Enhancement: OVN secondary network should have the possibility to disable mac spoof check

[agonzalezrh]

Using bridge for secondary network allows to specify macspoofchk to enable or disable the mac spoofing check.

It would be useful for the OVN secondary network to have the same feature. I think a simply condition can be added here:

https://github.com/ovn-org/ovn-kubernetes/blob/c463ceae1c0ec5d260ed66583a5a0dd6948e7f7f/go-controller/pkg/ovn/base_network_controller_pods.go#L563

Use case: nested virtualization

[girishmg]

This should be easy to add. We have it downstream @cathy-zhou can you PTAL?

[agonzalezrh]

From my tests is needed as well to set "Addresses" to unknown.

[cathy-zhou]

the way we support it downstream is to add a particular annotation in the net-attach-def to indicate on this particular network, spoofcheck is disabled.

[maiqueb]

o/

could you elaborate on the design choice @cathy-zhou ?

I.e. why have this a per-network attribute rather than per pod attachment ?

Like ... assume everything connected to a network like this is "unsafe" ?

[agonzalezrh]

Do we have any new information about this?

[maiqueb]

I've been thinking again about this; it could make sense, and if the setting is done per network - and defaulted to having MAC spoofing - I am OK with it.

[agonzalezrh]

Thanks for the update, I will work on implement it and create a PR if you agree

[maiqueb]

Thanks for the update, I will work on implement it and create a PR if you agree

Before you spend time on it, let's hear from a~~nother~~ maintainer; @trozet / @jcaamano / @tssurya any thoughts about this feature ?

[trozet]

Yes, we are OK to support this. Seems like NAD is a natural place for the setting to live. Perhaps when we move NAD creation to a CRD it should be a field there.

[github-actions[bot]]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 5 days.

[github-actions[bot]]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 5 days.

[github-actions[bot]]

This issue was closed because it has been stalled for 5 days with no activity.