Skip to content

Conversation

@rna-afk
Copy link
Contributor

@rna-afk rna-afk commented May 28, 2025

Adding the option for the users to create a NAT gateway for the compute nodes as an option to replace the traditional load balancer setup. This is only for a single NAT gateway in the compute subnet as CAPZ expects an outbound LB for control planes.

@openshift-ci-robot
Copy link
Contributor

openshift-ci-robot commented May 28, 2025

@rna-afk: This pull request references CORS-4067 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.20.0" version, but no target version was set.

Details

In response to this:

Adding the option for the users to create a NAT gateway for the compute nodes as an option to replace the traditional load balancer setup. This is only for a single NAT gateway in the compute subnet as CAPZ expects an outbound LB for control planes.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label May 28, 2025
@openshift-ci openshift-ci bot requested review from jhixson74 and sadasu May 28, 2025 20:19
Copy link
Contributor

@patrickdillon patrickdillon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

At a high level, this looks good. I do think we need to work out the install config API questions before moving forward ( see my comment in the PR)

It would be good to include some testing results and also it should be pretty simple to add pre-submit tests for this functionality so we can test this PR in CI. Happy to collaborate on that.


var loadBalancer *armnetwork.LoadBalancer
if platform.OutboundType == aztypes.UserDefinedRoutingOutboundType {
if platform.OutboundType != aztypes.LoadbalancerOutboundType {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this correct? For NATGateway our current thinking is that control plane nodes will still use the API load balancer for outbound access, so I'm not certain we want this change.

@rna-afk rna-afk force-pushed the azure_single_nat_gateway branch from 9e12d62 to f53184a Compare May 29, 2025 15:25
@rna-afk rna-afk force-pushed the azure_single_nat_gateway branch from f53184a to a6d0b46 Compare June 3, 2025 17:25
Copy link
Contributor

@patrickdillon patrickdillon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There are a few more annotations that need to be fixed:

// +kubebuilder:validation:Enum="";Loadbalancer;NatGateway;UserDefinedRouting

https://github.com/openshift/installer/blob/main/pkg/types/azure/platform.go#L79

For that last one, it would be good to include details about the NAT Gateway (repeating the comment text for the constant would be fine), because I believe those are the details included in the explain text.

And then the crd would need to be regenerated with go generate ./pkg/types/installconfig.go

@rna-afk rna-afk force-pushed the azure_single_nat_gateway branch 2 times, most recently from 46800f2 to 389f8a5 Compare June 4, 2025 18:04
@jhixson74
Copy link
Member

I'm coming in late here, but this LGTM ;-)

@rna-afk rna-afk force-pushed the azure_single_nat_gateway branch 6 times, most recently from 1cfe907 to 053a182 Compare June 6, 2025 15:40
Copy link
Contributor

@patrickdillon patrickdillon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's get openshift/release#65568 in (needs some slight changes) so we can test this PR.

@rna-afk rna-afk force-pushed the azure_single_nat_gateway branch 2 times, most recently from a8d5c70 to 85c1030 Compare June 11, 2025 00:56
@rna-afk rna-afk force-pushed the azure_single_nat_gateway branch from 85c1030 to d9b77d5 Compare July 1, 2025 05:12
@rna-afk
Copy link
Contributor Author

rna-afk commented Jul 2, 2025

/test ci/prow/e2e-azure-nat-gateway-single-zone

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Jul 2, 2025

@rna-afk: The specified target(s) for /test were not found.
The following commands are available to trigger required jobs:

/test aro-unit
/test artifacts-images
/test e2e-agent-compact-ipv4
/test e2e-aws-ovn
/test e2e-aws-ovn-edge-zones-manifest-validation
/test e2e-aws-ovn-upi
/test e2e-azure-nat-gateway-single-zone
/test e2e-azure-ovn
/test e2e-gcp-ovn
/test e2e-gcp-ovn-upi
/test e2e-metal-ipi-ovn-ipv6
/test e2e-openstack-ovn
/test e2e-vsphere-ovn
/test e2e-vsphere-ovn-upi
/test gofmt
/test golint
/test govet
/test images
/test integration-tests
/test integration-tests-nodejoiner
/test openstack-manifests
/test unit
/test verify-codegen
/test verify-deps
/test verify-vendor

