[PATCH pve-manager v3 32/45] pve-sdn-commit: apply the microseg policy at boot

[Hannes Laimer <h.laimer@proxmox.com>]

The microseg BPF programs and maps do not survive a reboot, so the
helper applies the policy of the running config on every boot. It is
ordered before the guests that start on boot, since an assigned guest
interface cannot come up without the programs. A failed ifreload or
FRR step does not skip the apply, and the helper still exits with
that failure afterwards.

Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
---
 bin/pve-sdn-commit              | 47 ++++++++++++++++++++-------------
 services/pve-sdn-commit.service |  1 +
 2 files changed, 30 insertions(+), 18 deletions(-)

diff --git a/bin/pve-sdn-commit b/bin/pve-sdn-commit
index aa7e9b29056a..29b867780dc8 100644
--- a/bin/pve-sdn-commit
+++ b/bin/pve-sdn-commit
@@ -13,6 +13,7 @@ use PVE::Network::SDN::Vnets;
 use PVE::Network::SDN::Subnets;
 use PVE::Network::SDN::Controllers;
 use PVE::Network::SDN::Fabrics;
+use PVE::Network::SDN::Microseg;
 use PVE::Tools;
 
 for (my $i = 0; !PVE::Cluster::check_cfs_quorum(1); $i++) {
@@ -96,29 +97,39 @@ sub sdn_changed {
     return fabrics_changed();
 }
 
-if (!sdn_changed()) {
-    print "No changes to SDN configuration detected, skipping reload\n";
-    exit 0;
-}
+my $errors = '';
 
-my $previous_config_has_frr = PVE::Network::SDN::running_config_has_frr();
-PVE::Network::SDN::commit_config();
+if (sdn_changed()) {
+    my $previous_config_has_frr = PVE::Network::SDN::running_config_has_frr();
+    PVE::Network::SDN::commit_config();
 
-my $new_config_has_frr = PVE::Network::SDN::running_config_has_frr();
-my $regenerate_frr = ($previous_config_has_frr || $new_config_has_frr);
+    my $new_config_has_frr = PVE::Network::SDN::running_config_has_frr();
+    my $regenerate_frr = ($previous_config_has_frr || $new_config_has_frr);
 
-PVE::Network::SDN::generate_etc_network_config();
-PVE::Network::SDN::generate_dhcp_config();
+    PVE::Network::SDN::generate_etc_network_config();
+    PVE::Network::SDN::generate_dhcp_config();
 
-my $err = sub {
-    my $line = shift;
-    if ($line =~ /(warning|error): (\S+):/) {
-        print "$2 : $line \n";
-    }
-};
+    my $err = sub {
+        my $line = shift;
+        if ($line =~ /(warning|error): (\S+):/) {
+            print "$2 : $line \n";
+        }
+    };
 
-PVE::Tools::run_command(['ifreload', '-a'], errfunc => $err);
+    eval {
+        PVE::Tools::run_command(['ifreload', '-a'], errfunc => $err);
+
+        PVE::Network::SDN::generate_frr_config(1) if $regenerate_frr;
+    };
+    $errors = $@;
+} else {
+    print "No changes to SDN configuration detected, skipping reload\n";
+}
 
-PVE::Network::SDN::generate_frr_config(1) if $regenerate_frr;
+# the pinned policy does not survive a reboot, so it is applied here, before the guests that
+# start on boot
+eval { PVE::Network::SDN::Microseg::apply_all() };
+$errors .= $@;
+die $errors if $errors;
 
 exit 0;
diff --git a/services/pve-sdn-commit.service b/services/pve-sdn-commit.service
index ff723725ddcd..d091abd2bd84 100644
--- a/services/pve-sdn-commit.service
+++ b/services/pve-sdn-commit.service
@@ -3,6 +3,7 @@ Description=Commit Proxmox VE SDN changes
 DefaultDependencies=no
 Wants=pve-cluster.service network.target
 After=frr.service network.target corosync.service
+Before=pve-ha-lrm.service pve-guests.service
 
 [Service]
 ExecStart=/usr/share/pve-manager/helpers/pve-sdn-commit
-- 
2.47.3