Bug 1890494

Summary: Error assigning Egress IP on GCP
Product: OpenShift Container Platform Reporter: siva kanakala <skanakal>
Component: NetworkingAssignee: Dan Winship <danw>
Networking sub component: openshift-sdn QA Contact: huirwang
Status: CLOSED ERRATA Docs Contact:
Severity: medium    
Priority: medium CC: anbhat, bbennett, cedric.girard, danw, fgrosjea, huirwang, mapandey, ssadhale, zzhao
Version: 4.4   
Target Milestone: ---   
Target Release: 4.7.0   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: No Doc Update
Doc Text:
Story Points: ---
Clone Of:
: 1920232 (view as bug list) Environment:
Last Closed: 2021-02-24 15:27:41 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Comment 2 Dan Winship 2020-10-27 18:08:58 UTC
It seems that the way that host networking is set up in GCP is incompatible with openshift-sdn's egress IP code. There is no workaround.

The egress IP documentation should probably be clearer about the fact that we do not necessarily expect egress IPs to work on any platform except bare metal. (At least, currently.)

Comment 5 Dan Winship 2020-10-29 14:27:36 UTC
@zhaozhanqi can you confirm what platforms QE currently tests egress IPs on? We need to update the documentation to be clearer about what platforms we support, and we may need to add QE coverage for additional platforms.

Comment 9 Dan Winship 2021-01-25 21:09:12 UTC
OK, bug 1920232 now covers updating the existing documentation to correctly describe the current state of affairs (including the fact that you can make it work on AWS and Azure if you know what to do, but you can't make it work on GCE).

https://issues.redhat.com/browse/SDN-1332 covers adding egress IP support for GCE (on both openshift-sdn and ovn-kubernetes). https://issues.redhat.com/browse/SDN-1315 and https://issues.redhat.com/browse/SDN-1316 cover adding _automatic_ egress IP support for AWS and Azure (on both openshift-sdn and ovn-kubernetes).

All that is left to do in this bug then is to update our QE testing to make sure that we don't accidentally break manual egress IPs on AWS/Azure until then.

So, QE needs to add a test that:

  - When using openshift-sdn...

  - on either AWS or Azure (probably don't need to test both; just test whichever is easier)...

  - if you go into the AWS/Azure console and add a secondary IPv4 address to the primary
    network interface on one of the nodes...

  - then you can use that IP as a manually-configured egress IP and it will work just
    like egress IPs on bare metal do

  - (You don't have to test automatically-configured egress IPs in this configuration because
    they're not expected to work.)

Hopefully the "adding a secondary IPv4 address" step should be somewhat obvious but if it's not then poke me again and I can try to figure it out.

Comment 12 Dan Winship 2021-01-27 12:36:19 UTC
@huirwang not sure if you did this or not, but I wanted to make sure that that test gets added to the set of tests that get run when validating a new release

Comment 16 errata-xmlrpc 2021-02-24 15:27:41 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.7.0 security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2020:5633