[Starlingx-discuss] calicoctl / calico containers stx 6.0 aio duplex and wireguard
based on the calico documentation, https://docs.projectcalico.org/security/encrypt-cluster-pod-traffic we should be able to patch felix calicoctl patch felixconfiguration default --type='merge' -p '{"spec":{"wireguardEnabled":true}}' I have a pre-6 stx aio duplex deployed, wireguard does work, i yum installed wireguard-tools, i can bring up the wg interface so two things, how can we execute calico commands ? i see 0 documentation on it and two im curious what wireguard firewall rules for calico would look like. id imagine based on the docs cat <<EOF > gnp-oam-overrides.yaml apiVersion: crd.projectcalico.org/v1 kind: GlobalNetworkPolicy metadata: name: wg-oam-overrides spec: ingress: - action: Allow destination: ports: - 51820 protocol: UDP order: 500 selector: has(iftype) && iftype == 'oam' types: - Ingress EOF when applied, i cannot connect a remote client to the OAM address, or the floating address -- Sent with Vivaldi Mail. Download Vivaldi for free at vivaldi.com
based on the calico documentation, https://docs.projectcalico.org/security/encrypt-cluster-pod-traffic we should be able to patch felix calicoctl patch felixconfiguration default --type='merge' -p '{"spec":{"wireguardEnabled":true}}'
I have a pre-6 stx aio duplex deployed, wireguard does work, i yum installed wireguard-tools, i can bring up the wg interface
so two things, how can we execute calico commands ? i see 0 documentation on it
and two im curious what wireguard firewall rules for calico would look
LOL Achievement unlocked ... it works now steps to reproduce: controller-0:~$ wget https://centos.pkgs.org/7/epel-testing-x86_64/wireguard-tools-1.0.20210914-1... controller-0:~$ sudo yum install -y wireguard-tools-1.0.20210914-1.el7.x86_64.rpm Loaded plugins: fastestmirror Examining wireguard-tools-1.0.20210914-1.el7.x86_64.rpm: wireguard-tools-1.0.20210914-1.el7.x86_64 Marking wireguard-tools-1.0.20210914-1.el7.x86_64.rpm to be installed Resolving Dependencies --> Running transaction check ---> Package wireguard-tools.x86_64 0:1.0.20210914-1.el7 will be installed --> Finished Dependency Resolution Dependencies Resolved =============================================================================================================================================================== Package Arch Version Repository Size =============================================================================================================================================================== Installing: wireguard-tools x86_64 1.0.20210914-1.el7 /wireguard-tools-1.0.20210914-1.el7.x86_64 291 k Transaction Summary =============================================================================================================================================================== Install 1 Package Total size: 291 k Installed size: 291 k Downloading packages: Running transaction check Running transaction test Transaction test succeeded Running transaction Installing : wireguard-tools-1.0.20210914-1.el7.x86_64 1/1 Verifying : wireguard-tools-1.0.20210914-1.el7.x86_64 1/1 Installed: wireguard-tools.x86_64 0:1.0.20210914-1.el7 controller-0:~$ curl -o kubectl-calico -O -L "https://github.com/projectcalico/calicoctl/releases/download/v3.19.1/calicoc..." % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 615 100 615 0 0 1930 0 --:--:-- --:--:-- --:--:-- 1933 100 42.8M 100 42.8M 0 0 28.1M 0 0:00:01 0:00:01 --:--:-- 46.2M controller-0:~$ chmod +x kubectl-calico controller-0:~$ sudo mv kubectl-calico /bin/ controller-0:~$ kubectl calico patch felixconfiguration default --type='merge' -p '{"spec":{"wireguardEnabled":true}}' Successfully patched 1 'FelixConfiguration' resource controller-0:~$ sudo wg interface: wireguard.cali public key: LcaQ5thd7yo4thPR/d0g4LHCnWwEfVsLJaaveeQnago= private key: (hidden) listening port: 51820 fwmark: 0x100000 peer: n1+ugi4bv8Vfpnhfau7/Uaqm/9RqhmQnQ9U+7DoOsj8= endpoint: 192.168.206.3:51820 allowed ips: 172.16.166.128/26, 172.16.166.128/32, 172.16.166.163/32 controller-0:~$ controller-1:~$ sudo wg interface: wireguard.cali public key: n1+ugi4bv8Vfpnhfau7/Uaqm/9RqhmQnQ9U+7DoOsj8= private key: (hidden) listening port: 51820 fwmark: 0x100000 peer: LcaQ5thd7yo4thPR/d0g4LHCnWwEfVsLJaaveeQnago= endpoint: 192.168.206.2:51820 allowed ips: 172.16.192.64/32, 172.16.192.64/26, 172.16.192.87/32 controller-1:~$ On Thursday 30 September 2021 11:11:01 AM (+07:00), Embedded Devel wrote: like.
