Skip to content

gvforwarder as a systemd service #1052

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
May 16, 2025
Merged

gvforwarder as a systemd service #1052

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3879ea2
gvforwarder as a systemd service
vyasgun Jan 21, 2025
f04603b
Use gvisor-tap-vsock-gvforwarder package instead image
praveenkumar May 13, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 24 additions & 12 deletions createdisk.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ INSTALL_DIR=${1:-crc-tmp-install-data}
OPENSHIFT_VERSION=$(${JQ} -r .clusterInfo.openshiftVersion $INSTALL_DIR/crc-bundle-info.json)
BASE_DOMAIN=$(${JQ} -r .clusterInfo.baseDomain $INSTALL_DIR/crc-bundle-info.json)
BUNDLE_TYPE=$(${JQ} -r .type $INSTALL_DIR/crc-bundle-info.json)
ADDITIONAL_PACKAGES="cloud-init"
ADDITIONAL_PACKAGES="cloud-init gvisor-tap-vsock-gvforwarder"
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

Copy link
Collaborator

@gbraad gbraad May 14, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This does mean we need to keep this package up to date along with Podman's timeline/schedule.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@gbraad This is subpackage and I think as of now it is not used by podman machine but build everytime there is release of gvisor-tap-vsock so we can just use it without maintaining (like building ourself).


case ${BUNDLE_TYPE} in
microshift)
Expand Down Expand Up @@ -94,23 +94,35 @@ if podman manifest inspect quay.io/crcont/routes-controller:${OPENSHIFT_VERSION}
image_tag=${OPENSHIFT_VERSION}
fi

# create the tap device interface with specified mac address
# this mac address is used to allocate a specific IP to the VM
# when tap device is in use.
${SSH} core@${VM_IP} 'sudo bash -x -s' <<EOF
nmcli connection add type tun ifname tap0 con-name tap0 mode tap autoconnect yes 802-3-ethernet.cloned-mac-address 5A:94:EF:E4:0C:EE
EOF
Comment on lines +97 to +102
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

suggestion (bug_risk): Consider handling potential errors when adding the tap device.

Capture and check the nmcli command’s exit status (e.g., check $?) so any failures in creating the tap interface are detected and handled.

Suggested change
# create the tap device interface with specified mac address
# this mac address is used to allocate a specific IP to the VM
# when tap device is in use.
${SSH} core@${VM_IP} 'sudo bash -x -s' <<EOF
nmcli connection add type tun ifname tap0 con-name tap0 mode tap autoconnect yes 802-3-ethernet.cloned-mac-address 5A:94:EF:E4:0C:EE
EOF
# create the tap device interface with specified mac address
# this mac address is used to allocate a specific IP to the VM
# when tap device is in use.
${SSH} core@${VM_IP} 'sudo bash -x -s' <<EOF
nmcli connection add type tun ifname tap0 con-name tap0 mode tap autoconnect yes 802-3-ethernet.cloned-mac-address 5A:94:EF:E4:0C:EE
status=\$?
if [ \$status -ne 0 ]; then
echo "Error: Failed to add tap device interface. nmcli exit status: \$status"
exit \$status
fi
EOF



# Add gvisor-tap-vsock service
${SSH} core@${VM_IP} 'sudo bash -x -s' <<EOF
podman pull quay.io/crcont/gvisor-tap-vsock:latest
cat > /etc/containers/systemd/gvisor-tap-vsock.container <<EOF1
tee /etc/systemd/system/gv-user-network@.service <<TEE
[Unit]
Description=gvisor-tap-vsock
Before=nodeip-configuration.service
Description=gvisor-tap-vsock Network Traffic Forwarder
After=NetworkManager.service
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this be Before=NetworkManager.service ? otherwise it starts very late after boot

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@anjannath networkManager is responsible to activate tun/tap device so it that is not even active how would this work.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this be Before=NetworkManager.service ? otherwise it starts very late after boot

Is it NetworkManager.service which would start late? or network-online?
Since we have After=sys-devices-virtual-net-%i.device , do we even need the reference to NetworkManager.service?

Copy link
Collaborator

@gbraad gbraad May 12, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I spoke with Anjan, and the TAP creation should be independent of the network which configures. But the current, After is too undetermined, as it can start at any point after; anything with priority or dependency goes first.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In short, rather use Before than After statements, as that ensures the order.

BindsTo=sys-devices-virtual-net-%i.device
After=sys-devices-virtual-net-%i.device
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we need to add Before=nodeip-configuration.service as in #1054 ?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't know but I can try to do that also.


[Container]
Image=quay.io/crcont/gvisor-tap-vsock:latest
Network=host
PodmanArgs=--interactive --privileged --tty
Volume=/etc/resolv.conf:/etc/resolv.conf
[Service]
Restart=on-failure
Environment="GV_VSOCK_PORT=1024"
EnvironmentFile=-/etc/sysconfig/gv-user-network
ExecStart=/usr/libexec/podman/gvforwarder -preexisting -iface %i -url vsock://2:"\\\${GV_VSOCK_PORT}"/connect

[Install]
WantedBy=default.target
EOF1
WantedBy=multi-user.target

TEE
systemctl daemon-reload
systemctl enable gv-user-network@tap0.service
EOF

# Add dummy crio-wipe service to instance
Expand Down