[Starlingx-discuss] calicoctl / calico containers stx 6.0 aio duplex and wireguard - DONE!

Embedded Devel lists at optimcloud.com
Tue Aug 9 00:59:42 UTC 2022



On Tuesday 09 August 2022 06:32:16 AM (+07:00), M. Vefa Bicakci wrote:

 > Hi,
 >
 > Sorry for the late response.
 >
 > I understand that you are upset because Wireguard was enabled and then 
disabled during the development of StarlingX 6.0. I am a part of the team 
working on the kernel for StarlingX, and I can tell you that actually 
Wireguard was enabled accidentally during the switch to the v5.10 kernel, 
and then a clean-up commit disabled it again before the StarlingX 6.0 
release.
 >
 > If you would like, I can file a bug report and/or feature request on 
your behalf, to enable Wireguard, for consideration in the StarlingX 8.0 
release cycle.
Please file a bug report on this so it makes it into the build, I have no 
idea why you would even consider not having wireguard as part of the base, 
There are numerous reasons why its a good fit for overlay and encryption, 
it also is a very good fit for Calico and Althea, Are among the list of 
reasons
where and why wireguard is just a good fit. If I can be assured it will 
make it maybe I can salvage this  work and save this contract. Right now we 
put
pre-6 with wireguard into prod, yet i have no upgrade path. Very risky 
move, but i wasnt going to leave that much money lost on the table. I hope
you all realize even us barely recognized consultants deploy startlingx and 
we make a living of it, and your decisions directly impact out business.

Do you even realize I alone have lost over $50K in revenues due to 
starlingx and bad decisions on the teams part. I wount even get into 
starlingx
loosing out to kubernetes/openstack-helm for the likes of AT&T. Some of 
your feature sets and controlled deployment points dont even fit with the 
largest
US Telecomm giant, Its really quite sad honestly to see such a nice product 
fail due to certain limitations imposed and bad design decisions. I would
seriously think manager at wind river itself would be kicking themselves 
know you only fit 40% of the market, and failed at AT&T.

 >
 > Regarding the deprecation of the mlx4 module and therefore Mellanox 
ConnectX-3 cards, I can only point you to our previous e-mail exchange at 
this link:
 >
 > 
https://lists.starlingx.io/pipermail/starlingx-discuss/2022-April/012906.html
 
>
 > Thank you,
 >
 > Vefa
 >
 > On 2022-07-25 08:40, Embedded Devel wrote:
 > > So literally after all the research I did on wireguard and a working 
model, in the dev lab, now i go to put it in production
 > > only to discover stx 6.0 has now literally disabled wireguard in the 
kernel, months of time and research is now wasted.
 > >
 > > I even mentioned it back in september and was told to file a bug 
report on previous errors with wireguard loading, then a later pre 6.0 
appeared to have it fixed, and now i find in 6.0 ...
 > >
 > > # CONFIG_WIREGUARD is not set
 > >
 > > completely useless waste of time as well as when you upgraded mellanox 
drivers to the latest version rendering thousands of $s in
 > > hardware useless to us for future revisions of starlingX, im sorry but 
i really have to say Ive gotten to the point where i ask why i bother
 > > supporting stx, championing stx, and deploying it for clients, Im 
sorry but i am beyond fscking pissed off right now!
 > >
 > >
 > > On Thursday 30 September 2021 11:41:20 AM (+07:00), Embedded Devel 
wrote:
 > >
 > >> LOL Achievement unlocked ... it works now
 > >> steps to reproduce:
 > >> controller-0:~$ wget 
https://centos.pkgs.org/7/epel-testing-x86_64/wireguard-tools-1.0.20210914-1.el7.x86_64.rpm.html
 
> >
 > >>
 > >> controller-0:~$ sudo yum install -y 
wireguard-tools-1.0.20210914-1.el7.x86_64.rpm Loaded plugins: fastestmirror
 > >> Examining wireguard-tools-1.0.20210914-1.el7.x86_64.rpm: 
wireguard-tools-1.0.20210914-1.el7.x86_64
 > >> Marking wireguard-tools-1.0.20210914-1.el7.x86_64.rpm to be installed
 > >> Resolving Dependencies
 > >> --> Running transaction check
 > >> ---> Package wireguard-tools.x86_64 0:1.0.20210914-1.el7 will be 
installed
 > >> --> Finished Dependency Resolution
 > >>
 > >> Dependencies Resolved
 > >>
 > >> 
===============================================================================================================================================================
 
> >
 > >> Package Arch Version Repository Size
 > >> 
===============================================================================================================================================================
 
> >
 > >>
 > >> Installing:
 > >> wireguard-tools x86_64 1.0.20210914-1.el7 
/wireguard-tools-1.0.20210914-1.el7.x86_64 291 k
 > >>
 > >> Transaction Summary
 > >> 
===============================================================================================================================================================
 
