Bug 1570400 - [3.7] DNS to local node vs. static egress IP
Summary: [3.7] DNS to local node vs. static egress IP
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Networking
Version: 3.7.1
Hardware: x86_64
OS: Linux
Target Milestone: ---
: 3.7.z
Assignee: Dan Winship
QA Contact: Meng Bo
Depends On: 1557924
TreeView+ depends on / blocked
Reported: 2018-04-22 15:01 UTC by Dan Winship
Modified: 2018-05-18 03:55 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Cause: When using per-namespace static egress IPs, all external traffic is routed through the egress IP. "External" means all traffic which isn't directed to another pod, and so includes traffic from the pod to the pod's node. Consequence: When pods are told to use the node's IP address for DNS, and the pod is using a static egress IP, then DNS traffic will be routed to the egress node first, and then back to the original node, which might be configured to not accept DNS requests from other hosts, causing the pod to be unable to resolve DNS. Fix: pod-to-node DNS requests now bypass the egress IP and go directly to the node Result: DNS works
Clone Of: 1570398
Last Closed: 2018-05-18 03:54:45 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Github ose/pull/1220 0 None None None 2018-04-22 15:03:33 UTC
Red Hat Product Errata RHBA-2018:1576 0 None None None 2018-05-18 03:55:08 UTC

Comment 1 Dan Winship 2018-04-22 15:03:34 UTC

Comment 3 Meng Bo 2018-05-11 07:14:44 UTC
Tested on 3.7.46, with same step in https://bugzilla.redhat.com/show_bug.cgi?id=1570398#c5

The issue had been fixed.

Comment 6 errata-xmlrpc 2018-05-18 03:54:45 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.