OPNET-782: Render BGP VIP static pods instead of keepalived #6326
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,165 @@ | ||
| --- | ||
| kind: Pod | ||
| apiVersion: v1 | ||
| metadata: | ||
| name: frr-k8s | ||
| namespace: openshift-frr-k8s | ||
| labels: | ||
| app: frr-k8s | ||
| spec: | ||
| # hostNetwork: the BGP session must originate from the node IP and the | ||
| # advertised VIP routes live in the host routing table (keepalived parity). | ||
| hostNetwork: true | ||
| shareProcessNamespace: true | ||
| priorityClassName: system-node-critical | ||
| # 10s (not the upstream DaemonSet's 0): a SIGTERM'd bgpd sends a Cease | ||
| # NOTIFICATION, which hard-resets the session; after a SIGKILL a peer in | ||
| # graceful-restart helper mode may retain stale VIP routes on bare TCP | ||
| # loss until the restart timer expires. | ||
| terminationGracePeriodSeconds: 10 | ||
| tolerations: | ||
| - operator: Exists | ||
| initContainers: | ||
| - name: render-config-frr | ||
| image: {{ .Images.BaremetalRuntimeCfgBootstrap }} | ||
| command: | ||
| - /usr/bin/runtimecfg | ||
| - render | ||
| - /etc/kubernetes/kubeconfig | ||
| - --api-vips | ||
| - {{ onPremPlatformAPIServerInternalIP .ControllerConfig }} | ||
| - --ingress-vips | ||
| - {{ onPremPlatformIngressIP .ControllerConfig }} | ||
| - "--cluster-config" | ||
| - "/opt/openshift/manifests/cluster-config.yaml" | ||
| - /config/frr.conf.tmpl | ||
| - --out-dir | ||
| - /etc/frr | ||
| - --peer-file | ||
| - /config/frr-peers.json | ||
| env: | ||
| - name: IS_BOOTSTRAP | ||
| value: "yes" | ||
| securityContext: | ||
| allowPrivilegeEscalation: false | ||
| readOnlyRootFilesystem: true | ||
| capabilities: | ||
| drop: | ||
| - ALL | ||
| resources: | ||
| requests: | ||
| cpu: 10m | ||
| memory: 50Mi | ||
| limits: | ||
| cpu: 100m | ||
| memory: 128Mi | ||
| terminationMessagePolicy: FallbackToLogsOnError | ||
| volumeMounts: | ||
| - name: resource-dir | ||
| mountPath: /config | ||
| readOnly: true | ||
| - name: frr-conf | ||
| mountPath: /etc/frr | ||
| - name: kubeconfig | ||
| mountPath: /etc/kubernetes | ||
| readOnly: true | ||
| - name: manifests | ||
| mountPath: "/opt/openshift/manifests" | ||
| mountPropagation: HostToContainer | ||
|
coderabbitai[bot] marked this conversation as resolved.
|
||
| readOnly: true | ||
| - name: cp-frr-files | ||
| image: {{ .Images.FRRK8sBootstrap }} | ||
| command: | ||
| - /bin/sh | ||
| - -c | ||
| - | | ||
| set -eu | ||
| cp -f /tmp/frr/daemons /etc/frr/daemons | ||
| cp -f /tmp/frr/vtysh.conf /etc/frr/vtysh.conf | ||
|
coderabbitai[bot] marked this conversation as resolved.
|
||
| securityContext: | ||
| runAsUser: 100 | ||
| runAsGroup: 101 | ||
| allowPrivilegeEscalation: false | ||
| readOnlyRootFilesystem: true | ||
| capabilities: | ||
| drop: | ||
| - ALL | ||
| resources: | ||
| requests: | ||
| cpu: 10m | ||
| memory: 20Mi | ||
| limits: | ||
| cpu: 100m | ||
| memory: 128Mi | ||
| terminationMessagePolicy: FallbackToLogsOnError | ||
| volumeMounts: | ||
| - name: frr-startup | ||
| mountPath: /tmp/frr | ||
| readOnly: true | ||
| - name: frr-conf | ||
| mountPath: /etc/frr | ||
|
coderabbitai[bot] marked this conversation as resolved.
|
||
| containers: | ||
| - name: frr | ||
| image: {{ .Images.FRRK8sBootstrap }} | ||
| command: | ||
| - /bin/sh | ||
| - -c | ||
| - /sbin/tini -- /usr/lib/frr/docker-start | ||
| env: | ||
| - name: TINI_SUBREAPER | ||
| value: "true" | ||
| resources: | ||
| requests: | ||
| cpu: 100m | ||
| memory: 200Mi | ||
| limits: | ||
| cpu: 500m | ||
| memory: 512Mi | ||
| securityContext: | ||
| allowPrivilegeEscalation: false | ||
| readOnlyRootFilesystem: true | ||
| capabilities: | ||
| # Mirrors the frr container of the frr-k8s DaemonSet shipped by CNO | ||
| # (upstream metallb/frr-k8s parity). No drop ALL: FRR's | ||
| # privilege-separated startup (watchfrr as root spawning daemons as | ||
| # the frr user) additionally relies on root's implicit capabilities | ||
| # (SETUID/SETGID/DAC_OVERRIDE/CHOWN); dropping ALL and re-adding | ||
| # only the network capabilities was tested and prevents the FRR | ||
| # daemons from starting. SYS_ADMIN is required by docker-start/ | ||
| # watchfrr process supervision. | ||
| add: | ||
| - NET_ADMIN | ||
| - NET_RAW | ||
| - SYS_ADMIN | ||
| - NET_BIND_SERVICE | ||
|
coderabbitai[bot] marked this conversation as resolved.
|
||
| terminationMessagePolicy: FallbackToLogsOnError | ||
| volumeMounts: | ||
| - name: frr-sockets | ||
| mountPath: /var/run/frr | ||
| - name: frr-conf | ||
| mountPath: /etc/frr | ||
| - name: frr-lib | ||
| mountPath: /var/lib/frr | ||
| - name: frr-tmp | ||
| mountPath: /var/tmp/frr | ||
|
coderabbitai[bot] marked this conversation as resolved.
|
||
| volumes: | ||
| - name: resource-dir | ||
| hostPath: | ||
| path: /etc/kubernetes/static-pod-resources/frr-k8s | ||
| - name: frr-conf | ||
| emptyDir: {} | ||
| - name: frr-sockets | ||
| emptyDir: {} | ||
| - name: frr-lib | ||
| emptyDir: {} | ||
| - name: frr-tmp | ||
| emptyDir: {} | ||
| - name: frr-startup | ||
| hostPath: | ||
| path: /etc/kubernetes/static-pod-resources/frr-k8s/startup | ||
| - name: kubeconfig | ||
| hostPath: | ||
| path: /etc/kubernetes | ||
| - name: manifests | ||
| hostPath: | ||
| path: "/opt/openshift/manifests" | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
Repository: openshift/machine-config-operator
Length of output: 2936
🏁 Script executed:
Repository: openshift/machine-config-operator
Length of output: 38773
🏁 Script executed:
Repository: openshift/machine-config-operator
Length of output: 232
🌐 Web query:
Go 1.26.5 release notes security fixes July 7 2026💡 Result:
Go 1.26.5 was released on July 7, 2026 [1][2]. This minor point release includes two critical security fixes along with various bug fixes for the compiler, runtime, go command, and several standard library packages [1][3]. The two security vulnerabilities addressed in this release are: 1. os: Root escape via symlink plus trailing slash (CVE-2026-39822) On Unix systems, the os.Root functionality improperly followed symbolic links to locations outside the intended root directory when the final path component was a symbolic link and the path ended with a trailing slash [2][4]. This failure to account for openat behavior with trailing slashes allowed paths to escape the root. The issue has been resolved by properly sanitizing the path parameter [4][5]. 2. crypto/tls: Encrypted Client Hello privacy leak (CVE-2026-42505) The Encrypted Client Hello (ECH) implementation leaked pre-shared key (PSK) identities during the handshake [2][6]. This vulnerability could allow a passive network observer to de-anonymize the server's hostname even when ECH was in use [4][5]. Additional updates in Go 1.26.5 include bug fixes for the compiler, runtime, the go command, and the net, os, and syscall packages [1][3]. Detailed technical changes can be found in the official Go release history [1][7].
Citations:
Pin a patched Go toolchain.
go 1.26.0leaves this repo on the initial 1.26 release, and there’s notoolchainor CI version pin here. Bump to at leastgo 1.26.5or enforce a newer toolchain in CI.🤖 Prompt for AI Agents