Remove config of pf0hpf_if instead of setting it to down after configuration by wminckler · Pull Request #457 · NVIDIA/infra-controller

wminckler · 2026-03-05T16:00:45Z

When applying a new nvue config, it sets the interface to up and for the non-primary DPUs, agent was going back and bringing the interface down. This leaves a small window where the host can get a dhcp response, leaking the admin IP address assigned to the host.

removes the interface and vpcs from the nvue config
-- bridge was always include in the non-fnn case. this was removed if not needed
disables dhcp server (it fails without the vpc)
ignores the dhcp server health when it is disabled
updates tests

Tested both etv and fnn configs in the dev env.

Description

Type of Change

Add - New feature or capability
Change - Changes in existing functionality
Fix - Bug fixes
Remove - Removed features or deprecated functionality
Internal - Internal changes (refactoring, tests, docs, etc.)

Related Issues (Optional)

Breaking Changes

This PR contains breaking changes

Testing

Unit tests added/updated
Integration tests added/updated
Manual testing performed
No testing required (docs, internal refactor, etc.)

Additional Notes

nvbug # 5931831

bcavnvidia

The logic around port_configs is a little funny and probably needs clean up. Could be now or could be later. No strong preference from me. 😄

abvarshney-nv

I checked from dhcp-server pov, lgtm.

wminckler · 2026-03-09T19:30:25Z

+                    // Note that the nvue config handles the blocking of traffic on the interface.  This is only so that the host link reflects the correct state.
+                    if let Err(err) = ethernet_virtualization::update_interface_state(&conf).await {
+                        tracing::error!(error = format!("{err:#}"), "Updating interface state.");
+                    }


Brian showed me that if we down the pf0hpf interface (in the dpu os itself) it will be reflected by the host, so instead of removing all of it, I removed the hbn stuff and targeted the new interface.

Also, I removed the cached state. I didn't feel like running ip link show was a big deal now that its not in the container and its way easier to test and the "is it down already" check is always right.

…uration

…ty to disable dhcp server

bcavnvidia

Changes in this crate are always a little 😅 , but these changes look ok.

…uration (NVIDIA#457) When applying a new nvue config, it sets the interface to up and for the non-primary DPUs, agent was going back and bringing the interface down. This leaves a small window where the host can get a dhcp response, leaking the admin IP address assigned to the host. - removes the interface and vpcs from the nvue config -- bridge was always include in the non-fnn case. this was removed if not needed - disables dhcp server (it fails without the vpc) - ignores the dhcp server health when it is disabled - instead of bringing down the interface in the container, it brings down the interface on the dpu os, which is reflected in the host. (this is not required, but is a nice to have) - updates tests Tested both etv and fnn configs in the dev env. ## Description  ## Type of Change  - [ ] **Add** - New feature or capability - [ ] **Change** - Changes in existing functionality - [X] **Fix** - Bug fixes - [ ] **Remove** - Removed features or deprecated functionality - [ ] **Internal** - Internal changes (refactoring, tests, docs, etc.) ## Related Issues (Optional)  ## Breaking Changes - [ ] This PR contains breaking changes  ## Testing  - [X] Unit tests added/updated - [ ] Integration tests added/updated - [X] Manual testing performed - [ ] No testing required (docs, internal refactor, etc.) ## Additional Notes  nvbug # 5931831

…uration (#457) When applying a new nvue config, it sets the interface to up and for the non-primary DPUs, agent was going back and bringing the interface down. This leaves a small window where the host can get a dhcp response, leaking the admin IP address assigned to the host. - removes the interface and vpcs from the nvue config -- bridge was always include in the non-fnn case. this was removed if not needed - disables dhcp server (it fails without the vpc) - ignores the dhcp server health when it is disabled - instead of bringing down the interface in the container, it brings down the interface on the dpu os, which is reflected in the host. (this is not required, but is a nice to have) - updates tests Tested both etv and fnn configs in the dev env. ## Description  ## Type of Change  - [ ] **Add** - New feature or capability - [ ] **Change** - Changes in existing functionality - [X] **Fix** - Bug fixes - [ ] **Remove** - Removed features or deprecated functionality - [ ] **Internal** - Internal changes (refactoring, tests, docs, etc.) ## Related Issues (Optional)  ## Breaking Changes - [ ] This PR contains breaking changes  ## Testing  - [X] Unit tests added/updated - [ ] Integration tests added/updated - [X] Manual testing performed - [ ] No testing required (docs, internal refactor, etc.) ## Additional Notes  nvbug # 5931831

