[Starlingx-discuss] calicoctl / calico containers stx 6.0 aio duplex and wireguard - DONE!

M. Vefa Bicakci vefa.bicakci at windriver.com
Mon Aug 8 23:32:16 UTC 2022


Hi,

Sorry for the late response.

I understand that you are upset because Wireguard was enabled and then disabled during the development of StarlingX 6.0. I am a part of the team working on the kernel for StarlingX, and I can tell you that actually Wireguard was enabled accidentally during the switch to the v5.10 kernel, and then a clean-up commit disabled it again before the StarlingX 6.0 release.

If you would like, I can file a bug report and/or feature request on your behalf, to enable Wireguard, for consideration in the StarlingX 8.0 release cycle.

Regarding the deprecation of the mlx4 module and therefore Mellanox ConnectX-3 cards, I can only point you to our previous e-mail exchange at this link:

  https://lists.starlingx.io/pipermail/starlingx-discuss/2022-April/012906.html

Thank you,

Vefa

On 2022-07-25 08:40, Embedded Devel wrote:
> So literally after all the research I did on wireguard and a working model, in the dev lab, now i go to put it in production
> only to discover stx 6.0 has now literally disabled wireguard in the kernel, months of time and research is now wasted.
> 
> I even mentioned it back in september and was told to file a bug report on previous errors with wireguard loading, then a later pre 6.0 appeared to have it fixed, and now i find in 6.0 ...
> 
> # CONFIG_WIREGUARD is not set
> 
> completely useless waste of time as well as when you upgraded mellanox drivers to the latest version rendering thousands of $s in
> hardware useless to us for future revisions of starlingX, im sorry but i really have to say Ive gotten to the point where i ask why i bother
> supporting stx, championing stx, and deploying it for clients, Im sorry but i am beyond fscking pissed off right now!
> 
> 
> On Thursday 30 September 2021 11:41:20 AM (+07:00), Embedded Devel wrote:
> 
>> LOL Achievement unlocked ... it works now
>> steps to reproduce:
>> controller-0:~$ wget https://centos.pkgs.org/7/epel-testing-x86_64/wireguard-tools-1.0.20210914-1.el7.x86_64.rpm.html
> 
>>
>> controller-0:~$ sudo yum install -y wireguard-tools-1.0.20210914-1.el7.x86_64.rpm Loaded plugins: fastestmirror
>> Examining wireguard-tools-1.0.20210914-1.el7.x86_64.rpm: wireguard-tools-1.0.20210914-1.el7.x86_64
>> Marking wireguard-tools-1.0.20210914-1.el7.x86_64.rpm to be installed
>> Resolving Dependencies
>> --> Running transaction check
>> ---> Package wireguard-tools.x86_64 0:1.0.20210914-1.el7 will be installed
>> --> Finished Dependency Resolution
>>
>> Dependencies Resolved
>>
>> ===============================================================================================================================================================
> 
>> Package Arch Version Repository Size
>> ===============================================================================================================================================================
> 
>>
>> Installing:
>> wireguard-tools x86_64 1.0.20210914-1.el7 /wireguard-tools-1.0.20210914-1.el7.x86_64 291 k
>>
>> Transaction Summary
>> ===============================================================================================================================================================
> 
>>
>> Install 1 Package
>>
>> Total size: 291 k
>> Installed size: 291 k
>> Downloading packages:
>> Running transaction check
>> Running transaction test
>> Transaction test succeeded
>> Running transaction
>> Installing : wireguard-tools-1.0.20210914-1.el7.x86_64 1/1 Verifying : wireguard-tools-1.0.20210914-1.el7.x86_64 1/1
>> Installed:
>> wireguard-tools.x86_64 0:1.0.20210914-1.el7
>> controller-0:~$ curl -o kubectl-calico -O -L "https://github.com/projectcalico/calicoctl/releases/download/v3.19.1/calicoctl"
> 
>> % Total % Received % Xferd Average Speed Time Time Time Current
>> Dload Upload Total Spent Left Speed
>> 100 615 100 615 0 0 1930 0 --:--:-- --:--:-- --:--:-- 1933
>> 100 42.8M 100 42.8M 0 0 28.1M 0 0:00:01 0:00:01 --:--:-- 46.2M
>> controller-0:~$ chmod +x kubectl-calico
>> controller-0:~$ sudo mv kubectl-calico /bin/
>> controller-0:~$ kubectl calico patch felixconfiguration default --type='merge' -p '{"spec":{"wireguardEnabled":true}}'
>> Successfully patched 1 'FelixConfiguration' resource
>>
>> controller-0:~$ sudo wg
>> interface: wireguard.cali
>> public key: LcaQ5thd7yo4thPR/d0g4LHCnWwEfVsLJaaveeQnago=
>> private key: (hidden)
>> listening port: 51820
>> fwmark: 0x100000
>>
>> peer: n1+ugi4bv8Vfpnhfau7/Uaqm/9RqhmQnQ9U+7DoOsj8=
>> endpoint: 192.168.206.3:51820
>> allowed ips: 172.16.166.128/26, 172.16.166.128/32, 172.16.166.163/32
>> controller-0:~$
>> controller-1:~$ sudo wg
>> interface: wireguard.cali
>> public key: n1+ugi4bv8Vfpnhfau7/Uaqm/9RqhmQnQ9U+7DoOsj8=
>> private key: (hidden)
>> listening port: 51820
>> fwmark: 0x100000
>>
>> peer: LcaQ5thd7yo4thPR/d0g4LHCnWwEfVsLJaaveeQnago=
>> endpoint: 192.168.206.2:51820
>> allowed ips: 172.16.192.64/32, 172.16.192.64/26, 172.16.192.87/32
>> controller-1:~$
>>
>>
>>
>> On Thursday 30 September 2021 11:11:01 AM (+07:00), Embedded Devel wrote:
>>
>> > based on the calico documentation, https://docs.projectcalico.org/security/encrypt-cluster-pod-traffic we should be able to patch felix calicoctl patch felixconfiguration default --type='merge' -p '{"spec":{"wireguardEnabled":true}}'
>> >
>> > I have a pre-6 stx aio duplex deployed, wireguard does work, i yum installed wireguard-tools, i can bring up the wg interface
>> >
>> > so two things, how can we execute calico commands ? i see 0 documentation on it
>> >
>> > and two im curious what wireguard firewall rules for calico would look like.
>> >
>> > id imagine based on the docs
>> >
>> > cat <<EOF > gnp-oam-overrides.yaml
>> > apiVersion: crd.projectcalico.org/v1
>> > kind: GlobalNetworkPolicy
>> > metadata:
>> > name: wg-oam-overrides
>> > spec:
>> > ingress:
>> > - action: Allow
>> > destination:
>> > ports:
>> > - 51820
>> > protocol: UDP
>> > order: 500
>> > selector: has(iftype) && iftype == 'oam'
>> > types:
>> > - Ingress
>> > EOF
>> >
>> >
>> > when applied, i cannot connect a remote client to the OAM address, or the floating address
>> >
> 



More information about the Starlingx-discuss mailing list