suse-edge/Factory
SHA256
14
0
Fork 15
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

dual-stack support in metal3-chart #223

Merged
mchiappero merged 8 commits from mchiappero/Factory:dual-stack-chart into main 2025-08-07 14:12:26 +02:00
Conversation 1 Commits 8 Files Changed 14 +116 -29
mchiappero commented 2025-08-04 11:18:52 +02:00
Owner
Copy Link

Add support to metal3-chart for dual-stack, on top of PR #213.

Add support to metal3-chart for dual-stack, on top of PR #213.
mchiappero added 19 commits 2025-08-04 11:18:53 +02:00
Simplify the setting of host_ip in ironic.conf 783a3fd5c2 
The value of host_ip is determined twice within the ironic.conf.j2 template
file, by means of a relatively hard to read set of conditions.

Avoid this duplication and improve readability by exporting the correct
value once in scripts/configure-ironic.sh. This also leave more room for
more complex evaluations should these be needed in the future.

Signed-off-by: Marco Chiappero <marco.chiappero@suse.com>
Remove PROVISIONING_INTERFACE default for better validation 1f98a15d26 
Whenever PROVISIONING_INTERFACE is not set by the user, function
get_provisioning_interface attempts to determine one, or provide
"provisionign" as default value. However this can cause confusing errors
down the line.

Remove this default value and fail gracefully, with proper logging,
if the PROVISIONING_INTERFACE value is not detected.

Signed-off-by: Marco Chiappero <marco.chiappero@suse.com>
Add two new utility functions for later refactoring f5676b293c 
The way the ironic-image processes are bound to internet sockets is mainly
by PROVISIONING_IP or PROVISIONING_INTERFACE, that is, by looking up a
specific address on an interface, or a specific interface for a workable
address.

Introduce two new utility functions in ironic-common.sh for these two
purposes:
get_interface_of_ip: returns the name of the interface where the IP address
                     provided as argument is found
get_ip_of_interface: returns the first IP associated to the interface
                     provided as argument

These two functions will be put into use in subsequent commits.

Signed-off-by: Marco Chiappero <marco.chiappero@suse.com>
Leverage get_interface_of_ip to look PROVISIONING_IP up 250635e51c 
Use the previously introduced get_interface_of_ip, to determine if the
PROVISIONING_IP address is actually present on a network interface.

This improves the code readability and enables additional debugging
output.

Signed-off-by: Marco Chiappero <marco.chiappero@suse.com>
Revert 2742439 being now redundant a1ee32b951 
Commit 2742439 added logic to tentatively identify the interface name
in get_provisioning_interface if the PROVISIONING_IP is provided.
However the same process in then repeated in wait_for_interface_or_ip.

Signed-off-by: Marco Chiappero <marco.chiappero@suse.com>
Introduce IRONIC_IPV6 to bind on IPv6 sockets e6700bd732 
The ironic scripts either use PROVISIONING_IP as an input or try to
determine an IP address to bind the sockets to. This results in
IRONIC_IP being defined once the process is complete, and it can carry
either an IPv4 or an IPv6 address.

Likely, the assumption is that on Linux, by default, IPv4-mapped IPv6
addresses can be leveraged to serve both IPv4 and IPv6 through a single
socket. However this is not a good practice and two separate sockets
should be used instead, whenever possible.

This change modifies such logic by
- introducing the variable IRONIC_IPV6 alongside the existing
- matching IRONIC_IP and attempting to populate both variables

Please note that hostname based URLs, with both A and AAAA records, are
also required for a fully working dual-stack configuration.

Signed-off-by: Marco Chiappero <marco.chiappero@suse.com>
Allow binding on the provisioning network via a hostname 8b6d7e409c 
In a dual-stack scenario, especially when deploying in direct mode via
virtual media, it might be useful to 1) use a hostname to enable "dual IP"
URLs 2) have ironic bind to those two addresses, if found on the system.