id imagine based on the docs
cat <<EOF > gnp-oam-overrides.yaml apiVersion: crd.projectcalico.org/v1 kind: GlobalNetworkPolicy metadata: name: wg-oam-overrides spec: ingress: - action: Allow destination: ports: - 51820 protocol: UDP order: 500 selector: has(iftype) && iftype == 'oam' types: - Ingress EOF
when applied, i cannot connect a remote client to the OAM address, or
the floating address
-- Sent with Vivaldi Mail. Download Vivaldi for free at vivaldi.com
So literally after all the research I did on wireguard and a working model, in the dev lab, now i go to put it in production only to discover stx 6.0 has now literally disabled wireguard in the kernel, months of time and research is now wasted. I even mentioned it back in september and was told to file a bug report on previous errors with wireguard loading, then a later pre 6.0 appeared to have it fixed, and now i find in 6.0 ... # CONFIG_WIREGUARD is not set completely useless waste of time as well as when you upgraded mellanox drivers to the latest version rendering thousands of $s in hardware useless to us for future revisions of starlingX, im sorry but i really have to say Ive gotten to the point where i ask why i bother supporting stx, championing stx, and deploying it for clients, Im sorry but i am beyond fscking pissed off right now! On Thursday 30 September 2021 11:41:20 AM (+07:00), Embedded Devel wrote:
LOL Achievement unlocked ... it works now steps to reproduce: controller-0:~$ wget https://centos.pkgs.org/7/epel-testing-x86_64/wireguard-tools-1.0.20210914-1...
controller-0:~$ sudo yum install -y
wireguard-tools-1.0.20210914-1.el7.x86_64.rpm Loaded plugins: fastestmirror
Examining wireguard-tools-1.0.20210914-1.el7.x86_64.rpm: wireguard-tools-1.0.20210914-1.el7.x86_64 Marking wireguard-tools-1.0.20210914-1.el7.x86_64.rpm to be installed Resolving Dependencies --> Running transaction check ---> Package wireguard-tools.x86_64 0:1.0.20210914-1.el7 will be installed --> Finished Dependency Resolution
Dependencies Resolved
===============================================================================================================================================================
Package Arch Version Repository Size
===============================================================================================================================================================
Installing: wireguard-tools x86_64 1.0.20210914-1.el7
/wireguard-tools-1.0.20210914-1.el7.x86_64 291 k
Transaction Summary
===============================================================================================================================================================
Install 1 Package
Total size: 291 k Installed size: 291 k Downloading packages: Running transaction check Running transaction test Transaction test succeeded Running transaction Installing : wireguard-tools-1.0.20210914-1.el7.x86_64 1/1 Verifying :
wireguard-tools-1.0.20210914-1.el7.x86_64 1/1
Installed: wireguard-tools.x86_64 0:1.0.20210914-1.el7 controller-0:~$ curl -o kubectl-calico -O -L "https://github.com/projectcalico/calicoctl/releases/download/v3.19.1/calicoc..."
