From a429012cda23fd604e1ced9e817b99df9ced5fcf Mon Sep 17 00:00:00 2001 From: joshsiv-mulga Date: Mon, 25 May 2026 10:52:23 +1000 Subject: [PATCH] fix(ipsec): use Debian unit name openvswitch-ipsec.service MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CI artifact shows `Unit ovs-monitor-ipsec.service could not be found` on every node. Debian's openvswitch-ipsec package ships the unit as openvswitch-ipsec.service (the binary inside is ovs-monitor-ipsec, but systemd's name follows the package). The previous commit guarded on the wrong unit name, so: - spinifex-daemon.service Wants=/After= silently no-op'd (missing unit) - enableOVNIPSec's `systemctl enable --now ovs-monitor-ipsec.service` failed, daemon logged a warning and continued without flipping ipsec_encapsulation=true - TestMultinodeIPSec skipped with `node1 reports ""` because OVS DB never received the cert pointers Rename across all 5 spots (daemon, systemd unit, test, CI diag script, workflow journal capture) to match the Debian package layout. Note: the package itself still must be present on the CI VM image — that's tracked in the mulga repo (image-builder provision.sh + bootstrap-install.sh shim). Refs: mulga-siv-136 --- .github/scripts/capture-net-diag.sh | 8 ++++---- .github/workflows/e2e-go.yml | 8 +++++--- build/systemd/spinifex-daemon.service | 6 +++--- spinifex/daemon/ipsec.go | 8 ++++---- spinifex/daemon/ipsec_test.go | 8 ++++---- 5 files changed, 20 insertions(+), 18 deletions(-) diff --git a/.github/scripts/capture-net-diag.sh b/.github/scripts/capture-net-diag.sh index 0efba1f45..43e9123fe 100755 --- a/.github/scripts/capture-net-diag.sh +++ b/.github/scripts/capture-net-diag.sh @@ -6,8 +6,8 @@ # binary on one path doesn't abort the rest of the capture. # # Output layout (under $1/net-diag/): -# ovs-monitor-ipsec.status systemctl status (output-only) -# ovs-monitor-ipsec.journal last 200 journal lines +# openvswitch-ipsec.status systemctl status (output-only) +# openvswitch-ipsec.journal last 200 journal lines # ipsec.openvswitch_conf ovs-vsctl get Open_vSwitch . other_config # ipsec.xfrm_state ip xfrm state list # ipsec.xfrm_policy ip xfrm policy list @@ -32,8 +32,8 @@ run() { } > "$OUT/$label" || true } -run ovs-monitor-ipsec.status sudo systemctl status ovs-monitor-ipsec.service --no-pager --full --lines=50 -run ovs-monitor-ipsec.journal sudo journalctl -u ovs-monitor-ipsec.service --no-pager --output=short-iso -n 200 +run openvswitch-ipsec.status sudo systemctl status openvswitch-ipsec.service --no-pager --full --lines=50 +run openvswitch-ipsec.journal sudo journalctl -u openvswitch-ipsec.service --no-pager --output=short-iso -n 200 run ipsec.openvswitch_conf sudo ovs-vsctl get Open_vSwitch . other_config run ipsec.xfrm_state sudo ip xfrm state list run ipsec.xfrm_policy sudo ip xfrm policy list diff --git a/.github/workflows/e2e-go.yml b/.github/workflows/e2e-go.yml index 97a983815..7be00caf0 100644 --- a/.github/workflows/e2e-go.yml +++ b/.github/workflows/e2e-go.yml @@ -728,12 +728,14 @@ jobs: > "${ARTIFACT_DIR}/spinifex-journal-node${idx}.log" 2>/dev/null ok "journal node${idx}: $(wc -l < "${ARTIFACT_DIR}/spinifex-journal-node${idx}.log" 2>/dev/null || echo 0) lines" done - # ovs-monitor-ipsec journal per node (separate file — bead 136). + # openvswitch-ipsec journal per node (separate file — bead 136). + # Debian unit name; the binary inside is /usr/share/openvswitch/scripts/ovs-ctl + # which spawns ovs-monitor-ipsec as a child. for i in "${!NODE_LIST[@]}"; do idx=$((i + 1)) ip="${NODE_LIST[$i]}" - ssh "${SSH_OPTS[@]}" tf-user@"$ip" 'sudo journalctl -u ovs-monitor-ipsec.service --no-pager --output=short-iso --since "60 min ago"' \ - > "${ARTIFACT_DIR}/ovs-monitor-ipsec-node${idx}.log" 2>/dev/null + ssh "${SSH_OPTS[@]}" tf-user@"$ip" 'sudo journalctl -u openvswitch-ipsec.service --no-pager --output=short-iso --since "60 min ago"' \ + > "${ARTIFACT_DIR}/openvswitch-ipsec-node${idx}.log" 2>/dev/null done - name: Convert test logs to JUnit XML diff --git a/build/systemd/spinifex-daemon.service b/build/systemd/spinifex-daemon.service index 1db8bfb90..6c993983e 100644 --- a/build/systemd/spinifex-daemon.service +++ b/build/systemd/spinifex-daemon.service @@ -1,14 +1,14 @@ [Unit] Description=Spinifex Daemon (VM Orchestration) PartOf=spinifex.target -After=spinifex-nats.service spinifex-viperblock.service openvswitch-switch.service ovn-controller.service ovs-monitor-ipsec.service -# Wants=ovs-monitor-ipsec.service so systemd brings the IPsec userspace +After=spinifex-nats.service spinifex-viperblock.service openvswitch-switch.service ovn-controller.service openvswitch-ipsec.service +# Wants=openvswitch-ipsec.service so systemd brings the IPsec userspace # daemon up before spinifex flips other_config:ipsec_encapsulation=true. # Without that daemon, OVS holds the cert pointers unused and strongSwan # never gets IKE config — tunnel traffic is encrypted with no SAs and # silently dropped. Wants= (not Requires=) keeps daemon bootable on # single-node / lab hosts where the package is intentionally absent. -Wants=ovs-monitor-ipsec.service +Wants=openvswitch-ipsec.service # No Wants=spinifex-nats.service: Wants= reactivates a stopped unit during # `systemctl restart spinifex-daemon`, which would mask the standalone-startup # path the Tier 1 DDIL Scenario B exercises. spinifex.target Wants= covers diff --git a/spinifex/daemon/ipsec.go b/spinifex/daemon/ipsec.go index 6d0a2ab55..ed23e8675 100644 --- a/spinifex/daemon/ipsec.go +++ b/spinifex/daemon/ipsec.go @@ -12,7 +12,7 @@ import ( ) // systemctlActiveTimeout bounds how long enableOVNIPSec waits for -// ovs-monitor-ipsec.service to report active after a `systemctl enable +// openvswitch-ipsec.service to report active after a `systemctl enable // --now`. Overridden in tests. var systemctlActiveTimeout = 5 * time.Second @@ -79,18 +79,18 @@ func (d *Daemon) enableOVNIPSec() error { return nil } -// ensureOVSMonitorIPSecActive enables + starts ovs-monitor-ipsec.service and +// ensureOVSMonitorIPSecActive enables + starts openvswitch-ipsec.service and // waits for it to report active. Without this guarantee, ipsec_encapsulation // silently drops all tunnel traffic because no userspace daemon is reading // the OVS DB cert pointers to drive strongSwan IKE. func ensureOVSMonitorIPSecActive() error { - if out, err := sudoCommand("systemctl", "enable", "--now", "ovs-monitor-ipsec.service").CombinedOutput(); err != nil { + if out, err := sudoCommand("systemctl", "enable", "--now", "openvswitch-ipsec.service").CombinedOutput(); err != nil { return fmt.Errorf("enable --now: %s: %w", strings.TrimSpace(string(out)), err) } deadline := time.Now().Add(systemctlActiveTimeout) var lastOut string for time.Now().Before(deadline) { - out, _ := sudoCommand("systemctl", "is-active", "ovs-monitor-ipsec.service").CombinedOutput() + out, _ := sudoCommand("systemctl", "is-active", "openvswitch-ipsec.service").CombinedOutput() lastOut = strings.TrimSpace(string(out)) if lastOut == "active" { return nil diff --git a/spinifex/daemon/ipsec_test.go b/spinifex/daemon/ipsec_test.go index ba5fab310..f5dc5c1e6 100644 --- a/spinifex/daemon/ipsec_test.go +++ b/spinifex/daemon/ipsec_test.go @@ -65,13 +65,13 @@ func TestEnableOVNIPSec(t *testing.T) { require.NoError(t, d.enableOVNIPSec()) // Expected sudo invocations in order: - // systemctl enable --now ovs-monitor-ipsec.service - // systemctl is-active ovs-monitor-ipsec.service + // systemctl enable --now openvswitch-ipsec.service + // systemctl is-active openvswitch-ipsec.service // ovs-vsctl set Open_vSwitch . other_config:certificate=... private_key=... ca_cert=... // ovs-vsctl set Open_vSwitch . other_config:ipsec_encapsulation=true require.Len(t, recorder.runs, 4) - assert.Equal(t, []string{"systemctl", "enable", "--now", "ovs-monitor-ipsec.service"}, recorder.runs[0]) - assert.Equal(t, []string{"systemctl", "is-active", "ovs-monitor-ipsec.service"}, recorder.runs[1]) + assert.Equal(t, []string{"systemctl", "enable", "--now", "openvswitch-ipsec.service"}, recorder.runs[0]) + assert.Equal(t, []string{"systemctl", "is-active", "openvswitch-ipsec.service"}, recorder.runs[1]) for _, run := range recorder.runs[2:] { assert.Equal(t, "ovs-vsctl", run[0]) assert.Equal(t, "set", run[1])