> >
 > >>
 > >> Install 1 Package
 > >>
 > >> Total size: 291 k
 > >> Installed size: 291 k
 > >> Downloading packages:
 > >> Running transaction check
 > >> Running transaction test
 > >> Transaction test succeeded
 > >> Running transaction
 > >> Installing : wireguard-tools-1.0.20210914-1.el7.x86_64 1/1 Verifying 
: wireguard-tools-1.0.20210914-1.el7.x86_64 1/1
 > >> Installed:
 > >> wireguard-tools.x86_64 0:1.0.20210914-1.el7
 > >> controller-0:~$ curl -o kubectl-calico -O -L 
"https://github.com/projectcalico/calicoctl/releases/download/v3.19.1/calicoctl"
 
> >
 > >> % Total % Received % Xferd Average Speed Time Time Time Current
 > >> Dload Upload Total Spent Left Speed
 > >> 100 615 100 615 0 0 1930 0 --:--:-- --:--:-- --:--:-- 1933
 > >> 100 42.8M 100 42.8M 0 0 28.1M 0 0:00:01 0:00:01 --:--:-- 46.2M
 > >> controller-0:~$ chmod +x kubectl-calico
 > >> controller-0:~$ sudo mv kubectl-calico /bin/
 > >> controller-0:~$ kubectl calico patch felixconfiguration default 
--type='merge' -p '{"spec":{"wireguardEnabled":true}}'
 > >> Successfully patched 1 'FelixConfiguration' resource
 > >>
 > >> controller-0:~$ sudo wg
 > >> interface: wireguard.cali
 > >> public key: LcaQ5thd7yo4thPR/d0g4LHCnWwEfVsLJaaveeQnago=
 > >> private key: (hidden)
 > >> listening port: 51820
 > >> fwmark: 0x100000
 > >>
 > >> peer: n1+ugi4bv8Vfpnhfau7/Uaqm/9RqhmQnQ9U+7DoOsj8=
 > >> endpoint: 192.168.206.3:51820
 > >> allowed ips: 172.16.166.128/26, 172.16.166.128/32, 172.16.166.163/32
 > >> controller-0:~$
 > >> controller-1:~$ sudo wg
 > >> interface: wireguard.cali
 > >> public key: n1+ugi4bv8Vfpnhfau7/Uaqm/9RqhmQnQ9U+7DoOsj8=
 > >> private key: (hidden)
 > >> listening port: 51820
 > >> fwmark: 0x100000
 > >>
 > >> peer: LcaQ5thd7yo4thPR/d0g4LHCnWwEfVsLJaaveeQnago=
 > >> endpoint: 192.168.206.2:51820
 > >> allowed ips: 172.16.192.64/32, 172.16.192.64/26, 172.16.192.87/32
 > >> controller-1:~$
 > >>
 > >>
 > >>
 > >> On Thursday 30 September 2021 11:11:01 AM (+07:00), Embedded Devel 
wrote:
 > >>
 > >> > based on the calico documentation, 
https://docs.projectcalico.org/security/encrypt-cluster-pod-traffic we 
should be able to patch felix calicoctl patch felixconfiguration default 
--type='merge' -p '{"spec":{"wireguardEnabled":true}}'
 > >> >
 > >> > I have a pre-6 stx aio duplex deployed, wireguard does work, i yum 
installed wireguard-tools, i can bring up the wg interface
 > >> >
 > >> > so two things, how can we execute calico commands ? i see 0 
documentation on it
 > >> >
 > >> > and two im curious what wireguard firewall rules for calico would 
look like.
 > >> >
 > >> > id imagine based on the docs
 > >> >
 > >> > cat <<EOF > gnp-oam-overrides.yaml
 > >> > apiVersion: crd.projectcalico.org/v1
 > >> > kind: GlobalNetworkPolicy
 > >> > metadata:
 > >> > name: wg-oam-overrides
 > >> > spec:
 > >> > ingress:
 > >> > - action: Allow
 > >> > destination:
 > >> > ports:
 > >> > - 51820
 > >> > protocol: UDP
 > >> > order: 500
 > >> > selector: has(iftype) && iftype == 'oam'
 > >> > types:
 > >> > - Ingress
 > >> > EOF
 > >> >
 > >> >
 > >> > when applied, i cannot connect a remote client to the OAM address, 
or the floating address
 > >> >
 > >
 >
 > _______________________________________________
 > Starlingx-discuss mailing list
 > Starlingx-discuss at lists.starlingx.io
 > https://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss
 >

-- 
Sent with Vivaldi Mail. Download Vivaldi for free at vivaldi.com



More information about the Starlingx-discuss mailing list