To make this possible, this commit introduces:
- a new user environment variable named IRONIC_URL_HOSTNAME, to be used
  as immutable external only input, to derive IRONIC_URL_HOST and the
  IP addresses to bind on
- a new utility function named "get_ip_of_hostname" to help look up the
  A and AAAA records
- additional logic to look for the returned address on the system, for
  binding the processes; this new logic has lower priority than
  PROVISIONING_IP (which can then be used to enforce one specific IP
  version) and PROVISIONING_INTERFACE

Note, while IRONIC_URL_HOSTNAME and PROVISIONING_IP are considered to be
mutually exclusive, IRONIC_URL_HOSTNAME and PROVISIONING_INTERFACE are
not.

Signed-off-by: Marco Chiappero <marco.chiappero@suse.com>
Use my_ipv6 when IRONIC_IPV6 is defined in ironic.conf e155a809b8 
As per the Ironic documentation:

"This field [my_ip] does accept an IPv6 address as an override for templates
and URLs, however it is recommended that [DEFAULT]my_ipv6 is used along with
DNS names for service URLs for dual-stack environments."

Fill my_ipv6 when an IPv6 address has been found for binding.

Signed-off-by: Marco Chiappero <marco.chiappero@suse.com>
Set host_ip to an IPv6 address when found ad68f891f5 
Prioritize IPv6 over IPv4 when available to set host_ip in ironic.conf
when LISTEN_ALL_INTERFACES is not set to true.

Signed-off-by: Marco Chiappero <marco.chiappero@suse.com>
Let Ironic API use IPv4 and IPv6 sockets when possible 11cd6f8ebe 
When LISTEN_ALL_INTERFACES is not set, Apache should make Ironic API
avaiable on either or both IPv4 and IPv6 sockets, depending on the
addresses requested or found on the system.

Make sure to set the "Listen" directive according to ENABLE_IPV4 and
ENABLE_IPV4, and the VirtualHost when IRONIC_URL_HOSTNAME is present.

Signed-off-by: Marco Chiappero <marco.chiappero@suse.com>
Update httpd.conf to bind to IPv4 and/or IPv6 sockets 2d83191e53 
Enable the use of individual IPv4 and IPv6 sockets when the respective
IP is detected and LISTEN_ALL_INTERFACES is not set to true. This allows
to correctly bind to both the IPv4 and IPv6 addresses found and not just
one of them.

Signed-off-by: Marco Chiappero <marco.chiappero@suse.com>
Let Apache use separate IPv4 and IPv6 sockets for listening to any
All checks were successful
Check Release Manifest Local Charts Versions / Check Release Manifest Local Charts Versions (pull_request) Successful in -6s
Details
Build PR in OBS / Build PR in OBS (pull_request_target) Successful in 3m25s
Details
e5f765ec69 
Enable the use of two separate sockets for IPv4 and IPv6 when
LISTEN_ALL_INTERFACES is set to true. While desirable, on Linux Apache uses
IPv4-mapped IPv6 addresses by default, thus leveraging a single IPv6 socket
for IPv4 connections as well.

This behaviour is far from being desirable and can be disabled at compile
time via the "--disable-v4-mapped" flag, so make sure both an ANY address
Listen directive is present for both IPv4 and IPv6. When Apache is compiled
with "--enable-v4-mapped", the IPv4 socket will be simply ignored.

Please see https://httpd.apache.org/docs/2.4/bind.html for more
information.

Signed-off-by: Marco Chiappero <marco.chiappero@suse.com>
Allow control over IRONIC_EXTERNAL_HTTP_URL via values.yaml 2f668ea505 
The purpose of this commit is to:
- avoid providing IRONIC_EXTERNAL_HTTP_URL by default, as the Ironic
  startup scripts will be able to derive the value from other variables
- define a new global value under the top values.yaml to define
  IRONIC_EXTERNAL_HTTP_URL when actually needed
- make sure that the input, which can either be a hostname or an IP
  address, is correctly formatted in case of an IPv6.

This change also allows subsequent cleanups of the whole Configmap
template for Ironic.

Signed-off-by: Marco Chiappero <marco.chiappero@suse.com>
Remove unused env and helm variables 0b487e78cc 
Since currently we can only define the provisioning network and the
external HTTP host, remove some clutter generating unused variables.

