Bug 1937214

Summary: Ingress operator performs spurious updates in response to API's defaulting of NodePort service's clusterIPs field
Product: OpenShift Container Platform Reporter: OpenShift BugZilla Robot <openshift-bugzilla-robot>
Component: NetworkingAssignee: Miciah Dashiel Butler Masters <mmasters>
Networking sub component: router QA Contact: Hongan Li <hongli>
Status: CLOSED ERRATA Docs Contact:
Severity: medium    
Priority: medium CC: amcdermo, aos-bugs
Version: 4.8   
Target Milestone: ---   
Target Release: 4.7.z   
Hardware: Unspecified   
OS: Unspecified   
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-04-05 13:56:14 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1936030    
Bug Blocks:    

Description OpenShift BugZilla Robot 2021-03-10 07:45:38 UTC
+++ This bug was initially created as a clone of Bug #1936030 +++

Description of problem:

When the ingress operator reconciles an ingresscontroller that has the "NodePortService" endpoint publishing strategy type, the operator gets the ingresscontroller's nodeport service (if one exists) from the API to determine whether the operator needs to create or update the service.  If the service does not exist, the operator creates it, and if the service does exist, the operator compares it with what the operator expects to get in order to determine whether an update is needed for that service.  In this comparison, if the API has set a value for the service's clusterIPs field, the operator detects the update and tries to set the clusterIPs field back to the empty value.  The operator should not update the service in response to API defaulting.

Version-Release number of selected component (if applicable):

The clusterIPs field is new in Kubernetes 1.20 (OpenShift 4.7).

Steps to Reproduce:

1. Launch a new cluster.

2. Create an ingresscontroller with the "NodePortService" endpoint publishing strategy:

    oc create -f - <<'EOF'
    apiVersion: operator.openshift.io/v1
    kind: IngressController
      name: nodeport
      namespace: openshift-ingress-operator
      replicas: 1
      domain: example.com
        type: NodePortService

3. Check the ingress operator's logs:

    oc -n openshift-ingress-operator logs deploy/ingress-operator -c ingress-operator

Actual results:

The ingress operator's logs have "updated NodePort service" repeated several times.

Expected results:

The ingress operator should ignore the clusterIPs field's value and should not log "updated NodePort service" unless the service is updated outside of API defaulting.

Comment 2 Hongan Li 2021-03-25 03:25:13 UTC
Verified with 4.7.0-0.nightly-2021-03-24-213550 and passed.

didn't see "updated NodePort service" and just saw one related logs as below:

$ oc -n openshift-ingress-operator logs deploy/ingress-operator -c ingress-operator | grep NodePort
2021-03-25T03:18:03.762Z	INFO	operator.ingress_controller	ingress/controller.go:667	created NodePort service{"service": "&Service{ObjectMeta:{router-nodeport-nodeport  openshift-ingress /api/v1/namespaces/openshift-ingress/services/router-nodeport-nodeport

Comment 5 errata-xmlrpc 2021-04-05 13:56:14 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.7.5 security and bug fix update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.