| Summary: | Start firewalld will flush the iptable rules | ||
|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | Yan Du <yadu> |
| Component: | Networking | Assignee: | Dan Winship <danw> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Meng Bo <bmeng> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 3.1.0 | CC: | aos-bugs, dcbw, eparis, erich, yadu |
| Target Milestone: | --- | Keywords: | Regression |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2016-01-29 20:58:02 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
|
Description
Yan Du
2016-01-14 07:48:18 UTC
I don't think this is really a bug, but I'll let Dan comment. I believe it is required that firewalld be running before docker/kubelet/kube-proxy, although you can restart firewalld after those are running... Could you reproduce with the following actions? 1) set --loglevel=5 in /lib/system/system/atomic-openshift-node.service (or openshift-node.service, whichever one you use) 2) restart openshift 3) reproduce the issue, note the time when you restarted firewalld 4) journalctl -b -u atomic-openshift-node (or just openshift-node) What I'm looking for is to see if there is a "reloading iptables rules" message in the openshift logs around the time that you start/restart firewalld. (In reply to Eric Paris from comment #1) > I don't think this is really a bug, but I'll let Dan comment. I believe it > is required that firewalld be running before docker/kubelet/kube-proxy, > although you can restart firewalld after those are running... No, it's supposed to work this way as well. I can't reproduce this. It works fine for me; when I start firewalld, the rules are removed by firewalld, and then immediately recreated by openshift. (In reply to Yan Du from comment #0) > step4: after starting firewalld > > > [root@openshift-v3 ~]# iptables -t nat -nL > Chain PREROUTING (policy ACCEPT) > target prot opt source destination > > Chain INPUT (policy ACCEPT) > target prot opt source destination > > Chain OUTPUT (policy ACCEPT) > target prot opt source destination > > Chain POSTROUTING (policy ACCEPT) > target prot opt source destination > [root@openshift-v3 ~]# systemctl start firewalld > [root@openshift-v3 ~]# iptables -t nat -nL > Chain PREROUTING (policy ACCEPT) > target prot opt source destination > PREROUTING_direct all -- 0.0.0.0/0 0.0.0.0/0 > PREROUTING_ZONES_SOURCE all -- 0.0.0.0/0 0.0.0.0/0 > PREROUTING_ZONES all -- 0.0.0.0/0 0.0.0.0/0 Note that the iptables are *already* missing before you start firewalld here. What did you do between the original "iptables -t nat -nL" (which showed the openshift rules) and the second one, quoted above, which does not? Actually it was not working last Friday, and I waited about 10 mintues, the rules was still not recovered. I tested it again on latest ose env today, oc v3.1.1.4 kubernetes v1.1.0-origin-1107-g4c8e6f4 But the issue could not be reproduced, iptales rules works normally now. Could you please move it to ON_QA and I will closed the bugs. Thanks |