…EFIX_LIST (#538) ## Description - Rule 65535 in the DPU_TO_EVPN_DROP_PREFIX_LIST prefix-list was using route-map object syntax (action: {deny: {}}) instead of the string syntax required by prefix-list rules (action: deny), causing NVUE schema validation to reject the entire network config with the error: Config invalid at router.policy.prefix-list.DPU_TO_EVPN_DROP_PREFIX_LIST.rule.65535.action: {'deny': {}} is not of type 'string' - This rule was added in #457 to handle the case where no VPCs are configured (making rule 10 conditional), but was copy-pasted from the adjacent route-map section which uses a different schema for action - Fix updates the template and 4 test expected files ## Type of Change  - [ ] **Add** - New feature or capability - [ ] **Change** - Changes in existing functionality - [x] **Fix** - Bug fixes - [ ] **Remove** - Removed features or deprecated functionality - [ ] **Internal** - Internal changes (refactoring, tests, docs, etc.) ## Related Issues (Optional)  ## Breaking Changes - [ ] This PR contains breaking changes  ## Testing  - [x] Unit tests added/updated - [ ] Integration tests added/updated - [ ] Manual testing performed - [ ] No testing required (docs, internal refactor, etc.) ## Additional Notes  Signed-off-by: Laura Gray <lgray@nvidia.com>

…EFIX_LIST (NVIDIA#538) ## Description - Rule 65535 in the DPU_TO_EVPN_DROP_PREFIX_LIST prefix-list was using route-map object syntax (action: {deny: {}}) instead of the string syntax required by prefix-list rules (action: deny), causing NVUE schema validation to reject the entire network config with the error: Config invalid at router.policy.prefix-list.DPU_TO_EVPN_DROP_PREFIX_LIST.rule.65535.action: {'deny': {}} is not of type 'string' - This rule was added in NVIDIA#457 to handle the case where no VPCs are configured (making rule 10 conditional), but was copy-pasted from the adjacent route-map section which uses a different schema for action - Fix updates the template and 4 test expected files ## Type of Change  - [ ] **Add** - New feature or capability - [ ] **Change** - Changes in existing functionality - [x] **Fix** - Bug fixes - [ ] **Remove** - Removed features or deprecated functionality - [ ] **Internal** - Internal changes (refactoring, tests, docs, etc.) ## Related Issues (Optional)  ## Breaking Changes - [ ] This PR contains breaking changes  ## Testing  - [x] Unit tests added/updated - [ ] Integration tests added/updated - [ ] Manual testing performed - [ ] No testing required (docs, internal refactor, etc.) ## Additional Notes  Signed-off-by: Laura Gray <lgray@nvidia.com>

…EFIX_LIST (NVIDIA#538) ## Description - Rule 65535 in the DPU_TO_EVPN_DROP_PREFIX_LIST prefix-list was using route-map object syntax (action: {deny: {}}) instead of the string syntax required by prefix-list rules (action: deny), causing NVUE schema validation to reject the entire network config with the error: Config invalid at router.policy.prefix-list.DPU_TO_EVPN_DROP_PREFIX_LIST.rule.65535.action: {'deny': {}} is not of type 'string' - This rule was added in NVIDIA#457 to handle the case where no VPCs are configured (making rule 10 conditional), but was copy-pasted from the adjacent route-map section which uses a different schema for action - Fix updates the template and 4 test expected files ## Type of Change  - [ ] **Add** - New feature or capability - [ ] **Change** - Changes in existing functionality - [x] **Fix** - Bug fixes - [ ] **Remove** - Removed features or deprecated functionality - [ ] **Internal** - Internal changes (refactoring, tests, docs, etc.) ## Related Issues (Optional)  ## Breaking Changes - [ ] This PR contains breaking changes  ## Testing  - [x] Unit tests added/updated - [ ] Integration tests added/updated - [ ] Manual testing performed - [ ] No testing required (docs, internal refactor, etc.) ## Additional Notes  Signed-off-by: Laura Gray <lgray@nvidia.com> Signed-off-by: Thomas McRoberts <tmcroberts@nvidia.com>

