Bug 1558484
Summary: | Update of Egress Network Policy causes temporary egress failure when using dnsName | ||
---|---|---|---|
Product: | OpenShift Container Platform | Reporter: | Andre Costa <andcosta> |
Component: | Networking | Assignee: | Ravi Sankar <rpenta> |
Status: | CLOSED ERRATA | QA Contact: | Meng Bo <bmeng> |
Severity: | high | Docs Contact: | |
Priority: | high | ||
Version: | 3.7.0 | CC: | aos-bugs, hongli, mjudeiki |
Target Milestone: | --- | Keywords: | NeedsTestCase |
Target Release: | 3.10.0 | ||
Hardware: | All | ||
OS: | Other | ||
Whiteboard: | |||
Fixed In Version: | Doc Type: | Bug Fix | |
Doc Text: |
Cause: Update egress policy needed blocking outgoing traffic, patching ovs flows and then re-enabling traffic but the ovs flow generation for dns names was slow.
Consequence: Few seconds egress traffic downtime which may not be acceptable.
Fix: Change update egress policy handling to pre-populate all new ovs flows before blocking the outgoing traffic.
Result: Reduces the downtime during egress policy updates.
|
Story Points: | --- |
Clone Of: | Environment: | ||
Last Closed: | 2018-07-30 19:10:48 UTC | Type: | Bug |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: |
Description
Andre Costa
2018-03-20 10:19:22 UTC
verified in atomic-openshift-3.10.0-0.50.0.git.0.db6dfd6.el7, the ovs flow updated as below: W0523 03:11:49.675710 32437 ovscontroller.go:473] Correcting CIDRSelector '0.0.0.0/32' to '0.0.0.0/0' in EgressNetworkPolicy lha:policy-test I0523 03:11:49.675798 32437 ovs.go:155] Executing: ovs-ofctl -O OpenFlow13 bundle br0 - << flow delete table=101, reg0=5808747 flow add table=101, reg0=5808747, priority=2, ip, nw_dst=98.138.219.231, actions=output:2 flow add table=101, reg0=5808747, priority=2, ip, nw_dst=98.138.219.232, actions=output:2 flow add table=101, reg0=5808747, priority=2, ip, nw_dst=72.30.35.9, actions=output:2 flow add table=101, reg0=5808747, priority=2, ip, nw_dst=72.30.35.10, actions=output:2 flow add table=101, reg0=5808747, priority=2, ip, nw_dst=98.137.246.7, actions=output:2 flow add table=101, reg0=5808747, priority=2, ip, nw_dst=98.137.246.8, actions=output:2 flow add table=101, reg0=5808747, priority=1, ip, actions=drop OS: Red Hat Enterprise Linux Server release 7.5 (Maipo) kernel: Linux ip-172-18-8-142.ec2.internal 3.10.0-862.el7.x86_64 #1 SMP Wed Mar 21 18:14:51 EDT 2018 x86_64 x86_64 x86_64 GNU/Linux Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:1816 |