From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id E172F1FF0DF for ; Thu, 05 Nov 2026 12:18:56 +0100 (CET) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id C00E721627; Thu, 05 Nov 2026 12:15:48 +0100 (CET) From: Hannes Laimer To: pve-devel@lists.proxmox.com Subject: [PATCH pve-manager v4 32/45] pve-sdn-commit: apply the microseg policy at boot Date: Thu, 5 Nov 2026 12:13:11 +0100 Message-ID: <20261105111324.706922-33-h.laimer@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20261105111324.706922-1-h.laimer@proxmox.com> References: <20261105111324.706922-1-h.laimer@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1793877242084 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.288 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: XW2T3L7IHGRGZSG2ZUK5VQIRY4KADYDL X-Message-ID-Hash: XW2T3L7IHGRGZSG2ZUK5VQIRY4KADYDL X-MailFrom: h.laimer@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: The microseg BPF programs and maps do not survive a reboot, so the helper applies the policy of the running config on every boot. It is ordered before the guests that start on boot, since an assigned guest interface cannot come up without the programs. A failed ifreload or FRR step does not skip the apply, and the helper still exits with that failure afterwards. A commit of pending SDN changes at boot leaves the policy as it is applied. The helper reloads this node alone, so the other nodes would keep the old policy in their maps while their plugs read the new one. Signed-off-by: Hannes Laimer --- bin/pve-sdn-commit | 49 +++++++++++++++++++++------------ services/pve-sdn-commit.service | 1 + 2 files changed, 32 insertions(+), 18 deletions(-) diff --git a/bin/pve-sdn-commit b/bin/pve-sdn-commit index aa7e9b29056a..2ec548fd788d 100644 --- a/bin/pve-sdn-commit +++ b/bin/pve-sdn-commit @@ -13,6 +13,7 @@ use PVE::Network::SDN::Vnets; use PVE::Network::SDN::Subnets; use PVE::Network::SDN::Controllers; use PVE::Network::SDN::Fabrics; +use PVE::Network::SDN::Microseg; use PVE::Tools; for (my $i = 0; !PVE::Cluster::check_cfs_quorum(1); $i++) { @@ -96,29 +97,41 @@ sub sdn_changed { return fabrics_changed(); } -if (!sdn_changed()) { - print "No changes to SDN configuration detected, skipping reload\n"; - exit 0; -} +my $errors = ''; -my $previous_config_has_frr = PVE::Network::SDN::running_config_has_frr(); -PVE::Network::SDN::commit_config(); +if (sdn_changed()) { + my $previous_config_has_frr = PVE::Network::SDN::running_config_has_frr(); + # the policy stays pending, this commit reloads only this node and the other nodes would + # enforce the old policy against the identities of the new one + PVE::Network::SDN::commit_config(1); -my $new_config_has_frr = PVE::Network::SDN::running_config_has_frr(); -my $regenerate_frr = ($previous_config_has_frr || $new_config_has_frr); + my $new_config_has_frr = PVE::Network::SDN::running_config_has_frr(); + my $regenerate_frr = ($previous_config_has_frr || $new_config_has_frr); -PVE::Network::SDN::generate_etc_network_config(); -PVE::Network::SDN::generate_dhcp_config(); + PVE::Network::SDN::generate_etc_network_config(); + PVE::Network::SDN::generate_dhcp_config(); -my $err = sub { - my $line = shift; - if ($line =~ /(warning|error): (\S+):/) { - print "$2 : $line \n"; - } -}; + my $err = sub { + my $line = shift; + if ($line =~ /(warning|error): (\S+):/) { + print "$2 : $line \n"; + } + }; -PVE::Tools::run_command(['ifreload', '-a'], errfunc => $err); + eval { + PVE::Tools::run_command(['ifreload', '-a'], errfunc => $err); + + PVE::Network::SDN::generate_frr_config(1) if $regenerate_frr; + }; + $errors = $@; +} else { + print "No changes to SDN configuration detected, skipping reload\n"; +} -PVE::Network::SDN::generate_frr_config(1) if $regenerate_frr; +# the pinned policy does not survive a reboot, so it is applied here, before the guests that +# start on boot +eval { PVE::Network::SDN::Microseg::apply_all() }; +$errors .= $@; +die $errors if $errors; exit 0; diff --git a/services/pve-sdn-commit.service b/services/pve-sdn-commit.service index ff723725ddcd..d091abd2bd84 100644 --- a/services/pve-sdn-commit.service +++ b/services/pve-sdn-commit.service @@ -3,6 +3,7 @@ Description=Commit Proxmox VE SDN changes DefaultDependencies=no Wants=pve-cluster.service network.target After=frr.service network.target corosync.service +Before=pve-ha-lrm.service pve-guests.service [Service] ExecStart=/usr/share/pve-manager/helpers/pve-sdn-commit -- 2.47.3