Bug 1698136 - [3.9] Egress Router HTTP Proxy cannot reach the node which router pod runs
Summary: [3.9] Egress Router HTTP Proxy cannot reach the node which router pod runs
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Networking
Version: 3.9.0
Hardware: Unspecified
OS: Unspecified
urgent
urgent
Target Milestone: ---
: 3.9.z
Assignee: Dan Winship
QA Contact: Meng Bo
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-04-09 16:31 UTC by Dan Winship
Modified: 2019-06-06 06:56 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Cause: The way that egress routers are set up made it impossible for an egress router pod to connect to the public IP address of the node it was hosted on. Consequence: If an egress pod was configured to use its node as a name server via /etc/resolv.conf, it would be unable to do DNS resolution. Fix: Traffic from an egress router pod to its node is now routed via the SDN tunnel instead of trying to send it via the egress interface. Result: Egress routers can now connect to their node's IP, and egress router DNS should always work, regardless of configuration.
Clone Of: 1595291
Environment:
Last Closed: 2019-06-06 06:56:05 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github openshift ose pull 1519 0 None None None 2019-04-09 16:34:28 UTC
Red Hat Product Errata RHBA-2019:0788 0 None None None 2019-06-06 06:56:07 UTC

Comment 1 Dan Winship 2019-04-09 16:32:13 UTC 
belatedly realized that we had backported this to 3.7 but skipped 3.9
Comment 2 Dan Winship 2019-04-09 16:34:29 UTC 
https://github.com/openshift/ose/pull/1519
Comment 4 Weibin Liang 2019-04-18 17:54:20 UTC 
Tested and verified on v3.9.78

Egress router pod deployed in nodeX can ping the IP address of nodeX.

And the following iptables rule can be found in egress router pod:
-A POSTROUTING -o macvlan0 -j SNAT --to-source 172.8.5.158
Comment 6 errata-xmlrpc 2019-06-06 06:56:05 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:0788
Note You need to log in before you can comment on or make changes to this bug.