From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id DA79E1FF0E3 for ; Tue, 27 Oct 2026 10:01:07 +0100 (CET) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id BDD6621A80; Tue, 27 Oct 2026 09:56:39 +0100 (CET) From: Hannes Laimer To: pve-devel@lists.proxmox.com Subject: [PATCH pve-manager v3 32/45] pve-sdn-commit: apply the microseg policy at boot Date: Tue, 27 Oct 2026 09:55:14 +0100 Message-ID: <20261027085527.702738-33-h.laimer@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20261027085527.702738-1-h.laimer@proxmox.com> References: <20261027085527.702738-1-h.laimer@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1793091368300 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.354 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: P5JIQAFOE2UALNVHA3KZNFYXEOAJADSU X-Message-ID-Hash: P5JIQAFOE2UALNVHA3KZNFYXEOAJADSU X-MailFrom: h.laimer@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: The microseg BPF programs and maps do not survive a reboot, so the helper applies the policy of the running config on every boot. It is ordered before the guests that start on boot, since an assigned guest interface cannot come up without the programs. A failed ifreload or FRR step does not skip the apply, and the helper still exits with that failure afterwards. Signed-off-by: Hannes Laimer --- bin/pve-sdn-commit | 47 ++++++++++++++++++++------------- services/pve-sdn-commit.service | 1 + 2 files changed, 30 insertions(+), 18 deletions(-) diff --git a/bin/pve-sdn-commit b/bin/pve-sdn-commit index aa7e9b29056a..29b867780dc8 100644 --- a/bin/pve-sdn-commit +++ b/bin/pve-sdn-commit @@ -13,6 +13,7 @@ use PVE::Network::SDN::Vnets; use PVE::Network::SDN::Subnets; use PVE::Network::SDN::Controllers; use PVE::Network::SDN::Fabrics; +use PVE::Network::SDN::Microseg; use PVE::Tools; for (my $i = 0; !PVE::Cluster::check_cfs_quorum(1); $i++) { @@ -96,29 +97,39 @@ sub sdn_changed { return fabrics_changed(); } -if (!sdn_changed()) { - print "No changes to SDN configuration detected, skipping reload\n"; - exit 0; -} +my $errors = ''; -my $previous_config_has_frr = PVE::Network::SDN::running_config_has_frr(); -PVE::Network::SDN::commit_config(); +if (sdn_changed()) { + my $previous_config_has_frr = PVE::Network::SDN::running_config_has_frr(); + PVE::Network::SDN::commit_config(); -my $new_config_has_frr = PVE::Network::SDN::running_config_has_frr(); -my $regenerate_frr = ($previous_config_has_frr || $new_config_has_frr); + my $new_config_has_frr = PVE::Network::SDN::running_config_has_frr(); + my $regenerate_frr = ($previous_config_has_frr || $new_config_has_frr); -PVE::Network::SDN::generate_etc_network_config(); -PVE::Network::SDN::generate_dhcp_config(); + PVE::Network::SDN::generate_etc_network_config(); + PVE::Network::SDN::generate_dhcp_config(); -my $err = sub { - my $line = shift; - if ($line =~ /(warning|error): (\S+):/) { - print "$2 : $line \n"; - } -}; + my $err = sub { + my $line = shift; + if ($line =~ /(warning|error): (\S+):/) { + print "$2 : $line \n"; + } + }; -PVE::Tools::run_command(['ifreload', '-a'], errfunc => $err); + eval { + PVE::Tools::run_command(['ifreload', '-a'], errfunc => $err); + + PVE::Network::SDN::generate_frr_config(1) if $regenerate_frr; + }; + $errors = $@; +} else { + print "No changes to SDN configuration detected, skipping reload\n"; +} -PVE::Network::SDN::generate_frr_config(1) if $regenerate_frr; +# the pinned policy does not survive a reboot, so it is applied here, before the guests that +# start on boot +eval { PVE::Network::SDN::Microseg::apply_all() }; +$errors .= $@; +die $errors if $errors; exit 0; diff --git a/services/pve-sdn-commit.service b/services/pve-sdn-commit.service index ff723725ddcd..d091abd2bd84 100644 --- a/services/pve-sdn-commit.service +++ b/services/pve-sdn-commit.service @@ -3,6 +3,7 @@ Description=Commit Proxmox VE SDN changes DefaultDependencies=no Wants=pve-cluster.service network.target After=frr.service network.target corosync.service +Before=pve-ha-lrm.service pve-guests.service [Service] ExecStart=/usr/share/pve-manager/helpers/pve-sdn-commit -- 2.47.3