Bug 1759966

Summary: GCP backend for api server has incorrect ranges allowed for heath checks
Product: OpenShift Container Platform Reporter: Abhinav Dahiya <adahiya>
Component: InstallerAssignee: Abhinav Dahiya <adahiya>
Installer sub component: openshift-installer QA Contact: Johnny Liu <jialiu>
Status: CLOSED ERRATA Docs Contact:
Severity: urgent    
Priority: urgent CC: jialiu, vlaad, xtian
Version: 4.2.0   
Target Milestone: ---   
Target Release: 4.2.0   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: 1759965
: 1760197 (view as bug list) Environment:
Last Closed: 2019-10-16 06:42:04 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1759965    
Bug Blocks:    

Description Abhinav Dahiya 2019-10-09 14:08:25 UTC 
+++ This bug was initially created as a clone of Bug #1759965 +++

Description of problem:

Based on https://cloud.google.com/load-balancing/docs/health-checks#fw-rule the ranges that should be allowed are `"35.191.0.0/16", "209.85.152.0/22", "209.85.204.0/22"`

But gcp firewall rule only allows `"35.191.0.0/16", "130.211.0.0/22"`

This causes health checks to api server fail when the source IPs is from `"209.85.152.0/22" or "209.85.204.0/22"``


Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1. create cluster on GCP
2. Look at the firewall rule for the health checks


Actual results:
Health checks fail due to firewall rules.

Expected results:
Correct ranges are allowed

Additional info:
Comment 1 Scott Dodson 2019-10-09 14:35:12 UTC 
Without this the load balancer will be denied access to the apiservers and will incorrectly remove members. We don't have a good method to measure how often we've been seeing this in CI, we may have just been getting lucky and only ending up with NLBs in the 1 of 3 ranges that are currently included which were correct.
Comment 2 Johnny Liu 2019-10-10 06:24:10 UTC 
4.2 PR:
https://github.com/openshift/installer/commit/f0e25273cf9512b4aa99c26acdd153007d046e2d


Verified this bug with 4.2.0-0.nightly-2019-10-09-203306, and PASS.

Installation is completed successfully.

Check source IP range in jialiu-w65g6-master-in-from-health-checks:

Source filters
IP ranges
209.85.204.0/22
209.85.152.0/22
35.191.0.0/16
Comment 3 errata-xmlrpc 2019-10-16 06:42:04 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:2922