-
Bug
-
Resolution: Not a Bug
-
Undefined
-
None
-
4.15
-
Important
-
No
-
Proposed
-
False
-
Description of problem:
nmstate operator was deployed to configure IPSec transport tunnel Following are rpm versions sh-5.1# rpm -qa | grep -i "nmst\|libre" libref_array-0.1.5-53.el9.x86_64 libreport-filesystem-2.15.2-6.el9.noarch librepo-1.14.5-1.el9.x86_64 nmstate-2.2.23-1.el9_2.x86_64 libreswan-4.9-4.el9_2.x86_64 NetworkManager-libreswan-1.2.14-3.el9_2.x86_64
Version-Release number of selected component (if applicable):
4.15.0-0.nightly-2024-01-24-103216
How reproducible:
Always
Steps to Reproduce:
1.Enable IPSec mode Full on OCP 2.Deploy nmstate operator 2.Create nncp object for ipsec policy [anusaxen@anusaxen ~]$ cat try.yaml kind: NodeNetworkConfigurationPolicy apiVersion: nmstate.io/v1 metadata: name: "ipsec-policy1" spec: nodeSelector: kubernetes.io/hostname: "ipsec-testpr65-8b2sk-worker-b-wlrwt" desiredState: interfaces: - name: pluto-VM type: ipsec libreswan: left: 10.0.128.2 leftid: '%fromcert' leftmodecfgclient: no leftrsasigkey: '%cert' leftcert: "10_0_128_2" right: 10.0.0.2 rightid: '%fromcert' rightrsasigkey: '%cert' rightsubnet: 10.0.0.2/32 ikev2: insist type: transport 3. $ oc get nncp NAME STATUS REASON ipsec-policy1 Available SuccessfullyConfigured 4. oc debug on node and check ipsec status (tunnel up) 000 #30: "2db7541a-0a33-4373-8a85-f64b796ff02a":500 STATE_V2_ESTABLISHED_IKE_SA (established IKE SA); REKEY in 27197s; REPLACE in 28217s; newest; idle; 000 #31: "2db7541a-0a33-4373-8a85-f64b796ff02a":500 STATE_V2_ESTABLISHED_CHILD_SA (established Child SA); REKEY in 27208s; REPLACE in 28217s; newest; eroute owner; IKE SA #30; idle; 000 #31: "2db7541a-0a33-4373-8a85-f64b796ff02a" esp.d7d3cac0@10.0.0.2 esp.3edc1329@10.0.128.2 Traffic: ESPin=64B ESPout=64B ESPmax=2^63B 5. oc delete nncp ipsec-policy1 6. above tunnel IPSec SA remains up and traffic continues to be encrypted
Actual results:
Tunnel is not terminated post nncp object deletion
Expected results:
Tunnel should be terminated post nncp object deletion
Additional info:
restarting ipsec.service terminates the tunnel