Bug 1500118
| Summary: | Lbaas port allows traffic even when sec-group attached does not have rules to allow that traffic | ||
|---|---|---|---|
| Product: | Red Hat OpenStack | Reporter: | Jeremy <jmelvin> |
| Component: | openstack-neutron-lbaas | Assignee: | Nir Magnezi <nmagnezi> |
| Status: | CLOSED WONTFIX | QA Contact: | Toni Freger <tfreger> |
| Severity: | high | Docs Contact: | |
| Priority: | low | ||
| Version: | 10.0 (Newton) | CC: | amuller, apevec, fgarciad, jlibosva, jmelvin, lhh, nyechiel |
| Target Milestone: | --- | Keywords: | FutureFeature, Triaged |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2017-10-26 11:53:55 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Jeremy
2017-10-09 23:20:30 UTC
Assigned to Nir for triage. Hi Jeremy, In short: Unfortunately, the document you attached is just wrong and needs fixing. I double checked that with the LBaaS upstream PTL. This is not supported (even in Queens, which would be OSP13) by the haproxy in namespace lbaas implementation, and actually, this is not how security groups are intended to work. The longer version: Security groups, which is a concept originated in Nova, were designed to restrict ingress/egress traffic for Nova instances. That has implications about how security groups were actually implemented and the thing to keep in mind here is that Nova instances connect to the main OVS bridge (br-int) through an intermediate Linux bridge (more details about this here[1]. that is where security group rules are being applied. That being said, the LBaaS VIP port (among other types of Neutron ports) is wired directly to the main OVS bridge (br-int) directly. Thus, no security group enforcement. That is actually a base assumption taken into account in the haproxy namespace driver implementation. Note the attached security group won't get updated when you add an LBaaS listener. If security groups were to be enforced, it *had* to add rules to it in order to have a functioning loadbalancer. IIRC, there were talks in the community to have some sort of ACLs mechanism in Octavia, but that's not relevant for OSP10 nor it got any actual work done in that field just yet. Let me know if you have any further questions. [1] https://www.rdoproject.org/networking/networking-in-too-much-detail/ As we are moving towards using Octavia as load balancing service, I'm closing this bug as WONTFIX. Octavia loadbalancers are implemented as regular instances and hence can have security groups implemented just like ordinary instances. The needinfo request[s] on this closed bug have been removed as they have been unresolved for 1000 days |