[Starlingx-discuss] calicoctl / calico containers stx 6.0 aio duplex and wireguard - DONE!
Embedded Devel
lists at optimcloud.com
Tue Aug 9 00:59:42 UTC 2022
On Tuesday 09 August 2022 06:32:16 AM (+07:00), M. Vefa Bicakci wrote:
> Hi,
>
> Sorry for the late response.
>
> I understand that you are upset because Wireguard was enabled and then
disabled during the development of StarlingX 6.0. I am a part of the team
working on the kernel for StarlingX, and I can tell you that actually
Wireguard was enabled accidentally during the switch to the v5.10 kernel,
and then a clean-up commit disabled it again before the StarlingX 6.0
release.
>
> If you would like, I can file a bug report and/or feature request on
your behalf, to enable Wireguard, for consideration in the StarlingX 8.0
release cycle.
Please file a bug report on this so it makes it into the build, I have no
idea why you would even consider not having wireguard as part of the base,
There are numerous reasons why its a good fit for overlay and encryption,
it also is a very good fit for Calico and Althea, Are among the list of
reasons
where and why wireguard is just a good fit. If I can be assured it will
make it maybe I can salvage this work and save this contract. Right now we
put
pre-6 with wireguard into prod, yet i have no upgrade path. Very risky
move, but i wasnt going to leave that much money lost on the table. I hope
you all realize even us barely recognized consultants deploy startlingx and
we make a living of it, and your decisions directly impact out business.
Do you even realize I alone have lost over $50K in revenues due to
starlingx and bad decisions on the teams part. I wount even get into
starlingx
loosing out to kubernetes/openstack-helm for the likes of AT&T. Some of
your feature sets and controlled deployment points dont even fit with the
largest
US Telecomm giant, Its really quite sad honestly to see such a nice product
fail due to certain limitations imposed and bad design decisions. I would
seriously think manager at wind river itself would be kicking themselves
know you only fit 40% of the market, and failed at AT&T.
>
> Regarding the deprecation of the mlx4 module and therefore Mellanox
ConnectX-3 cards, I can only point you to our previous e-mail exchange at
this link:
>
>
https://lists.starlingx.io/pipermail/starlingx-discuss/2022-April/012906.html
>
> Thank you,
>
> Vefa
>
> On 2022-07-25 08:40, Embedded Devel wrote:
> > So literally after all the research I did on wireguard and a working
model, in the dev lab, now i go to put it in production
> > only to discover stx 6.0 has now literally disabled wireguard in the
kernel, months of time and research is now wasted.
> >
> > I even mentioned it back in september and was told to file a bug
report on previous errors with wireguard loading, then a later pre 6.0
appeared to have it fixed, and now i find in 6.0 ...
> >
> > # CONFIG_WIREGUARD is not set
> >
> > completely useless waste of time as well as when you upgraded mellanox
drivers to the latest version rendering thousands of $s in
> > hardware useless to us for future revisions of starlingX, im sorry but
i really have to say Ive gotten to the point where i ask why i bother
> > supporting stx, championing stx, and deploying it for clients, Im
sorry but i am beyond fscking pissed off right now!
> >
> >
> > On Thursday 30 September 2021 11:41:20 AM (+07:00), Embedded Devel
wrote:
> >
> >> LOL Achievement unlocked ... it works now
> >> steps to reproduce:
> >> controller-0:~$ wget
https://centos.pkgs.org/7/epel-testing-x86_64/wireguard-tools-1.0.20210914-1.el7.x86_64.rpm.html
> >
> >>
> >> controller-0:~$ sudo yum install -y
wireguard-tools-1.0.20210914-1.el7.x86_64.rpm Loaded plugins: fastestmirror
> >> Examining wireguard-tools-1.0.20210914-1.el7.x86_64.rpm:
wireguard-tools-1.0.20210914-1.el7.x86_64
> >> Marking wireguard-tools-1.0.20210914-1.el7.x86_64.rpm to be installed
> >> Resolving Dependencies
> >> --> Running transaction check
> >> ---> Package wireguard-tools.x86_64 0:1.0.20210914-1.el7 will be
installed
> >> --> Finished Dependency Resolution
> >>
