Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-42989

Ipsec containers do not check for already present CSRs

XMLWordPrintable

    • None
    • False
    • Hide

      None

      Show
      None

      Background: 
      At large scale (500 nodes) we see issues where ipsec pods once created check for Approved CSRs.
      Currently the CSRs never get approved and that is being tracked here https://issues.redhat.com/browse/OCPBUGS-36404 
      The workaround for that is approving the CSRs manually, once approved ipsec pods should get into Ready state. The issue here is that ipsec pods doesnt wait for 60 seconds which is being addressed here https://github.com/openshift/cluster-network-operator/pull/2481.

      Description of problem:
      Now, even with the above manual approval and wait we should still utilize the already created CSRs and not create the new ones as this overwhelms the system at higher node scales

      Version-Release number of selected component (if applicable):

      4.14.0-0.nightly-2024-10-07-005809

      How reproducible:

      Always

      Steps to Reproduce:

      1. Enable ipsec or restart ipsec daemonset at 500 node scale

      2. See if ds comes up

      Actual results:

      ipsec pods do not come up as they are stuck with the above issue 

      Expected results:

      ipsec pods come up without going into Crashloop

              trozet@redhat.com Tim Rozet
              mohit-sheth Mohit Jitendra Sheth
              Anurag Saxena Anurag Saxena
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated: