Bug 2012167
| Summary: | Virt-handler pods uses iptables instead of nftables, causing service-mesh related rules to be missing | ||
|---|---|---|---|
| Product: | Container Native Virtualization (CNV) | Reporter: | Radim Hrazdil <rhrazdil> |
| Component: | Networking | Assignee: | Radim Hrazdil <rhrazdil> |
| Status: | CLOSED ERRATA | QA Contact: | Adi Zavalkovsky <azavalko> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 4.9.0 | CC: | azavalko, cnv-qe-bugs, phoracek, rsdeor |
| Target Milestone: | --- | ||
| Target Release: | 4.9.3 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | virt-handler v4.9.3-4 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-02-22 21:54:59 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
We have identified another discrepancy between U/S and D/S and have to postpone this to 4.9.2. Verified. OCP version - 4.9.18. Virt-handler 4.9.3-1. Deployed VM with istio-proxy container and a svc with port 22 as targetPort. Successfully connected to the VM with ssh via port 22. Back to dev. Verification steps didn't cover fix. Needs update For verification: 1. Create a VM with masquerade interface and no specific ports defined 2. Check that all containers in the virt-launcher pod remain Ready Verified. OCP version - 4.9. virt-handler v4.9.3-4. Deployed two vms, one with specified ports for the masquerade iface, the other without. Both vms - Are unreachable on port 22, Reachable on istio ports - 8000+ Can reach outside (8.8.8.8 for example). Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (OpenShift Virtualization 4.9.3 Images), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2022:0641 |
Description of problem: virt handler fails to use nftables because of missing nft binary: {"component":"virt-handler","level":"info","msg":"failed to load nftable ipv4-nat","pos":"common.go:243","reason":"exec: \"nft\": executable file not found in $PATH","timestamp":"2021-10-08T11:56:56.745518Z"} Consequence of missing nft binary are missing rules for service-mesh, meaning that VMs with no explicit ports have isto-proxy sidecar in non-ready state. Version-Release number of selected component (if applicable): How reproducible: Steps to Reproduce: 1. Set logVerbosity to 5 2. Create a VM with masquerade binding Actual results: the above log is in the virt-handler log Expected results: virt-handler should use nftables by default Additional info: