Bug 2042655

Summary:	[IPI on Alibabacloud] cluster becomes unusable if there is only one kube-apiserver pod running
Product:	OpenShift Container Platform	Reporter:	Matthew Staebler <mstaeble>
Component:	Installer	Assignee:	Matthew Staebler <mstaeble>
Installer sub component:	openshift-installer	QA Contact:	Jianli Wei <jiwei>
Status:	CLOSED ERRATA	Docs Contact:
Severity:	urgent
Priority:	urgent
Version:	4.10
Target Milestone:	---
Target Release:	4.10.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-03-10 16:40:58 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Matthew Staebler 2022-01-19 20:48:06 UTC

This is split off from https://bugzilla.redhat.com/show_bug.cgi?id=2035757 to cover issues post-install.

Due to limitations in the load balancer on alibaba cloud, a request made from a control plane host to api-int will fail if the backend server handling that request is the same host. If there is ever a time when there is only one kube-apiserver pod running, then the cluster will become unusable. The node running that kube-apiserver pod will not be able to send heartbeats to the api server. The token for the node will be revoked. The kube-apiserver pod will devolve into a state where it cannot handle requests. At that point, there is no functioning api server, and there is no resolution without manual intervention by the cluster administrator.

Comment 6 errata-xmlrpc 2022-03-10 16:40:58 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.10.3 security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2022:0056