Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1698136

Summary:	[3.9] Egress Router HTTP Proxy cannot reach the node which router pod runs
Product:	OpenShift Container Platform	Reporter:	Dan Winship <danw>
Component:	Networking	Assignee:	Dan Winship <danw>
Status:	CLOSED ERRATA	QA Contact:	Meng Bo <bmeng>
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	3.9.0	CC:	aos-bugs, weliang
Target Milestone:	---
Target Release:	3.9.z
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	Cause: The way that egress routers are set up made it impossible for an egress router pod to connect to the public IP address of the node it was hosted on. Consequence: If an egress pod was configured to use its node as a name server via /etc/resolv.conf, it would be unable to do DNS resolution. Fix: Traffic from an egress router pod to its node is now routed via the SDN tunnel instead of trying to send it via the egress interface. Result: Egress routers can now connect to their node's IP, and egress router DNS should always work, regardless of configuration.	Story Points:	---
Clone Of:	1595291	Environment:
Last Closed:	2019-06-06 06:56:05 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Comment 1 Dan Winship 2019-04-09 16:32:13 UTC

belatedly realized that we had backported this to 3.7 but skipped 3.9

Comment 2 Dan Winship 2019-04-09 16:34:29 UTC

https://github.com/openshift/ose/pull/1519

Comment 4 Weibin Liang 2019-04-18 17:54:20 UTC

Tested and verified on v3.9.78

Egress router pod deployed in nodeX can ping the IP address of nodeX.

And the following iptables rule can be found in egress router pod:
-A POSTROUTING -o macvlan0 -j SNAT --to-source 172.8.5.158

Comment 6 errata-xmlrpc 2019-06-06 06:56:05 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:0788