/gvisor_service/ which update the unit files used in the PR to use a unit file close to https://github.com/containers/gvisor-tap-vsock/tree/main/contrib/systemd

With the current code, I still have this question/concern #673 (comment)

[vyasgun]

/retest

[vyasgun]

/retest

[vyasgun]

/retest

[vyasgun]

/retest

[vyasgun]

/retest

[vyasgun]

/retest

[vyasgun]

/retest

[vyasgun]

/retest

[vyasgun]

/retest

[vyasgun]

/retest

[vyasgun]

/retest

[vyasgun]

/retest

[vyasgun]

/retest

[vyasgun]

/retest

[cfergeau]

Looks good to me, thanks a lot for putting this into shape/testing it.

[vyasgun]

/test e2e-snc

[cfergeau]

Isn't this equivalent to ${SSH} core@${VM_IP} 'sudo nmcli connection add type tun ifname tap0 con-name tap0 mode tap autoconnect yes 802-3-ethernet.cloned-mac-address 5A:94:EF:E4:0C:EE'?

[gbraad]

In short; you are questioning why this needs to be wrapped in a sudo bash -x -s.
Would otherwise an error occur? I do not see characters that would be wrongly interpreted by the host shell (like zsh could do).

@anjannath How was this solved for the self-sufficient bundle?

[anjannath]

this is not being changed for the self-sufficient bundle, its been tested with the existing situation which is that there is a container image which runs the gvforwarder and that container also has a dhcp client script which configures the interface using the dhcp service from gvisor-tap-vsock

[anjannath]

i think we can also scp the NetworkManger config file to /etc/NetworkManager/system-connections instead of running nmcli commands, there's a config file in: https://github.com/containers/gvisor-tap-vsock/blob/main/contrib/networkmanager/vsock0.nmconnection

[connection]
id=tap0
type=tun
autoconnect=true
interface-name=tap0

[tun]
mode=2

[802-3-ethernet]
cloned-mac-address=5A:94:EF:E4:0C:EE

[ipv4]
method=auto

[proxy]

[cfergeau]

@praveenkumar can you take a look at this PR? you also looked into this in the past.

[gbraad]

I would approve, but I question the use of the command... first why invoked like this... though, even ... why is the creation of the tap not part of a systemd unit by itself? As in that case you can depend on it...

[gbraad]

👍

[gbraad]

... I like how this can be targeted with %i, but this 'depends' on actions performed previously by creating this device.

For this increment, this would work. But most likely would change with the self-sufficient bundle.

[cfergeau]

The nmcli command creates a Network Manager configuration file in the bundle, the self-sufficient bundle should be similar from that perspective?

[gbraad]

In short; you are questioning why this needs to be wrapped in a sudo bash -x -s.
Would otherwise an error occur? I do not see characters that would be wrongly interpreted by the host shell (like zsh could do).

@anjannath How was this solved for the self-sufficient bundle?

[cfergeau]

why is the creation of the tap not part of a systemd unit by itself? As in that case you can depend on it...

In a way the creation of the tap is part of a systemd unit, it's added to NetworkManager configuration files, which is started through systemd.
The gv-user-network unit has dependencies on the network device:

After=NetworkManager.service
BindsTo=sys-devices-virtual-net-%i.device
After=sys-devices-virtual-net-%i.device

[openshift-ci]

@vyasgun: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-snc	cf5affc	link	true	/test e2e-snc
ci/prow/e2e-microshift	cf5affc	link	true	/test e2e-microshift

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[praveenkumar]

/close

this is taken care by #1052

[openshift-ci]

@praveenkumar: Closed this PR.

In response to this:

/close

this is taken care by #1052

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.