…EFIX_LIST (#538) ## Description - Rule 65535 in the DPU_TO_EVPN_DROP_PREFIX_LIST prefix-list was using route-map object syntax (action: {deny: {}}) instead of the string syntax required by prefix-list rules (action: deny), causing NVUE schema validation to reject the entire network config with the error: Config invalid at router.policy.prefix-list.DPU_TO_EVPN_DROP_PREFIX_LIST.rule.65535.action: {'deny': {}} is not of type 'string' - This rule was added in #457 to handle the case where no VPCs are configured (making rule 10 conditional), but was copy-pasted from the adjacent route-map section which uses a different schema for action - Fix updates the template and 4 test expected files ## Type of Change  - [ ] **Add** - New feature or capability - [ ] **Change** - Changes in existing functionality - [x] **Fix** - Bug fixes - [ ] **Remove** - Removed features or deprecated functionality - [ ] **Internal** - Internal changes (refactoring, tests, docs, etc.) ## Related Issues (Optional)  ## Breaking Changes - [ ] This PR contains breaking changes  ## Testing  - [x] Unit tests added/updated - [ ] Integration tests added/updated - [ ] Manual testing performed - [ ] No testing required (docs, internal refactor, etc.) ## Additional Notes  Signed-off-by: Laura Gray <lgray@nvidia.com> Signed-off-by: Thomas McRoberts <tmcroberts@nvidia.com>

…EFIX_LIST (NVIDIA#538) ## Description - Rule 65535 in the DPU_TO_EVPN_DROP_PREFIX_LIST prefix-list was using route-map object syntax (action: {deny: {}}) instead of the string syntax required by prefix-list rules (action: deny), causing NVUE schema validation to reject the entire network config with the error: Config invalid at router.policy.prefix-list.DPU_TO_EVPN_DROP_PREFIX_LIST.rule.65535.action: {'deny': {}} is not of type 'string' - This rule was added in NVIDIA#457 to handle the case where no VPCs are configured (making rule 10 conditional), but was copy-pasted from the adjacent route-map section which uses a different schema for action - Fix updates the template and 4 test expected files ## Type of Change  - [ ] **Add** - New feature or capability - [ ] **Change** - Changes in existing functionality - [x] **Fix** - Bug fixes - [ ] **Remove** - Removed features or deprecated functionality - [ ] **Internal** - Internal changes (refactoring, tests, docs, etc.) ## Related Issues (Optional)  ## Breaking Changes - [ ] This PR contains breaking changes  ## Testing  - [x] Unit tests added/updated - [ ] Integration tests added/updated - [ ] Manual testing performed - [ ] No testing required (docs, internal refactor, etc.) ## Additional Notes  Signed-off-by: Laura Gray <lgray@nvidia.com>

## Description #457 introduced a new policy rule missing a match-block. This PR adds that missing block. ## Type of Change  - [ ] **Add** - New feature or capability - [ ] **Change** - Changes in existing functionality - [x] **Fix** - Bug fixes - [ ] **Remove** - Removed features or deprecated functionality - [ ] **Internal** - Internal changes (refactoring, tests, docs, etc.) ## Related Issues (Optional)  ## Breaking Changes - [ ] This PR contains breaking changes  ## Testing  - [x] Unit tests added/updated - [ ] Integration tests added/updated - [x] Manual testing performed - [ ] No testing required (docs, internal refactor, etc.) ## Additional Notes

…r configuration (NVIDIA#457)" This reverts commit e508409.

…r configuration (#457)" This reverts commit e508409.

