Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Changes for deployment of VPN2 after rewrite to Go. #9774

Open
wants to merge 8 commits into
base: master
Choose a base branch
from
Open

Changes for deployment of VPN2 after rewrite to Go. #9774

wants to merge 8 commits into from

Conversation

MartinWeindel
Copy link
Member

@MartinWeindel MartinWeindel commented May 16, 2024 •
edited by rfranzke
Loading

How to categorize this PR?

/area control-plane
/kind enhancement

What this PR does / why we need it:
The rewrite of the bash scripts to Go in vpn2 brings some changes in the deployment of the vpn-seed-server and vpn-shoot-client deployments.
These adjustments must be applied together with the new release of VPN2 containing

The feature gate NewVPN is introduced for the gardenlet component to enable the new implementation.

Co-authored-by: @dergeberl
Co-authored-by: @hown3d
Co-authored-by: @mreiger

Which issue(s) this PR fixes:
Fixes #

Special notes for your reviewer:

Release note:

The feature gate `NewVPN` is introduced for the `gardenlet` component. If enabled, the new VPN implementation (Golang rewrite) is used for all `Shoot`s of the respective `Seed`. In this case, the old implementation can be disabled for a single `Shoot` by annotating the shoot resource with `alpha.control-plane.shoot.gardener.cloud/disable-new-vpn=true`. For `Seed`s with disabled feature gate, the new implementation can be enabled for a single shoot by annotating it with `alpha.control-plane.shoot.gardener.cloud/disable-new-vpn=false`.

@gardener-prow Gardener Prow
Copy link
Contributor

gardener-prow bot commented May 16, 2024

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@gardener-prow gardener-prow bot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. area/control-plane Control plane related kind/enhancement Enhancement, improvement, extension labels May 16, 2024
@gardener-prow gardener-prow bot requested review from shafeeqes and timuthy May 16, 2024 15:16
@gardener-prow gardener-prow bot added cla: yes Indicates the PR's author has signed the cla-assistant.io CLA. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels May 16, 2024
@dergeberl dergeberl mentioned this pull request May 16, 2024
Merged
7 tasks
@gardener-prow gardener-prow bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label May 28, 2024
@gardener-prow gardener-prow bot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. and removed needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Jun 6, 2024
@gardener-prow gardener-prow bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jun 14, 2024
@gardener-ci-robot
Copy link
Contributor

The Gardener project currently lacks enough active contributors to adequately respond to all PRs.
This bot triages PRs according to the following rules:

  • After 15d of inactivity, lifecycle/stale is applied
  • After 15d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 7d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

  • Mark this PR as fresh with /remove-lifecycle stale
  • Mark this PR as rotten with /lifecycle rotten
  • Close this PR with /close

/lifecycle stale

@gardener-prow gardener-prow bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jun 29, 2024
@MartinWeindel MartinWeindel force-pushed the enh/vpn2-as-go branch 2 times, most recently from 1eaebb9 to ded8fe1 Compare July 8, 2024 12:50
@gardener-prow gardener-prow bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jul 8, 2024
@gardener-prow gardener-prow bot added needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. and removed size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Jul 23, 2024
@gardener-prow gardener-prow bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jul 23, 2024
@MartinWeindel
Copy link
Member Author

/remove-lifecycle stale

@gardener-prow gardener-prow bot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jul 24, 2024
@gardener-prow gardener-prow bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 14, 2024
@gardener-prow gardener-prow bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 23, 2024
@MartinWeindel MartinWeindel mentioned this pull request Aug 27, 2024
Closed
1 task
@MartinWeindel
replacing side-car for openvpn metrics with go routine
4265752 
chore(apiserver): adjust vpn-path-controller in HA apiserver