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 615 100 615 0 0 1930 0 --:--:-- --:--:-- --:--:-- 1933 100 42.8M 100 42.8M 0 0 28.1M 0 0:00:01 0:00:01 --:--:-- 46.2M controller-0:~$ chmod +x kubectl-calico controller-0:~$ sudo mv kubectl-calico /bin/ controller-0:~$ kubectl calico patch felixconfiguration default --type='merge' -p '{"spec":{"wireguardEnabled":true}}' Successfully patched 1 'FelixConfiguration' resource
controller-0:~$ sudo wg interface: wireguard.cali public key: LcaQ5thd7yo4thPR/d0g4LHCnWwEfVsLJaaveeQnago= private key: (hidden) listening port: 51820 fwmark: 0x100000
peer: n1+ugi4bv8Vfpnhfau7/Uaqm/9RqhmQnQ9U+7DoOsj8= endpoint: 192.168.206.3:51820 allowed ips: 172.16.166.128/26, 172.16.166.128/32, 172.16.166.163/32 controller-0:~$ controller-1:~$ sudo wg interface: wireguard.cali public key: n1+ugi4bv8Vfpnhfau7/Uaqm/9RqhmQnQ9U+7DoOsj8= private key: (hidden) listening port: 51820 fwmark: 0x100000
peer: LcaQ5thd7yo4thPR/d0g4LHCnWwEfVsLJaaveeQnago= endpoint: 192.168.206.2:51820 allowed ips: 172.16.192.64/32, 172.16.192.64/26, 172.16.192.87/32 controller-1:~$
On Thursday 30 September 2021 11:11:01 AM (+07:00), Embedded Devel wrote:
based on the calico documentation, https://docs.projectcalico.org/security/encrypt-cluster-pod-traffic we should be able to patch felix calicoctl patch felixconfiguration default --type='merge' -p '{"spec":{"wireguardEnabled":true}}'
I have a pre-6 stx aio duplex deployed, wireguard does work, i yum installed wireguard-tools, i can bring up the wg interface
so two things, how can we execute calico commands ? i see 0 documentation on it
and two im curious what wireguard firewall rules for calico would look like.
id imagine based on the docs
cat <<EOF > gnp-oam-overrides.yaml apiVersion: crd.projectcalico.org/v1 kind: GlobalNetworkPolicy metadata: name: wg-oam-overrides spec: ingress: - action: Allow destination: ports: - 51820 protocol: UDP order: 500 selector: has(iftype) && iftype == 'oam' types: - Ingress EOF
when applied, i cannot connect a remote client to the OAM address, or the floating address
-- Sent with Vivaldi Mail. Download Vivaldi for free at vivaldi.com
Hi, Sorry for the late response. I understand that you are upset because Wireguard was enabled and then disabled during the development of StarlingX 6.0. I am a part of the team working on the kernel for StarlingX, and I can tell you that actually Wireguard was enabled accidentally during the switch to the v5.10 kernel, and then a clean-up commit disabled it again before the StarlingX 6.0 release. If you would like, I can file a bug report and/or feature request on your behalf, to enable Wireguard, for consideration in the StarlingX 8.0 release cycle. Regarding the deprecation of the mlx4 module and therefore Mellanox ConnectX-3 cards, I can only point you to our previous e-mail exchange at this link: https://lists.starlingx.io/pipermail/starlingx-discuss/2022-April/012906.htm... Thank you, Vefa On 2022-07-25 08:40, Embedded Devel wrote:
So literally after all the research I did on wireguard and a working model, in the dev lab, now i go to put it in production only to discover stx 6.0 has now literally disabled wireguard in the kernel, months of time and research is now wasted.
I even mentioned it back in september and was told to file a bug report on previous errors with wireguard loading, then a later pre 6.0 appeared to have it fixed, and now i find in 6.0 ...
# CONFIG_WIREGUARD is not set
completely useless waste of time as well as when you upgraded mellanox drivers to the latest version rendering thousands of $s in hardware useless to us for future revisions of starlingX, im sorry but i really have to say Ive gotten to the point where i ask why i bother supporting stx, championing stx, and deploying it for clients, Im sorry but i am beyond fscking pissed off right now!
On Thursday 30 September 2021 11:41:20 AM (+07:00), Embedded Devel wrote:
LOL Achievement unlocked ... it works now steps to reproduce: controller-0:~$ wget https://centos.pkgs.org/7/epel-testing-x86_64/wireguard-tools-1.0.20210914-1...
controller-0:~$ sudo yum install -y wireguard-tools-1.0.20210914-1.el7.x86_64.rpm Loaded plugins: fastestmirror Examining wireguard-tools-1.0.20210914-1.el7.x86_64.rpm: wireguard-tools-1.0.20210914-1.el7.x86_64 Marking wireguard-tools-1.0.20210914-1.el7.x86_64.rpm to be installed Resolving Dependencies --> Running transaction check ---> Package wireguard-tools.x86_64 0:1.0.20210914-1.el7 will be installed --> Finished Dependency Resolution
Dependencies Resolved
===============================================================================================================================================================
Package Arch Version Repository Size ===============================================================================================================================================================
Installing: wireguard-tools x86_64 1.0.20210914-1.el7 /wireguard-tools-1.0.20210914-1.el7.x86_64 291 k
Transaction Summary ===============================================================================================================================================================
Install 1 Package
Total size: 291 k Installed size: 291 k Downloading packages: Running transaction check Running transaction test Transaction test succeeded Running transaction Installing : wireguard-tools-1.0.20210914-1.el7.x86_64 1/1 Verifying : wireguard-tools-1.0.20210914-1.el7.x86_64 1/1 Installed: wireguard-tools.x86_64 0:1.0.20210914-1.el7 controller-0:~$ curl -o kubectl-calico -O -L "https://github.com/projectcalico/calicoctl/releases/download/v3.19.1/calicoc..."
