Hide Forgot
Description of problem: Latency on iptables rules update after atomic-openshift-node service restart After atomic-openshift-node service restarting, iptables rules (KUBE-SERVICES chain) are not ok during few minutes. Version-Release number of selected component (if applicable): 3.2.0.20-1 How reproducible: On customer end Steps to Reproduce: 1. 2. 3. Actual results: After atomic-openshift-node service restarting, iptables rules (KUBE-SERVICES chain) are not ok during few minutes. Expected results: After atomic-openshift-node service restarting, iptables rules (KUBE-SERVICES chain) shall be OK right from the begining. Additional info:
Ok, so the problem is at: https://github.com/openshift/origin/blob/v1.2.0/Godeps/_workspace/src/github.com/openshift/openshift-sdn/plugins/osdn/registry.go#L133 We need to point to the list item, not use the pod to loop over it otherwise we are just pointing to that variable and we end up using the same pointer for all items.
A little more info: - This will happen any time the atomic-openshift-node software is restated - It will self-correct after 5-10 minutes when the data structures refresh, it is only the initial initialization that is incorrect - This is resolved in 3.3 because the way all of this is tracked was completely re-done
Miheer: Can you open a new bug for the new issue they are seeing with 3.3? It is different from this one that they originally hit (on 3.2).
Dropping the priority since it self-corrects and is fixed in 3.3.
This is fixed in 3.3. There is a PR ready for 3.2, but a merge was rejected because the urgency seemed low.
@Ben Sir-> Opened https://bugzilla.redhat.com/show_bug.cgi?id=1389451
Re-Opened. Pull Request for fix: https://github.com/openshift/ose/pull/641
verified in OCP 3.2.1.28 and the issue has been fixed. After atomic-openshift-node service restarting, iptables rules (KUBE-SERVICES chain) is OK in about 15 seconds. [root@host-8-175-119 ~]# openshift version openshift v3.2.1.28 kubernetes v1.2.0-36-g4a3f9c5 etcd 2.2.5 [root@host-8-175-119 ~]# [root@host-8-175-119 ~]# systemctl restart atomic-openshift-node [root@host-8-175-119 ~]# [root@host-8-175-119 ~]# iptables -L KUBE-SERVICES Chain KUBE-SERVICES (1 references) target prot opt source destination REJECT tcp -- anywhere 172.30.147.75 /* install-test/cakephp-mysql-example:web has no endpoints */ tcp dpt:webcache reject-with icmp-port-unreachable [root@host-8-175-119 ~]# [root@host-8-175-119 ~]# [root@host-8-175-119 ~]# [root@host-8-175-119 ~]# iptables -L KUBE-SERVICES Chain KUBE-SERVICES (1 references) target prot opt source destination [root@host-8-175-119 ~]#
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:0865