Bug 2021261
| Summary: | Floating IPs do not respect security groups while attached to Baremetal vlan tenant network | ||
|---|---|---|---|
| Product: | Red Hat OpenStack | Reporter: | Chris Janiszewski <cjanisze> |
| Component: | openstack-neutron | Assignee: | OSP Team <rhos-maint> |
| Status: | CLOSED WONTFIX | QA Contact: | Eran Kuris <ekuris> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 16.1 (Train) | CC: | bcafarel, ccamposr, chrisw, dsneddon, jjoyce, jschluet, scohen, skaplons, slinaber, tvignaud |
| Target Milestone: | --- | Keywords: | FutureFeature |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-07-24 10:31:01 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Chris Janiszewski
2021-11-08 17:04:03 UTC
(poc-az1) [stack@director ~]$ openstack security group rule list --fit-width 66739708-fe26-49d8-902b-88fbe3d463f5 +--------------------------------------+-------------+-----------+-----------+------------+-----------------------+ | ID | IP Protocol | Ethertype | IP Range | Port Range | Remote Security Group | +--------------------------------------+-------------+-----------+-----------+------------+-----------------------+ | 43d074d5-c4a1-4bc1-9e1e-735461cbd205 | None | IPv6 | ::/0 | | None | | 78ccdb06-46f7-49f1-9df0-24ad505f6b59 | None | IPv4 | 0.0.0.0/0 | | None | +--------------------------------------+-------------+-----------+-----------+------------+-----------------------+ (poc-az1) [stack@director ~]$ openstack security group rule show --fit-width 78ccdb06-46f7-49f1-9df0-24ad505f6b59 +-------------------+------------------------------------------------------------------------------------------------------------------------------------------------------+| Field | Value |+-------------------+------------------------------------------------------------------------------------------------------------------------------------------------------+| created_at | 2021-11-08T14:30:57Z || description | None || direction | egress || ether_type | IPv4 || id | 78ccdb06-46f7-49f1-9df0-24ad505f6b59 || location | cloud='', project.domain_id=, project.domain_name='Default', project.id='3ee2ae6c63b743708aec498565aeaa77', project.name='admin', || | region_name='regionOne', zone= || name | None || port_range_max | None || port_range_min | None || project_id | 3ee2ae6c63b743708aec498565aeaa77 || protocol | None || remote_group_id | None || remote_ip_prefix | 0.0.0.0/0 || revision_number | 0 || security_group_id | 66739708-fe26-49d8-902b-88fbe3d463f5 || tags | [] || updated_at | 2021-11-08T14:30:57Z |+-------------------+------------------------------------------------------------------------------------------------------------------------------------------------------+ Security groups are applied on the compute nodes for VMs, but not on network controllers handling the floating IPs. This means that security groups do not work for bare metal nodes with ML2/OVS. You can apply iptables rules on the BM node. You might be able to apply SGs on a load balancer with Octavia, but I have not tested this myself. |