Issue

What were you trying to do that didn't work? While testing IPsec with 250/500 node cluster, seeing traffic over IPsec tunnels are broken, it happens with few pair of nodes, caused by duplicate child SAs present on one end and corresponding SA not found on the other side. Slack thread: https://redhat-internal.slack.com/archives/C08DNAFC85T/p1745906230814439 Libreswan upstream issue: https://github.com/libreswan/libreswan/issues/2184 What is the impact of this issue to you? This is a kind of regression issue in OCP 4.19.0 on a scaled cluster, was not seen with Libreswan 4.6 in previous OCP releases. Please provide the package NVR for which the bug is seen: Libreswan 5.12 How reproducible is this bug?: Always Steps to reproduce Expected results pod to pod connectivity should always work on a IPsec enabled cluster. Actual results pod to pod connectivity connectivity is broken.

Release Notes

No. of Comments

Resolution

Unresolved