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 615 100 615 0 0 1930 0 --:--:-- --:--:-- --:--:-- 1933 100 42.8M 100 42.8M 0 0 28.1M 0 0:00:01 0:00:01 --:--:-- 46.2M controller-0:~$ chmod +x kubectl-calico controller-0:~$ sudo mv kubectl-calico /bin/ controller-0:~$ kubectl calico patch felixconfiguration default --type='merge' -p '{"spec":{"wireguardEnabled":true}}' Successfully patched 1 'FelixConfiguration' resource
controller-0:~$ sudo wg interface: wireguard.cali public key: LcaQ5thd7yo4thPR/d0g4LHCnWwEfVsLJaaveeQnago= private key: (hidden) listening port: 51820 fwmark: 0x100000
peer: n1+ugi4bv8Vfpnhfau7/Uaqm/9RqhmQnQ9U+7DoOsj8= endpoint: 192.168.206.3:51820 allowed ips: 172.16.166.128/26, 172.16.166.128/32, 172.16.166.163/32 controller-0:~$ controller-1:~$ sudo wg interface: wireguard.cali public key: n1+ugi4bv8Vfpnhfau7/Uaqm/9RqhmQnQ9U+7DoOsj8= private key: (hidden) listening port: 51820 fwmark: 0x100000
peer: LcaQ5thd7yo4thPR/d0g4LHCnWwEfVsLJaaveeQnago= endpoint: 192.168.206.2:51820 allowed ips: 172.16.192.64/32, 172.16.192.64/26, 172.16.192.87/32 controller-1:~$
On Thursday 30 September 2021 11:11:01 AM (+07:00), Embedded Devel wrote:
based on the calico documentation, https://docs.projectcalico.org/security/encrypt-cluster-pod-traffic we should be able to patch felix calicoctl patch felixconfiguration default --type='merge' -p '{"spec":{"wireguardEnabled":true}}'
I have a pre-6 stx aio duplex deployed, wireguard does work, i yum installed wireguard-tools, i can bring up the wg interface
so two things, how can we execute calico commands ? i see 0 documentation on it
and two im curious what wireguard firewall rules for calico would look like.
id imagine based on the docs
cat <<EOF > gnp-oam-overrides.yaml apiVersion: crd.projectcalico.org/v1 kind: GlobalNetworkPolicy metadata: name: wg-oam-overrides spec: ingress: - action: Allow destination: ports: - 51820 protocol: UDP order: 500 selector: has(iftype) && iftype == 'oam' types: - Ingress EOF
when applied, i cannot connect a remote client to the OAM address, or the floating address
Hi,
Sorry for the late response.
I understand that you are upset because Wireguard was enabled and then disabled during the development of StarlingX 6.0. I am a part of the team working on the kernel for StarlingX, and I can tell you that actually Wireguard was enabled accidentally during the switch to the v5.10 kernel, and then a clean-up commit disabled it again before the StarlingX 6.0 release.
If you would like, I can file a bug report and/or feature request on your behalf, to enable Wireguard, for consideration in the StarlingX 8.0 release cycle. Please file a bug report on this so it makes it into the build, I have no idea why you would even consider not having wireguard as part of the base, There are numerous reasons why its a good fit for overlay and encryption, it also is a very good fit for Calico and Althea, Are among the list of reasons where and why wireguard is just a good fit. If I can be assured it will make it maybe I can salvage this work and save this contract. Right now we
On Tuesday 09 August 2022 06:32:16 AM (+07:00), M. Vefa Bicakci wrote: put pre-6 with wireguard into prod, yet i have no upgrade path. Very risky move, but i wasnt going to leave that much money lost on the table. I hope you all realize even us barely recognized consultants deploy startlingx and we make a living of it, and your decisions directly impact out business. Do you even realize I alone have lost over $50K in revenues due to starlingx and bad decisions on the teams part. I wount even get into starlingx loosing out to kubernetes/openstack-helm for the likes of AT&T. Some of your feature sets and controlled deployment points dont even fit with the largest US Telecomm giant, Its really quite sad honestly to see such a nice product fail due to certain limitations imposed and bad design decisions. I would seriously think manager at wind river itself would be kicking themselves know you only fit 40% of the market, and failed at AT&T.
