| Summary: | ShiftStack installer doesn't open cri-o stream port (10010/tcp) | ||
|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | Eduardo Minguez <eminguez> |
| Component: | Installer | Assignee: | egarcia |
| Status: | CLOSED ERRATA | QA Contact: | weiwei jiang <wjiang> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 3.10.0 | CC: | aos-bugs, egarcia, gpei, jokerman, mmccomas, wjiang |
| Target Milestone: | --- | ||
| Target Release: | 4.1.0 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
Cause: 10010/tcp port not open
Consequence: Unable to do `oc exec` or `oc rsh`
Fix: Create firewall rule for 10010/tcp in openstack
Result: `oc rsh` and `oc exec` reachable
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-06-04 10:40:34 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
|
Description
Eduardo Minguez
2018-08-10 14:50:23 UTC
Assigning to Emilio who I believe is looking at the open ports situation in the provisioning playbooks now. Emilio, if that's not correct, let me know. Reassigning to Eduardo, since he fixed the bug Checked with openshift-ansible-4.0.0-0.101.0, and this has heen fixed.
TASK [container_runtime : Add iptables allow rules] ****************************************************************************************************************************************************************************************************************************
task path: /home/openshift/openshift-ansible/roles/container_runtime/tasks/crio_firewall.yml:4
Friday 21 December 2018 17:23:39 +0800 (0:00:01.444) 0:11:39.057 *******
changed: [master-1.wjiang-ocp.example.com] => (item={'service': 'crio', 'port': '10010/tcp'}) => {"changed": true, "item": {"port": "10010/tcp", "service": "crio"}, "output": ["", "Successfully created chain OS_FIREWALL_ALLOW", "iptables: Saving firewall rules to /etc/sysconfig/iptables: [ OK ]\r\n", "", "iptables: Saving firewall rules to /etc/sysconfig/iptables: [ OK ]\r\n", "", "iptables: Saving firewall rules to /etc/sysconfig/iptables: [ OK ]\r\n"]}
changed: [infra-node-0.wjiang-ocp.example.com] => (item={'service': 'crio', 'port': '10010/tcp'}) => {"changed": true, "item": {"port": "10010/tcp", "service": "crio"}, "output": ["", "Successfully created chain OS_FIREWALL_ALLOW", "iptables: Saving firewall rules to /etc/sysconfig/iptables: [ OK ]\r\n", "", "iptables: Saving firewall rules to /etc/sysconfig/iptables: [ OK ]\r\n", "", "iptables: Saving firewall rules to /etc/sysconfig/iptables: [ OK ]\r\n"]}
changed: [master-0.wjiang-ocp.example.com] => (item={'service': 'crio', 'port': '10010/tcp'}) => {"changed": true, "item": {"port": "10010/tcp", "service": "crio"}, "output": ["", "Successfully created chain OS_FIREWALL_ALLOW", "iptables: Saving firewall rules to /etc/sysconfig/iptables: [ OK ]\r\n", "", "iptables: Saving firewall rules to /etc/sysconfig/iptables: [ OK ]\r\n", "", "iptables: Saving firewall rules to /etc/sysconfig/iptables: [ OK ]\r\n"]}
changed: [app-node-0.wjiang-ocp.example.com] => (item={'service': 'crio', 'port': '10010/tcp'}) => {"changed": true, "item": {"port": "10010/tcp", "service": "crio"}, "output": ["", "Successfully created chain OS_FIREWALL_ALLOW", "iptables: Saving firewall rules to /etc/sysconfig/iptables: [ OK ]\r\n", "", "iptables: Saving firewall rules to /etc/sysconfig/iptables: [ OK ]\r\n", "", "iptables: Saving firewall rules to /etc/sysconfig/iptables: [ OK ]\r\n"]}
[openshift@master-0 ~]$ cat /etc/crio/crio.conf|grep -i 10010
stream_port = "10010"
[openshift@master-0 ~]$ sudo ss -4lnt
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 5 192.168.99.8:53 *:*
LISTEN 0 128 *:22 *:*
LISTEN 0 100 127.0.0.1:25 *:*
LISTEN 0 128 192.168.99.8:10010 *:*
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2019:0758 |