-
Bug
-
Resolution: Not a Bug
-
Undefined
-
None
-
4.15
-
Quality / Stability / Reliability
-
False
-
-
None
-
Important
-
No
-
None
-
None
-
Proposed
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
Description of problem:
nmstate operator was deployed to configure IPSec transport tunnel Following are rpm versions sh-5.1# rpm -qa | grep -i "nmst\|libre" libref_array-0.1.5-53.el9.x86_64 libreport-filesystem-2.15.2-6.el9.noarch librepo-1.14.5-1.el9.x86_64 nmstate-2.2.23-1.el9_2.x86_64 libreswan-4.9-4.el9_2.x86_64 NetworkManager-libreswan-1.2.14-3.el9_2.x86_64
Version-Release number of selected component (if applicable):
4.15.0-0.nightly-2024-01-24-103216
How reproducible:
Always
Steps to Reproduce:
1.Enable IPSec mode Full on OCP
2.Deploy nmstate operator
2.Create nncp object for ipsec policy
[anusaxen@anusaxen ~]$ cat try.yaml
kind: NodeNetworkConfigurationPolicy
apiVersion: nmstate.io/v1
metadata:
name: "ipsec-policy1"
spec:
nodeSelector:
kubernetes.io/hostname: "ipsec-testpr65-8b2sk-worker-b-wlrwt"
desiredState:
interfaces:
- name: pluto-VM
type: ipsec
libreswan:
left: 10.0.128.2
leftid: '%fromcert'
leftmodecfgclient: no
leftrsasigkey: '%cert'
leftcert: "10_0_128_2"
right: 10.0.0.2
rightid: '%fromcert'
rightrsasigkey: '%cert'
rightsubnet: 10.0.0.2/32
ikev2: insist
type: transport
3. $ oc get nncp
NAME STATUS REASON
ipsec-policy1 Available SuccessfullyConfigured
4. oc debug on node and check ipsec status (tunnel up)
000 #30: "2db7541a-0a33-4373-8a85-f64b796ff02a":500 STATE_V2_ESTABLISHED_IKE_SA (established IKE SA); REKEY in 27197s; REPLACE in 28217s; newest; idle;
000 #31: "2db7541a-0a33-4373-8a85-f64b796ff02a":500 STATE_V2_ESTABLISHED_CHILD_SA (established Child SA); REKEY in 27208s; REPLACE in 28217s; newest; eroute owner; IKE SA #30; idle;
000 #31: "2db7541a-0a33-4373-8a85-f64b796ff02a" esp.d7d3cac0@10.0.0.2 esp.3edc1329@10.0.128.2 Traffic: ESPin=64B ESPout=64B ESPmax=2^63B
5. oc delete nncp ipsec-policy1
6. above tunnel IPSec SA remains up and traffic continues to be encrypted
Actual results:
Tunnel is not terminated post nncp object deletion
Expected results:
Tunnel should be terminated post nncp object deletion
Additional info:
restarting ipsec.service terminates the tunnel