Bug 1760166
| Summary: | openshift-ansible openshift_aws security_group.yml destroys Service LoadBalancers (aws elb) | ||
|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | Drew Anderson <dranders> |
| Component: | Installer | Assignee: | Joseph Callen <jcallen> |
| Installer sub component: | openshift-ansible | QA Contact: | Johnny Liu <jialiu> |
| Status: | CLOSED ERRATA | Docs Contact: | |
| Severity: | high | ||
| Priority: | unspecified | CC: | mwoodson, sdodson |
| Version: | 3.11.0 | ||
| Target Milestone: | --- | ||
| Target Release: | 3.11.z | ||
| Hardware: | All | ||
| OS: | Other | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-10-18 01:34:44 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2019:3139 |
Description of problem: `oc get service --all-namespaces | grep LoadBalancer` Service LoadBalancers managed by OpenShift use a "{{ item.value.name }}_k8s" AWS security-group. The following code tries to ensure the AWS security-groups exist. https://github.com/openshift/openshift-ansible/blob/706d0643371bc84706879a10ae18619582dd605a/roles/openshift_aws/tasks/security_group.yml#L18-L25 - name: create the k8s sgs for the node group ec2_group: name: "{{ item.value.name }}_k8s" description: "{{ item.value.desc }} for k8s" region: "{{ openshift_aws_region }}" vpc_id: "{{ vpcout.vpcs[0].id }}" with_dict: "{{ openshift_aws_node_security_groups }}" register: k8s_sg_create As there is no "rules" key in the above code, the security groups are created empty. The problem exists when the existing security groups both exist and are not empty (they contain ELB security group rules allowing access to nodes from ELBs). When this rule is executed, the existing rules in the "{{ item.value.name }}_k8s" AWS security groups are destroyed, blocking access from ELBs to Instances. All Instances will go "OutOfService" and connectivity is lost. OpenShift does not auto-heal this case. Version-Release number of selected component (if applicable): openshift-ansible release-3.11 How reproducible: 100% Steps to Reproduce: Re-run security-groups to update for any changes. Actual results: Rules allowing Service LoadBalancer ELBs access to Instances are removed. Expected results: Rules allowing Service LoadBalancer ELBs access to Instances should be maintained. Additional info: This could be fixed in openshift-ansible, or in the OpenShift Service LoadBalancer implementation for auto-heal.