…er configuration (NVIDIA#457)" This reverts commit 9f3c2da.

wminckler requested a review from a team as a code owner March 5, 2026 16:00

wminckler requested review from abvarshney-nv and bcavnvidia March 5, 2026 16:01

kensimon approved these changes Mar 5, 2026

View reviewed changes

abvarshney-nv approved these changes Mar 6, 2026

View reviewed changes

bcavnvidia approved these changes Mar 6, 2026

View reviewed changes

wminckler changed the title ~~DRAFT: Remove config of pf0hpf_if instead of setting it to down after configuration~~ Remove config of pf0hpf_if instead of setting it to down after configuration Mar 7, 2026

wminckler force-pushed the minckler/disable-2nd-dpu branch from 3ad59a4 to 8c7a078 Compare March 7, 2026 00:15

wminckler enabled auto-merge (squash) March 7, 2026 10:27

bcavnvidia requested changes Mar 9, 2026

View reviewed changes

Comment thread crates/agent/templates/nvue_startup_fnn.conf Outdated

abvarshney-nv approved these changes Mar 9, 2026

View reviewed changes

wminckler disabled auto-merge March 9, 2026 14:39

wminckler force-pushed the minckler/disable-2nd-dpu branch from 65a898a to d181762 Compare March 9, 2026 14:54

wminckler commented Mar 9, 2026

View reviewed changes

wminckler requested a review from bcavnvidia March 9, 2026 19:32

wminckler added 12 commits March 9, 2026 20:26

Remove config of pf0hpf_if instead of setting it to down after config…

2856fe8

…uration

fmt

1215470

avoid clone and cleanup include_bridge

1683f84

remove bridge from expected output

3f3ae4f

add test for using bridge

eea27bc

remove disabled flag and do not pass disabled port configs; add abili…

788f153

…ty to disable dhcp server

cleanup arg handling

38fe9ed

fix test

2292e6b

use default deny rule instead of removing DPU_TO_EVPN_DROP_PREFIX_LIST

ba7a6ae

fix indent

aadc8ea

add interface control back and change it to os's pf0hpf interface

0eae186

add deny rule to tests

04538bf

wminckler force-pushed the minckler/disable-2nd-dpu branch from 156a575 to 04538bf Compare March 9, 2026 20:27

clippy fixes

5e80af7

fmt

b1fa15b

bcavnvidia approved these changes Mar 10, 2026

View reviewed changes

wminckler merged commit 443d318 into NVIDIA:main Mar 10, 2026
36 checks passed

lauragra-y mentioned this pull request Mar 12, 2026

fix(agent): correct prefix-list action format for DPU_TO_EVPN_DROP_PREFIX_LIST #538

Merged

10 tasks

bcavnvidia mentioned this pull request Mar 12, 2026

fix(agent): Add missing match block in FNN NVUE policy #543

Merged

10 tasks

ajf added a commit to ajf/infra-controller that referenced this pull request Mar 13, 2026

Revert "Remove config of pf0hpf_if instead of setting it to down afte…

7d12e15

…r configuration (NVIDIA#457)" This reverts commit e508409.

ajf added a commit that referenced this pull request Mar 13, 2026

Revert "Remove config of pf0hpf_if instead of setting it to down afte…

9f3c2da

…r configuration (#457)" This reverts commit e508409.

ajf added a commit to ajf/infra-controller that referenced this pull request Mar 19, 2026

Reapply "Remove config of pf0hpf_if instead of setting it to down aft…

58fe914

…er configuration (NVIDIA#457)" This reverts commit 9f3c2da.

kfelternv added a commit to kfelternv/infra-controller that referenced this pull request May 18, 2026

fix: Add Apache source headers (NVIDIA#457)

c576443

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Remove config of pf0hpf_if instead of setting it to down after configuration#457

Remove config of pf0hpf_if instead of setting it to down after configuration#457
wminckler merged 14 commits into
NVIDIA:mainfrom
wminckler:minckler/disable-2nd-dpu

wminckler commented Mar 5, 2026 •

edited

Loading

Uh oh!

bcavnvidia left a comment

Uh oh!

Uh oh!

abvarshney-nv left a comment

Uh oh!

wminckler Mar 9, 2026

Uh oh!

bcavnvidia left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

wminckler commented Mar 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Type of Change

Related Issues (Optional)

Breaking Changes

Testing

Additional Notes

Uh oh!

bcavnvidia left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

abvarshney-nv left a comment

Choose a reason for hiding this comment

Uh oh!

wminckler Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

bcavnvidia left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

wminckler commented Mar 5, 2026 •

edited

Loading