-
Bug
-
Resolution: Unresolved
-
Undefined
-
None
-
4.14
-
None
-
False
-
Background:
At large scale (500 nodes) we see issues where ipsec pods once created check for Approved CSRs.
Currently the CSRs never get approved and that is being tracked here https://issues.redhat.com/browse/OCPBUGS-36404
The workaround for that is approving the CSRs manually, once approved ipsec pods should get into Ready state. The issue here is that ipsec pods doesnt wait for 60 seconds which is being addressed here https://github.com/openshift/cluster-network-operator/pull/2481.
Description of problem:
Now, even with the above manual approval and wait we should still utilize the already created CSRs and not create the new ones as this overwhelms the system at higher node scales
Version-Release number of selected component (if applicable):
4.14.0-0.nightly-2024-10-07-005809
How reproducible:
Always
Steps to Reproduce:
1. Enable ipsec or restart ipsec daemonset at 500 node scale
2. See if ds comes up
Actual results:
ipsec pods do not come up as they are stuck with the above issue
Expected results:
ipsec pods come up without going into Crashloop