Regarding the deprecation of the mlx4 module and therefore Mellanox
ConnectX-3 cards, I can only point you to our previous e-mail exchange at this link:
https://lists.starlingx.io/pipermail/starlingx-discuss/2022-April/012906.htm...
Thank you,
Vefa
On 2022-07-25 08:40, Embedded Devel wrote:
So literally after all the research I did on wireguard and a working
model, in the dev lab, now i go to put it in production
only to discover stx 6.0 has now literally disabled wireguard in the kernel, months of time and research is now wasted.
I even mentioned it back in september and was told to file a bug report on previous errors with wireguard loading, then a later pre 6.0 appeared to have it fixed, and now i find in 6.0 ...
# CONFIG_WIREGUARD is not set
completely useless waste of time as well as when you upgraded mellanox drivers to the latest version rendering thousands of $s in hardware useless to us for future revisions of starlingX, im sorry but i really have to say Ive gotten to the point where i ask why i bother supporting stx, championing stx, and deploying it for clients, Im sorry but i am beyond fscking pissed off right now!
On Thursday 30 September 2021 11:41:20 AM (+07:00), Embedded Devel wrote:
LOL Achievement unlocked ... it works now steps to reproduce: controller-0:~$ wget https://centos.pkgs.org/7/epel-testing-x86_64/wireguard-tools-1.0.20210914-1...
controller-0:~$ sudo yum install -y
wireguard-tools-1.0.20210914-1.el7.x86_64.rpm Loaded plugins: fastestmirror
Examining wireguard-tools-1.0.20210914-1.el7.x86_64.rpm: wireguard-tools-1.0.20210914-1.el7.x86_64 Marking wireguard-tools-1.0.20210914-1.el7.x86_64.rpm to be installed Resolving Dependencies --> Running transaction check ---> Package wireguard-tools.x86_64 0:1.0.20210914-1.el7 will be installed --> Finished Dependency Resolution
Dependencies Resolved
===============================================================================================================================================================
Package Arch Version Repository Size
===============================================================================================================================================================
Installing: wireguard-tools x86_64 1.0.20210914-1.el7
/wireguard-tools-1.0.20210914-1.el7.x86_64 291 k
Transaction Summary
===============================================================================================================================================================
Install 1 Package
Total size: 291 k Installed size: 291 k Downloading packages: Running transaction check Running transaction test Transaction test succeeded Running transaction Installing : wireguard-tools-1.0.20210914-1.el7.x86_64 1/1 Verifying
: wireguard-tools-1.0.20210914-1.el7.x86_64 1/1
Installed: wireguard-tools.x86_64 0:1.0.20210914-1.el7 controller-0:~$ curl -o kubectl-calico -O -L "https://github.com/projectcalico/calicoctl/releases/download/v3.19.1/calicoc..."
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 615 100 615 0 0 1930 0 --:--:-- --:--:-- --:--:-- 1933 100 42.8M 100 42.8M 0 0 28.1M 0 0:00:01 0:00:01 --:--:-- 46.2M controller-0:~$ chmod +x kubectl-calico controller-0:~$ sudo mv kubectl-calico /bin/ controller-0:~$ kubectl calico patch felixconfiguration default
--type='merge' -p '{"spec":{"wireguardEnabled":true}}'
Successfully patched 1 'FelixConfiguration' resource
controller-0:~$ sudo wg interface: wireguard.cali public key: LcaQ5thd7yo4thPR/d0g4LHCnWwEfVsLJaaveeQnago= private key: (hidden) listening port: 51820 fwmark: 0x100000
peer: n1+ugi4bv8Vfpnhfau7/Uaqm/9RqhmQnQ9U+7DoOsj8= endpoint: 192.168.206.3:51820 allowed ips: 172.16.166.128/26, 172.16.166.128/32, 172.16.166.163/32 controller-0:~$ controller-1:~$ sudo wg interface: wireguard.cali public key: n1+ugi4bv8Vfpnhfau7/Uaqm/9RqhmQnQ9U+7DoOsj8= private key: (hidden) listening port: 51820 fwmark: 0x100000
peer: LcaQ5thd7yo4thPR/d0g4LHCnWwEfVsLJaaveeQnago= endpoint: 192.168.206.2:51820 allowed ips: 172.16.192.64/32, 172.16.192.64/26, 172.16.192.87/32 controller-1:~$
On Thursday 30 September 2021 11:11:01 AM (+07:00), Embedded Devel wrote:
based on the calico documentation, https://docs.projectcalico.org/security/encrypt-cluster-pod-traffic we should be able to patch felix calicoctl patch felixconfiguration default --type='merge' -p '{"spec":{"wireguardEnabled":true}}'
I have a pre-6 stx aio duplex deployed, wireguard does work, i yum installed wireguard-tools, i can bring up the wg interface
so two things, how can we execute calico commands ? i see 0 documentation on it
and two im curious what wireguard firewall rules for calico would look like.
id imagine based on the docs
cat <<EOF > gnp-oam-overrides.yaml apiVersion: crd.projectcalico.org/v1 kind: GlobalNetworkPolicy metadata: name: wg-oam-overrides spec: ingress: - action: Allow destination: ports: - 51820 protocol: UDP order: 500 selector: has(iftype) && iftype == 'oam' types: - Ingress EOF
when applied, i cannot connect a remote client to the OAM address, or the floating address
_______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io https://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss
-- Sent with Vivaldi Mail. Download Vivaldi for free at vivaldi.com
Hi all, I had opened the following feature request/bug on Launchpad about two days ago. Sorry for the delay in my notification. The bug report requesting that the CONFIG_WIREGUARD kernel configuration option be enabled is here: https://bugs.launchpad.net/starlingx/+bug/1984125 Thank you, Vefa On 2022-08-08 20:59, Embedded Devel wrote:
On Tuesday 09 August 2022 06:32:16 AM (+07:00), M. Vefa Bicakci wrote:
Hi,
Sorry for the late response.
I understand that you are upset because Wireguard was enabled and then disabled during the development of StarlingX 6.0. I am a part of the team working on the kernel for StarlingX, and I can tell you that actually Wireguard was enabled accidentally during the switch to the v5.10 kernel, and then a clean-up commit disabled it again before the StarlingX 6.0 release.
If you would like, I can file a bug report and/or feature request on your behalf, to enable Wireguard, for consideration in the StarlingX 8.0 release cycle. Please file a bug report on this so it makes it into the build, I have no idea why you would even consider not having wireguard as part of the base, There are numerous reasons why its a good fit for overlay and encryption, it also is a very good fit for Calico and Althea, Are among the list of reasons where and why wireguard is just a good fit. If I can be assured it will make it maybe I can salvage this work and save this contract. Right now we put pre-6 with wireguard into prod, yet i have no upgrade path. Very risky move, but i wasnt going to leave that much money lost on the table. I hope you all realize even us barely recognized consultants deploy startlingx and we make a living of it, and your decisions directly impact out business.
Do you even realize I alone have lost over $50K in revenues due to starlingx and bad decisions on the teams part. I wount even get into starlingx loosing out to kubernetes/openstack-helm for the likes of AT&T. Some of your feature sets and controlled deployment points dont even fit with the largest US Telecomm giant, Its really quite sad honestly to see such a nice product fail due to certain limitations imposed and bad design decisions. I would seriously think manager at wind river itself would be kicking themselves know you only fit 40% of the market, and failed at AT&T.
Regarding the deprecation of the mlx4 module and therefore Mellanox ConnectX-3 cards, I can only point you to our previous e-mail exchange at this link:
https://lists.starlingx.io/pipermail/starlingx-discuss/2022-April/012906.htm...
Thank you,
Vefa
On 2022-07-25 08:40, Embedded Devel wrote:
So literally after all the research I did on wireguard and a working model, in the dev lab, now i go to put it in production only to discover stx 6.0 has now literally disabled wireguard in the kernel, months of time and research is now wasted.
I even mentioned it back in september and was told to file a bug report on previous errors with wireguard loading, then a later pre 6.0 appeared to have it fixed, and now i find in 6.0 ...
# CONFIG_WIREGUARD is not set
completely useless waste of time as well as when you upgraded mellanox drivers to the latest version rendering thousands of $s in hardware useless to us for future revisions of starlingX, im sorry but i really have to say Ive gotten to the point where i ask why i bother supporting stx, championing stx, and deploying it for clients, Im sorry but i am beyond fscking pissed off right now!
