Bug 1858183

Summary: [kuryr] hostnetwork pod can access MCS port 22623 or 22624 on master
Product: OpenShift Container Platform Reporter: OpenShift BugZilla Robot <openshift-bugzilla-robot>
Component: NetworkingAssignee: Michał Dulko <mdulko>
Networking sub component: kuryr QA Contact: GenadiC <gcheresh>
Status: CLOSED ERRATA Docs Contact:
Severity: high    
Priority: high CC: ltomasbo, rlobillo
Version: 4.6Keywords: UpcomingSprint
Target Milestone: ---   
Target Release: 4.4.z   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-08-04 14:16:04 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1856374    
Bug Blocks:    

Comment 3 rlobillo 2020-07-27 13:27:37 UTC 
Verified in 4.4.0-0.nightly-2020-07-24-031753 on top of OSP 16.1 RHOS-16.1-RHEL-8-20200723.n.0 compose.

The MCS ports are not accessible from the hostnetwork pod in a cluster with Kuryr.

$ oc create -f https://raw.githubusercontent.com/anuragthehatter/v3-testfiles/master/networking/hostnetwork-pod.json
pod/hostnetwork-pod created

(shiftstack) [stack@undercloud-0 ~]$ openstack server list
+--------------------------------------+---------------------------+--------+-------------------------------------+--------------------+--------+
| ID                                   | Name                      | Status | Networks                            | Image              | Flavor |
+--------------------------------------+---------------------------+--------+-------------------------------------+--------------------+--------+
| 5d55c485-e198-4372-b9e8-4ec9d349498e | ostest-6cgs2-worker-zkbcp | ACTIVE | ostest-6cgs2-openshift=10.196.3.1   | ostest-6cgs2-rhcos |        |
| 1a5ef833-5bdd-4334-9920-d9a7db9fd197 | ostest-6cgs2-worker-zjx4h | ACTIVE | ostest-6cgs2-openshift=10.196.1.116 | ostest-6cgs2-rhcos |        |
| e85dc144-79d7-4224-bc0d-48cbb7491ed0 | ostest-6cgs2-worker-h9jkk | ACTIVE | ostest-6cgs2-openshift=10.196.1.155 | ostest-6cgs2-rhcos |        |
| c54380d3-a63b-4689-a4ba-1fab5d439898 | ostest-6cgs2-master-2     | ACTIVE | ostest-6cgs2-openshift=10.196.2.236 | ostest-6cgs2-rhcos |        |
| d976fe8c-48b4-473e-a083-0cf116bab119 | ostest-6cgs2-master-1     | ACTIVE | ostest-6cgs2-openshift=10.196.0.146 | ostest-6cgs2-rhcos |        |
| c8899a7d-e7ee-461f-bb7d-aa23600d1ca6 | ostest-6cgs2-master-0     | ACTIVE | ostest-6cgs2-openshift=10.196.0.205 | ostest-6cgs2-rhcos |        |
+--------------------------------------+---------------------------+--------+-------------------------------------+--------------------+--------+


(shiftstack) [stack@undercloud-0 ~]$ oc get pods
NAME              READY   STATUS    RESTARTS   AGE
hostnetwork-pod   1/1     Running   0          3h


$ oc rsh hostnetwork-pod
~ $ curl -I http://10.196.0.205:22623/config/master -k
curl: (7) Failed to connect to 10.196.0.205 port 22623: Connection refused
~ $ curl -I http://10.196.0.205:22624/config/master -k
curl: (7) Failed to connect to 10.196.0.205 port 22624: Connection refused


~ $ curl -I http://10.196.0.146:22623/config/master -k
curl: (7) Failed to connect to 10.196.0.146 port 22623: Connection refused
~ $ curl -I http://10.196.0.146:22624/config/master -k
curl: (7) Failed to connect to 10.196.0.146 port 22624: Connection refused


~ $ curl -I http://10.196.2.236:22624/config/master -k
curl: (7) Failed to connect to 10.196.2.236 port 22624: Connection refused
~ $ curl -I http://10.196.2.236:22623/config/master -k
curl: (7) Failed to connect to 10.196.2.236 port 22623: Connection refused
Comment 5 errata-xmlrpc 2020-08-04 14:16:04 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (OpenShift Container Platform 4.4.15 bug fix update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:3128