The following commands are available to trigger optional jobs:

/test aws-private
/test azure-ovn-marketplace-images
/test azure-private
/test e2e-agent-4control-ipv4
/test e2e-agent-5control-ipv4
/test e2e-agent-compact-ipv4-appliance-diskimage
/test e2e-agent-compact-ipv4-none-platform
/test e2e-agent-compact-ipv6-minimaliso
/test e2e-agent-ha-dualstack
/test e2e-agent-sno-ipv4-pxe
/test e2e-agent-sno-ipv6
/test e2e-aws-byo-subnet-role-security-groups
/test e2e-aws-default-config
/test e2e-aws-overlay-mtu-ovn-1200
/test e2e-aws-ovn-custom-iam-profile
/test e2e-aws-ovn-edge-zones
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-heterogeneous
/test e2e-aws-ovn-imdsv2
/test e2e-aws-ovn-proxy
/test e2e-aws-ovn-public-ipv4-pool
/test e2e-aws-ovn-public-ipv4-pool-disabled
/test e2e-aws-ovn-public-subnets
/test e2e-aws-ovn-shared-vpc-custom-security-groups
/test e2e-aws-ovn-shared-vpc-edge-zones
/test e2e-aws-ovn-single-node
/test e2e-aws-ovn-techpreview
/test e2e-aws-ovn-upgrade
/test e2e-aws-ovn-user-provisioned-dns
/test e2e-aws-upi-proxy
/test e2e-azure-default-config
/test e2e-azure-ovn-multidisk-techpreview
/test e2e-azure-ovn-resourcegroup
/test e2e-azure-ovn-shared-vpc
/test e2e-azure-ovn-techpreview
/test e2e-azure-ovn-upi
/test e2e-azurestack
/test e2e-azurestack-upi
/test e2e-crc
/test e2e-external-aws
/test e2e-external-aws-ccm
/test e2e-gcp-default-config
/test e2e-gcp-ovn-byo-vpc
/test e2e-gcp-ovn-heterogeneous
/test e2e-gcp-ovn-techpreview
/test e2e-gcp-ovn-xpn
/test e2e-gcp-secureboot
/test e2e-gcp-upgrade
/test e2e-gcp-upi-xpn
/test e2e-gcp-user-provisioned-dns
/test e2e-ibmcloud-ovn
/test e2e-metal-assisted
/test e2e-metal-ipi-ovn
/test e2e-metal-ipi-ovn-dualstack
/test e2e-metal-ipi-ovn-swapped-hosts
/test e2e-metal-ipi-ovn-virtualmedia
/test e2e-metal-ovn-two-node-arbiter
/test e2e-metal-ovn-two-node-fencing
/test e2e-metal-single-node-live-iso
/test e2e-nutanix-ovn
/test e2e-openstack-ccpmso
/test e2e-openstack-ccpmso-zone
/test e2e-openstack-dualstack
/test e2e-openstack-dualstack-upi
/test e2e-openstack-externallb
/test e2e-openstack-nfv-intel
/test e2e-openstack-proxy
/test e2e-openstack-singlestackv6
/test e2e-powervs-capi-ovn
/test e2e-vsphere-externallb-ovn
/test e2e-vsphere-host-groups-ovn-custom-no-upgrade
/test e2e-vsphere-multi-vcenter-ovn
/test e2e-vsphere-ovn-hybrid-env
/test e2e-vsphere-ovn-multi-disk
/test e2e-vsphere-ovn-multi-network
/test e2e-vsphere-ovn-multi-network-techpreview
/test e2e-vsphere-ovn-techpreview
/test e2e-vsphere-ovn-upi-zones
/test e2e-vsphere-ovn-zones
/test e2e-vsphere-ovn-zones-techpreview
/test e2e-vsphere-static-ovn
/test gcp-private
/test okd-scos-e2e-aws-ovn
/test okd-scos-images