> >> Dependencies Resolved
> >>
> >>
===============================================================================================================================================================
> >
> >> Package Arch Version Repository Size
> >>
===============================================================================================================================================================
> >
> >>
> >> Installing:
> >> wireguard-tools x86_64 1.0.20210914-1.el7
/wireguard-tools-1.0.20210914-1.el7.x86_64 291 k
> >>
> >> Transaction Summary
> >>
===============================================================================================================================================================
> >
> >>
> >> Install 1 Package
> >>
> >> Total size: 291 k
> >> Installed size: 291 k
> >> Downloading packages:
> >> Running transaction check
> >> Running transaction test
> >> Transaction test succeeded
> >> Running transaction
> >> Installing : wireguard-tools-1.0.20210914-1.el7.x86_64 1/1 Verifying
: wireguard-tools-1.0.20210914-1.el7.x86_64 1/1
> >> Installed:
> >> wireguard-tools.x86_64 0:1.0.20210914-1.el7
> >> controller-0:~$ curl -o kubectl-calico -O -L
"https://github.com/projectcalico/calicoctl/releases/download/v3.19.1/calicoctl"
> >
> >> % Total % Received % Xferd Average Speed Time Time Time Current
> >> Dload Upload Total Spent Left Speed
> >> 100 615 100 615 0 0 1930 0 --:--:-- --:--:-- --:--:-- 1933
> >> 100 42.8M 100 42.8M 0 0 28.1M 0 0:00:01 0:00:01 --:--:-- 46.2M
> >> controller-0:~$ chmod +x kubectl-calico
> >> controller-0:~$ sudo mv kubectl-calico /bin/
> >> controller-0:~$ kubectl calico patch felixconfiguration default
--type='merge' -p '{"spec":{"wireguardEnabled":true}}'
> >> Successfully patched 1 'FelixConfiguration' resource
> >>
> >> controller-0:~$ sudo wg
> >> interface: wireguard.cali
> >> public key: LcaQ5thd7yo4thPR/d0g4LHCnWwEfVsLJaaveeQnago=
> >> private key: (hidden)
> >> listening port: 51820
> >> fwmark: 0x100000
> >>
> >> peer: n1+ugi4bv8Vfpnhfau7/Uaqm/9RqhmQnQ9U+7DoOsj8=
> >> endpoint: 192.168.206.3:51820
> >> allowed ips: 172.16.166.128/26, 172.16.166.128/32, 172.16.166.163/32
> >> controller-0:~$
> >> controller-1:~$ sudo wg
> >> interface: wireguard.cali
> >> public key: n1+ugi4bv8Vfpnhfau7/Uaqm/9RqhmQnQ9U+7DoOsj8=
> >> private key: (hidden)
> >> listening port: 51820
> >> fwmark: 0x100000
> >>
> >> peer: LcaQ5thd7yo4thPR/d0g4LHCnWwEfVsLJaaveeQnago=
> >> endpoint: 192.168.206.2:51820
> >> allowed ips: 172.16.192.64/32, 172.16.192.64/26, 172.16.192.87/32
> >> controller-1:~$
> >>
> >>
> >>
> >> On Thursday 30 September 2021 11:11:01 AM (+07:00), Embedded Devel
wrote:
> >>
> >> > based on the calico documentation,
https://docs.projectcalico.org/security/encrypt-cluster-pod-traffic we
should be able to patch felix calicoctl patch felixconfiguration default
--type='merge' -p '{"spec":{"wireguardEnabled":true}}'
> >> >
> >> > I have a pre-6 stx aio duplex deployed, wireguard does work, i yum
installed wireguard-tools, i can bring up the wg interface
> >> >
> >> > so two things, how can we execute calico commands ? i see 0
documentation on it
> >> >
> >> > and two im curious what wireguard firewall rules for calico would
look like.
> >> >
> >> > id imagine based on the docs
> >> >
> >> > cat <<EOF > gnp-oam-overrides.yaml
> >> > apiVersion: crd.projectcalico.org/v1
> >> > kind: GlobalNetworkPolicy
> >> > metadata:
> >> > name: wg-oam-overrides
> >> > spec:
> >> > ingress:
> >> > - action: Allow
> >> > destination:
> >> > ports:
> >> > - 51820
> >> > protocol: UDP
> >> > order: 500
> >> > selector: has(iftype) && iftype == 'oam'
> >> > types:
> >> > - Ingress
> >> > EOF
> >> >
> >> >
> >> > when applied, i cannot connect a remote client to the OAM address,
or the floating address
> >> >
> >
>
> _______________________________________________
> Starlingx-discuss mailing list
> Starlingx-discuss at lists.starlingx.io
> https://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss
>
--
Sent with Vivaldi Mail. Download Vivaldi for free at vivaldi.com
More information about the Starlingx-discuss
mailing list