Description of problem: When setup the openshift cluster 4.0 on AWS. The master and workers cannot ping each other using the internal-ip. Found the security group only have 'echo reply' rule in 'Inbound'. When I added the 'echo request' rule by manual. then they are able to ping each other. Version-Release number of selected component (if applicable): 4.0.0-0.nightly-2019-03-15-063749 How reproducible: always Steps to Reproduce: 1. see the Description 2. 3. Actual results: master and workers cannot ping using the internal-ip each other, thus it makes hard when debugging some issue. Expected results: master and workers can ping each other. Additional info: I checked one blog https://charity.wtf/2016/04/14/scrapbag-of-useful-terraform-tips The from_port should be 8 other than 0 in the openshift-installer/data/data/aws/vpc/sg-worker.tf resource "aws_security_group_rule" "worker_ingress_icmp" { type = "ingress" security_group_id = "${aws_security_group.worker.id}" protocol = "icmp" cidr_blocks = ["0.0.0.0/0"] from_port = 0 to_port = 0
Can you describe the impact of this? Is the cluster functional? Is it harder to debug? Perhaps use the 'As an TYPE_OF_USER, I want to ping between masters and works, so that I can USER_GOAL' format.
Hi Nick, We(QE) will try to debug the cluster network sometimes, and the node to node connectivity is one of the checkpoint. Beside above, I'd like to know the reason that we set the `ICMP reply` rule only which may not make the ping works. And since the nodes will not have the public IP, why we set the cidr block to 0.0.0.0/0 instead of a vpc internal subnet or another security group? Thanks
Hang on - if we really block ICMP between nodes, then it's definitely a bug. We 100% need ICMP internal to the VPC to be completely unblocked. I'm checking now.
Please let us know what you determine.
Filed PR https://github.com/openshift/installer/pull/1550
Tested this bug on 4.1.0-0.nightly-2019-04-22-005054, this issue had been fixed.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2019:0758