Bug 1740439 - Unless RHEL worker disable firewalld.service, "oc rsh/exec/logs" does not work
Summary: Unless RHEL worker disable firewalld.service, "oc rsh/exec/logs" does not work
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Installer
Version: 4.1.0
Hardware: Unspecified
OS: Unspecified
unspecified
medium
Target Milestone: ---
: 4.2.0
Assignee: Russell Teague
QA Contact: Weihua Meng
URL:
Whiteboard:
Depends On:
Blocks: 1740684 1740964
TreeView+ depends on / blocked
 
Reported: 2019-08-13 02:04 UTC by Daein Park
Modified: 2019-10-17 07:12 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Cause: Default minimal install of RHEL installs firewalld.service Consequence: Firewall blocks ports and which prevents "oc rsh/exec/logs" from working Fix: Disabled firewalld.service if it is installed to conform to the the same as RHCOS hosts. Result: Remote 'oc' commands work as expected.
Clone Of:
: 1740684 1740964 (view as bug list)
Environment:
Last Closed: 2019-10-16 06:35:39 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github openshift openshift-ansible pull 11824 0 None closed Bug 1740439: Disable firewalld service during adding RHEL worker 2021-02-18 13:16:34 UTC
Red Hat Product Errata RHBA-2019:2922 0 None None None 2019-10-16 06:35:53 UTC

Description Daein Park 2019-08-13 02:04:04 UTC
Description of problem:

If you add RHEL worker through [0] steps, you cannot use "oc rsh/exec/logs" with "connect: no route to host" error message as follows.

~~~
# oc get pod -o wide
NAME                   READY   STATUS    RESTARTS   AGE   IP             NODE                         NOMINATED NODE   READINESS GATES
...
sdn-vfjxw              1/1     Running   6          43h   10.0.1.10   worker-1.ocp41.rhel.worker   <none>           <none>

# oc rsh sdn-vfjxw
Error from server: error dialing backend: dial tcp 10.0.1.10:10250: connect: no route to host

# oc exec sdn-vfjxw -- date
Error from server: error dialing backend: dial tcp 10.0.1.10:10250: connect: no route to host

# oc logs sdn-vfjxw
Error from server: Get https://worker-1.ocp41.rhel.worker:10250/containerLogs/openshift-sdn/sdn-vfjxw/sdn: dial tcp 10.0.1.10:10250: connect: no route to host
~~~

[0] Adding RHEL compute machines to an OpenShift Container Platform cluster
    [ https://docs.openshift.com/container-platform/4.1/machine_management/adding-rhel-compute.html ]
~~~
$ cd /usr/share/ansible/openshift-ansible
$ ansible-playbook -i /<path>/inventory/hosts playbooks/scaleup.yml 
~~~


Version-Release number of the following components:
rpm -q openshift-ansible
openshift-ansible-4.1.9-201907280809.git.160.39bd430.el7.noarch

rpm -q ansible
ansible-2.7.12-1.el7ae.noarch

ansible --version
ansible 2.7.12
  config file = /etc/ansible/ansible.cfg
  configured module search path = [u'/root/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python2.7/site-packages/ansible
  executable location = /usr/bin/ansible
  python version = 2.7.5 (default, Jun 11 2019, 12:19:05) [GCC 4.8.5 20150623 (Red Hat 4.8.5-36)]

How reproducible:

You can always reproduce this issue as adding RHEL worker through [0]steps.

[0] Adding RHEL compute machines to an OpenShift Container Platform cluster
    [ https://docs.openshift.com/container-platform/4.1/machine_management/adding-rhel-compute.html ]
~~~
$ cd /usr/share/ansible/openshift-ansible
$ ansible-playbook -i /<path>/inventory/hosts playbooks/scaleup.yml 
~~~

Steps to Reproduce:
1.
2.
3.

Actual results:

"oc rsh/exec/logs" are failed with "connect: no route to host".

Expected results:

"oc rsh/exec/logs" work well without any errors.

Additional info:
Please attach logs from ansible-playbook with the -vvv flag

Comment 5 Weihua Meng 2019-08-16 07:32:24 UTC
Fixed.

openshift-ansible-4.2.0-201908142219.git.188.7254b39.el7

Comment 6 errata-xmlrpc 2019-10-16 06:35:39 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:2922


Note You need to log in before you can comment on or make changes to this bug.