Signed-off-by: Lukas Hoehl <lukas.hoehl@stackit.de>

Set higher limits for vpn init container in shoot

use subcommand in initCommand

chore(vpn): remove unused exit env var

Signed-off-by: Lukas Hoehl <lukas.hoehl@stackit.de>

clean up env variables; fix tests

add IS_HA env

run openvpn for shoot-client from shell

annotation to support disable VPN Go rewrite

fixes after rebase

refactor entrypoints

Signed-off-by: Lukas Hoehl <lukas.hoehl@stackit.de>

fix kube-apiserver vpn init container

Signed-off-by: Lukas Hoehl <lukas.hoehl@stackit.de>

fix tests

rename new vpn go images

add SEED_POD_NETWORK

add tunnel-controller

fix HA IPv6

adjust to renamed vpn images and binaries

fixes after rebase

fix tunnel-controller binary name
@MartinWeindel
add feature NewVPN
0f41e2a
@MartinWeindel
update VPN2 images; fix inconsistencies
26626e5 
update VPN2 images; fix inconsistencies
@MartinWeindel
updated VPN architecture images
5930e45
@MartinWeindel MartinWeindel marked this pull request as ready for review August 27, 2024 14:09
@gardener-prow gardener-prow bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 27, 2024
@MartinWeindel
Copy link
Member Author

/invite @ScheererJ

@MartinWeindel
Copy link
Member Author

/retest

@ScheererJ
Copy link
Member

/assign

ScheererJ
ScheererJ reviewed Sep 2, 2024
View reviewed changes
Copy link
Member

@ScheererJ ScheererJ left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks a lot for this big improvement and allowing it to run in parallel to the old vpn so that we can easily switch between both variants.

I have a few questions/comments, though.

imagevector/images.go Outdated Show resolved Hide resolved
pkg/apis/core/v1beta1/constants/types_constants.go Outdated Show resolved Hide resolved
pkg/component/kubernetes/apiserver/deployment.go Outdated Show resolved Hide resolved
pkg/component/kubernetes/apiserver/deployment.go Outdated Show resolved Hide resolved
pkg/component/networking/vpn/seedserver/seedserver.go Outdated Show resolved Hide resolved
pkg/component/networking/vpn/seedserver/seedserver.go Show resolved Hide resolved
pkg/component/networking/vpn/shoot/shoot.go Outdated Show resolved Hide resolved
pkg/component/networking/vpn/shoot/shoot.go Show resolved Hide resolved
pkg/component/networking/vpn/shoot/shoot.go Show resolved Hide resolved
docs/deployment/feature_gates.md Show resolved Hide resolved
@gardener-prow Gardener Prow
Copy link
Contributor

gardener-prow bot commented Sep 3, 2024

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from scheererj. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@MartinWeindel
Copy link
Member Author

/test pull-gardener-integration

@MartinWeindel
Copy link
Member Author

/test pull-gardener-e2e-kind-migration-ha-single-zone

rfranzke
rfranzke reviewed Sep 3, 2024
View reviewed changes
docs/deployment/feature_gates.md Outdated Show resolved Hide resolved
docs/usage/reversed-vpn-tunnel.md Outdated Show resolved Hide resolved
imagevector/containers.yaml Outdated Show resolved Hide resolved
imagevector/containers.yaml Outdated Show resolved Hide resolved
pkg/apis/core/v1beta1/constants/types_constants.go Outdated Show resolved Hide resolved
pkg/features/features.go Outdated Show resolved Hide resolved
pkg/features/features.go Outdated Show resolved Hide resolved
pkg/gardenlet/operation/botanist/vpnshoot.go Outdated Show resolved Hide resolved
pkg/gardenlet/operation/botanist/vpnseedserver.go Outdated Show resolved Hide resolved
pkg/gardenlet/operation/shoot/types.go Outdated Show resolved Hide resolved
@gardener-prow gardener-prow bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Sep 11, 2024
@gardener-prow Gardener Prow
Copy link
Contributor

gardener-prow bot commented Sep 11, 2024

PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@rfranzke rfranzke rfranzke left review comments

@shafeeqes shafeeqes Awaiting requested review from shafeeqes

@timuthy timuthy Awaiting requested review from timuthy

@LucaBernstein LucaBernstein Awaiting requested review from LucaBernstein

@oliver-goetz oliver-goetz Awaiting requested review from oliver-goetz

@ScheererJ ScheererJ Awaiting requested review from ScheererJ

Assignees

@ScheererJ ScheererJ

Labels
area/control-plane Control plane related cla: yes Indicates the PR's author has signed the cla-assistant.io CLA. kind/enhancement Enhancement, improvement, extension needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@MartinWeindel @gardener-ci-robot @ScheererJ @rfranzke