Bug 1835440

Summary:	Updates to iptables entries slow to take effect on OCP endpoint object changes
Product:	OpenShift Container Platform	Reporter:	Luke Stanton <lstanton>
Component:	Networking	Assignee:	Dan Winship <danw>
Networking sub component:	openshift-sdn	QA Contact:	zhaozhanqi <zzhao>
Status:	CLOSED DUPLICATE	Docs Contact:
Severity:	high
Priority:	unspecified	CC:	aconstan, bbennett, jcrumple, openshift-bugs-escalate
Version:	3.11.0
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-05-20 13:19:35 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Luke Stanton 2020-05-13 19:12:09 UTC

Description of problem:

When pods associated with a service are removed, the endpoint objects are updated immediately but there is a significant delay for this information to be reflected in the NAT table on the cluster nodes. This delay in NAT table updates causes connectivity problems for applications running within OpenShift because traffic is being routed to stale pod IP's.


Version-Release number of selected component (if applicable):

OCP 3.11.161


How reproducible:

Consistently


Actual results:

A lag is observed in NAT Table updates related to endpoint changes.


Expected results:

NAT Table updates would happen within 1-2 seconds of an endpoint change.

Comment 6 Dan Winship 2020-05-18 14:07:33 UTC

Many problems with iptables in 3.11 can be resolved by setting `iptablesSyncPeriod` in the node-config to something large like '1h'.

There is a large set of iptables performance fixes making their way toward 3.11, which bug 1795416 is the tracking bug for. We don't know exactly when this will be in an errata; at the moment we are working on finalizing the 4.2 backport, and then 3.11 is next.

Comment 7 Ben Bennett 2020-05-20 13:19:35 UTC


*** This bug has been marked as a duplicate of bug 1795416 ***