Bug 2054767

Summary:	[ovn] Missing lr-policy-list and snat rules for egressip when new pods are added
Product:	OpenShift Container Platform	Reporter:	Patryk Diak <pdiak>
Component:	Networking	Assignee:	Patryk Diak <pdiak>
Networking sub component:	ovn-kubernetes	QA Contact:	huirwang
Status:	CLOSED ERRATA	Docs Contact:
Severity:	high
Priority:	medium	CC:	anusaxen, ffernand, pdiak
Version:	4.10
Target Milestone:	---
Target Release:	4.10.z
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:	2048841	Environment:
Last Closed:	2022-04-21 13:15:55 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2048841
Bug Blocks:

Description Patryk Diak 2022-02-15 16:39:55 UTC

+++ This bug was initially created as a clone of Bug #2048841 +++

This is a follow up from bug 2029742.

When new pods that are expected to have egressip nat and lrpolicies are
created while ovn-k master is down, they remain missing, even after
ovn-k8 is started.

Steps to Reproduce:
1. Label one node as egress node
2. Create egressip object
 oc get egressip -o yaml
....
  spec:
    egressIPs:
    - 172.31.249.117
    namespaceSelector:
      matchLabels:
        org: pm
    podSelector: {}
  status:
    items:
    - egressIP: 172.31.249.117
      node: compute-0
....
3. Create ns ds36l and 10 pods in it, label org=pm  to the namespace
4. scale the CNO to 0 
 oc scale deployment network-operator -n openshift-network-operator --replicas 0
5.Delete ovnkube-master ds
Scale test pods replicas to 20
6. scale the CNO to 1
oc scale deployment network-operator -n openshift-network-operator --replicas 1
deployment.apps/network-operator scaled

7. Check  lr-policy-list and snat
 ovn-nbctl lr-policy-list ovn_cluster_router | grep "100 "

8. Nat rules are also not correct. They should have been added for the new
pods that were started while ovn-k8 was down. 

sh-4.4# ovn-nbctl --format=csv --no-heading find nat external_ids:name=egressip

Actual results:
lr-policy-list  and snat rules are not added for the new pod instances.


Expected results:
No stale lr-policy-list  and snat rules, and accounting for the all the ones running.

--- Additional comment from Patryk Diak on 2022-02-15 16:24:22 UTC ---

Fixed in https://github.com/openshift/ovn-kubernetes/pull/947/commits/0a2fee424ec84a4af3a47af47d8554d2b04fcb0c

Comment 11 errata-xmlrpc 2022-04-21 13:15:55 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.10.10 bug fix and security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2022:1356