Use /test all to run the following jobs that were automatically triggered:

pull-ci-openshift-installer-main-aro-unit
pull-ci-openshift-installer-main-artifacts-images
pull-ci-openshift-installer-main-azure-ovn-marketplace-images
pull-ci-openshift-installer-main-azure-private
pull-ci-openshift-installer-main-e2e-aws-ovn
pull-ci-openshift-installer-main-e2e-azure-default-config
pull-ci-openshift-installer-main-e2e-azure-ovn
pull-ci-openshift-installer-main-e2e-azure-ovn-resourcegroup
pull-ci-openshift-installer-main-e2e-azure-ovn-shared-vpc
pull-ci-openshift-installer-main-e2e-azurestack
pull-ci-openshift-installer-main-e2e-vsphere-externallb-ovn
pull-ci-openshift-installer-main-e2e-vsphere-ovn-multi-network
pull-ci-openshift-installer-main-e2e-vsphere-static-ovn
pull-ci-openshift-installer-main-gofmt
pull-ci-openshift-installer-main-golint
pull-ci-openshift-installer-main-govet
pull-ci-openshift-installer-main-images
pull-ci-openshift-installer-main-okd-scos-e2e-aws-ovn
pull-ci-openshift-installer-main-okd-scos-images
pull-ci-openshift-installer-main-unit
pull-ci-openshift-installer-main-verify-codegen
pull-ci-openshift-installer-main-verify-deps
pull-ci-openshift-installer-main-verify-vendor
Details

In response to this:

/test ci/prow/e2e-azure-nat-gateway-single-zone

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@patrickdillon
Copy link
Contributor

/test e2e-azure-nat-gateway-single-zone

Adding the option for the users to create a NAT gateway for the
compute nodes as an option to replace the traditional load balancer
setup. This is only for a single NAT gateway in the compute
subnet as CAPZ expects an outbound LB for control planes.
@rna-afk rna-afk force-pushed the azure_single_nat_gateway branch from d9b77d5 to 9ea9f83 Compare July 2, 2025 21:29
@rna-afk
Copy link
Contributor Author

rna-afk commented Jul 2, 2025

/test e2e-azure-nat-gateway-single-zone

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Jul 3, 2025

@rna-afk: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/okd-scos-e2e-aws-ovn 9ea9f83 link false /test okd-scos-e2e-aws-ovn
ci/prow/e2e-azurestack 9ea9f83 link false /test e2e-azurestack
ci/prow/e2e-azure-ovn-resourcegroup 9ea9f83 link false /test e2e-azure-ovn-resourcegroup
ci/prow/e2e-vsphere-externallb-ovn 9ea9f83 link false /test e2e-vsphere-externallb-ovn
ci/prow/e2e-vsphere-ovn-multi-network 9ea9f83 link false /test e2e-vsphere-ovn-multi-network

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@patrickdillon
Copy link
Contributor

/approve

shoot, I thought we merged this a while ago... I can tag in a moment, just going to do a final test

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Aug 7, 2025

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: patrickdillon

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 7, 2025
@patrickdillon
Copy link
Contributor

/lgtm

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Aug 7, 2025
@openshift-ci-robot
Copy link
Contributor

/retest-required

Remaining retests: 0 against base HEAD 97a12cf and 2 for PR HEAD 9ea9f83 in total

@openshift-merge-bot openshift-merge-bot bot merged commit 569bbc8 into openshift:main Aug 8, 2025
20 of 25 checks passed
@openshift-bot
Copy link
Contributor

[ART PR BUILD NOTIFIER]

Distgit: ose-installer
This PR has been included in build ose-installer-container-v4.20.0-202508080613.p0.g569bbc8.assembly.stream.el9.
All builds following this will include this PR.

@openshift-bot
Copy link
Contributor

[ART PR BUILD NOTIFIER]

Distgit: ose-baremetal-installer
This PR has been included in build ose-baremetal-installer-container-v4.20.0-202508080613.p0.g569bbc8.assembly.stream.el9.
All builds following this will include this PR.

@openshift-bot
Copy link
Contributor

[ART PR BUILD NOTIFIER]

Distgit: ose-installer-artifacts
This PR has been included in build ose-installer-artifacts-container-v4.20.0-202508080613.p0.g569bbc8.assembly.stream.el9.
All builds following this will include this PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants