joshsiv-mulga 596e787bd0 fix(ipsec): guard ipsec_encapsulation on ovs-monitor-ipsec liveness ...

enableOVNIPSec set OVS cert pointers + ipsec_encapsulation=true without
ensuring ovs-monitor-ipsec.service was running. Without that daemon, OVS
holds the cert pointers unused, strongSwan never gets IKE config, and
tunnel traffic ovn-controller marks for encryption gets silently
dropped. TestMultinodeIPSec fails on `node1 xfrm has no AEAD SAs`.

- systemd: spinifex-daemon Wants=/After= ovs-monitor-ipsec.service
- daemon: ensureOVSMonitorIPSecActive — systemctl enable --now +
  is-active poll; refuses to flip ipsec_encapsulation if daemon is dead
- daemon: single-node short-circuit — no peers means no tunnels means
  the flag is at best inert and at worst load-bearing-silent-drop
- ci: capture-net-diag.sh + workflow steps to snapshot OVS/OVN/xfrm
  state on failure, fan out across all 3 multinode nodes

Refs: mulga-siv-136

2026-05-25 10:16:01 +10:00

..

actions

feat(e2e): Go E2E harness + single-node migration to Ensure*/Discover* + reboot suite (#241)

2026-05-20 21:04:13 +10:00

assets

feat: VFIO GPU passthrough (#188)

2026-05-06 09:52:23 +10:00

scripts

fix(ipsec): guard ipsec_encapsulation on ovs-monitor-ipsec liveness

2026-05-25 10:16:01 +10:00

workflows

fix(ipsec): guard ipsec_encapsulation on ovs-monitor-ipsec liveness

2026-05-25 10:16:01 +10:00

dependabot.yml

fix: min package age 3 days

2026-05-12 11:23:58 +10:00