Signed-off-by: Marco Chiappero <marco.chiappero@suse.com>
Introduce the provisioningHostname env variable in Ironic ef880d81fb 
Create a new provisioningHostname value in values.yaml in order to set
the new IRONIC_URL_HOSTNAME, that allows to set the address(es) Ironic
will bind to.

Signed-off-by: Marco Chiappero <marco.chiappero@suse.com>
Allow to change the LISTEN_ALL_INTERFACE variable for Ironic a26f3b1e91 
It should be possible to enable or disable the environment variable
LISTEN_ALL_INTERFACE in the Ironic configmap, as it allows to the way
Ironic binds to socket, especially in combination with the changes
introduced in v29.

Signed-off-by: Marco Chiappero <marco.chiappero@suse.com>
Introduce metal3.provisioningIP template and deprecate ironicIP 7b78c1b0d8 
So far ironicIP has been part of values.yaml under the global section,
however this is very misleading: this variable is internal to the Ironic
startup scripts and should not be set, moreover it conflicts with
provisioningIP, which is instead a public configuration variable for the
purpose.

This commits thus introduces the following changes:
- removes the creation of IRONIC_IP in the Ironic configmap
- does not yet remove ironicIP from values.yaml to avoid breaking
  forward compatibility
- introduces a utility function to perform input validation while still
  prioritizing ironicIP if present

Signed-off-by: Marco Chiappero <marco.chiappero@suse.com>
Include the hostname for SAN in Certificates 34b3a36787 
Recently provisioningHostname has been introduced as an alternative way
to configure the IPs to bind and respond to. This however requires that
the Certificates for HTTPS also include a dnsNames section whenver such
value is present.

Signed-off-by: Marco Chiappero <marco.chiappero@suse.com>
Update the URL for the BMO to connect to Ironic
Some checks failed
Check Release Manifest Local Charts Versions / Check Release Manifest Local Charts Versions (pull_request) Successful in -10s
Details
Build PR in OBS / Build PR in OBS (pull_request_target) Failing after 36m34s
Details
cf76077752 
The BMO should now connect via the provisioningHostname if set or an IP
address. Add a helper that returns the ironic hostname or correctly
formatted IP to define the ironicApiHost variable in the BMO configmap.

Signed-off-by: Marco Chiappero <marco.chiappero@suse.com>
mchiappero force-pushed dual-stack-chart from cf76077752 to 818a739343 2025-08-05 17:22:52 +02:00 Compare
mchiappero force-pushed dual-stack-chart from 818a739343 to 419e8a0814 2025-08-05 18:32:04 +02:00 Compare
mchiappero force-pushed dual-stack-chart from 419e8a0814 to 44a6a19b56 2025-08-05 20:28:58 +02:00 Compare
mchiappero force-pushed dual-stack-chart from 44a6a19b56 to 31a853afb2 2025-08-05 21:20:04 +02:00 Compare
mchiappero requested review from dprodanov 2025-08-06 18:17:46 +02:00
mchiappero force-pushed dual-stack-chart from 31a853afb2 to e233adfec2 2025-08-06 19:50:13 +02:00 Compare
mchiappero changed title from WIP: dual-stack support in metal3-chart to dual-stack support in metal3-chart 2025-08-06 21:00:29 +02:00
mchiappero commented 2025-08-07 12:07:18 +02:00
Author
Owner
Copy Link

Can I proceed with this? No comments?

Can I proceed with this? No comments?
mchiappero merged commit e233adfec2 into main 2025-08-07 14:12:26 +02:00
mchiappero deleted branch dual-stack-chart 2025-08-07 14:12:27 +02:00
Sign in to join this conversation.
Reviewers
No Reviewers
dprodanov
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
amorgante atanasdinov atrendafilov dbekhit dprodanov eminguez fdegirmenci geoagriogiannis ipetrov117 jtomasek kzhelyazkov mchiappero nbelouin roxenham steven.hardy
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: suse-edge/Factory#223
No description provided.
Delete Branch "mchiappero/Factory:dual-stack-chart"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?