On Thursday 30 September 2021 11:41:20 AM (+07:00), Embedded Devel wrote:
LOL Achievement unlocked ... it works now steps to reproduce: controller-0:~$ wget https://centos.pkgs.org/7/epel-testing-x86_64/wireguard-tools-1.0.20210914-1...
controller-0:~$ sudo yum install -y wireguard-tools-1.0.20210914-1.el7.x86_64.rpm Loaded plugins: fastestmirror Examining wireguard-tools-1.0.20210914-1.el7.x86_64.rpm: wireguard-tools-1.0.20210914-1.el7.x86_64 Marking wireguard-tools-1.0.20210914-1.el7.x86_64.rpm to be installed Resolving Dependencies --> Running transaction check ---> Package wireguard-tools.x86_64 0:1.0.20210914-1.el7 will be installed --> Finished Dependency Resolution
Dependencies Resolved
===============================================================================================================================================================
Package Arch Version Repository Size ===============================================================================================================================================================
Installing: wireguard-tools x86_64 1.0.20210914-1.el7 /wireguard-tools-1.0.20210914-1.el7.x86_64 291 k
Transaction Summary ===============================================================================================================================================================
Install 1 Package
Total size: 291 k Installed size: 291 k Downloading packages: Running transaction check Running transaction test Transaction test succeeded Running transaction Installing : wireguard-tools-1.0.20210914-1.el7.x86_64 1/1 Verifying : wireguard-tools-1.0.20210914-1.el7.x86_64 1/1 Installed: wireguard-tools.x86_64 0:1.0.20210914-1.el7 controller-0:~$ curl -o kubectl-calico -O -L "https://github.com/projectcalico/calicoctl/releases/download/v3.19.1/calicoc..."
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 615 100 615 0 0 1930 0 --:--:-- --:--:-- --:--:-- 1933 100 42.8M 100 42.8M 0 0 28.1M 0 0:00:01 0:00:01 --:--:-- 46.2M controller-0:~$ chmod +x kubectl-calico controller-0:~$ sudo mv kubectl-calico /bin/ controller-0:~$ kubectl calico patch felixconfiguration default --type='merge' -p '{"spec":{"wireguardEnabled":true}}' Successfully patched 1 'FelixConfiguration' resource
controller-0:~$ sudo wg interface: wireguard.cali public key: LcaQ5thd7yo4thPR/d0g4LHCnWwEfVsLJaaveeQnago= private key: (hidden) listening port: 51820 fwmark: 0x100000
peer: n1+ugi4bv8Vfpnhfau7/Uaqm/9RqhmQnQ9U+7DoOsj8= endpoint: 192.168.206.3:51820 allowed ips: 172.16.166.128/26, 172.16.166.128/32, 172.16.166.163/32 controller-0:~$ controller-1:~$ sudo wg interface: wireguard.cali public key: n1+ugi4bv8Vfpnhfau7/Uaqm/9RqhmQnQ9U+7DoOsj8= private key: (hidden) listening port: 51820 fwmark: 0x100000
peer: LcaQ5thd7yo4thPR/d0g4LHCnWwEfVsLJaaveeQnago= endpoint: 192.168.206.2:51820 allowed ips: 172.16.192.64/32, 172.16.192.64/26, 172.16.192.87/32 controller-1:~$
On Thursday 30 September 2021 11:11:01 AM (+07:00), Embedded Devel wrote:
based on the calico documentation, https://docs.projectcalico.org/security/encrypt-cluster-pod-traffic we should be able to patch felix calicoctl patch felixconfiguration default --type='merge' -p '{"spec":{"wireguardEnabled":true}}'
I have a pre-6 stx aio duplex deployed, wireguard does work, i yum installed wireguard-tools, i can bring up the wg interface
so two things, how can we execute calico commands ? i see 0 documentation on it
and two im curious what wireguard firewall rules for calico would look like.
id imagine based on the docs
cat <<EOF > gnp-oam-overrides.yaml apiVersion: crd.projectcalico.org/v1 kind: GlobalNetworkPolicy metadata: name: wg-oam-overrides spec: ingress: - action: Allow destination: ports: - 51820 protocol: UDP order: 500 selector: has(iftype) && iftype == 'oam' types: - Ingress EOF
when applied, i cannot connect a remote client to the OAM address, or the floating address
_______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io https://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss
participants (2)
-
Embedded Devel
-
M. Vefa Bicakci