| Summary: | Martian source in logs | ||
|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | Miheer Salunke <misalunk> |
| Component: | Networking | Assignee: | Phil Cameron <pcameron> |
| Status: | CLOSED NEXTRELEASE | QA Contact: | Meng Bo <bmeng> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 3.2.1 | CC: | aos-bugs, bbennett, eparis, erich, marc.jadoul, misalunk, weliang |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2016-11-03 20:12:12 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
|
Comment 2
Marc Jadoul
2016-08-24 15:19:03 UTC
Ok, sross managed to reproduce this with the heapster container. Since the SDN IPs are Matrian (from the reserved private IP ranges) they set off the alert when they are targetted to the host public address. We are still investigating to see if this message is avoidable, or if it will always happen when private IP ranges are used for the SDN. Log_martian setting only log them but It also means those packets are dropped by the rp_filter.... This is the default on RHEL6 and RHEL7: https://access.redhat.com/solutions/53031 https://access.redhat.com/solutions/32261 What is actually the effect on heapster? Let supposes you have 100 nodes.... It will at least make heapster busy as I guess it retry..... I see around 3 packets / second rejected on each node. I'd advise you disable the martian logging for now. Given that we are using the private IP ranges deliberately, then it is just going to cause trouble. We'll work on getting more concrete advice. We need to work out what in particular is triggering this. And see if we can change the rules so that it doesn't, or see if a different subnet choice makes a difference. Then we need to document our needs (probably in a new hardening doc that refers to the RHEL one, but adds this as an exception if needed). When net.ipv4.conf.all.log_martians = 1 and net.ipv4.conf.all.rp_filter = 1 setup, when update clusterNetworkCIDR and serviceNetworkCIDR to the new ip address range, the log messages start to show up martian source information, after deploy Heapster pod, more martian source information show up. I can duplicate this issue in openshift v3.2 and v3.3, no martian source information show up from v3.4 in my setup. Based on Weibin's findings I'm closing this since it works in 3.4. *** Bug 1393815 has been marked as a duplicate of this bug. *** |