Bug 1760166 - openshift-ansible openshift_aws security_group.yml destroys Service LoadBalancers (aws elb)
Summary: openshift-ansible openshift_aws security_group.yml destroys Service LoadBalan...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Installer
Version: 3.11.0
Hardware: All
OS: Other
unspecified
high
Target Milestone: ---
: 3.11.z
Assignee: Joseph Callen
QA Contact: Johnny Liu
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-10-10 02:56 UTC by Drew Anderson
Modified: 2019-10-18 01:34 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-10-18 01:34:44 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Github openshift openshift-ansible pull 11944 None None None 2019-10-10 12:27:51 UTC
Red Hat Product Errata RHBA-2019:3139 None None None 2019-10-18 01:34:45 UTC

Description Drew Anderson 2019-10-10 02:56:53 UTC
Description of problem:

`oc get service --all-namespaces | grep LoadBalancer`
Service LoadBalancers managed by OpenShift use a "{{ item.value.name }}_k8s" AWS security-group. 

The following code tries to ensure the AWS security-groups exist.

https://github.com/openshift/openshift-ansible/blob/706d0643371bc84706879a10ae18619582dd605a/roles/openshift_aws/tasks/security_group.yml#L18-L25

- name: create the k8s sgs for the node group
  ec2_group:
    name: "{{ item.value.name }}_k8s"
    description: "{{ item.value.desc }} for k8s"
    region: "{{ openshift_aws_region }}"
    vpc_id: "{{ vpcout.vpcs[0].id }}"
  with_dict: "{{ openshift_aws_node_security_groups }}"
  register: k8s_sg_create


As there is no "rules" key in the above code, the security groups are created empty. 

The problem exists when the existing security groups both exist and are not empty (they contain ELB security group rules allowing access to nodes from ELBs).

When this rule is executed, the existing rules in the "{{ item.value.name }}_k8s" AWS security groups are destroyed, blocking access from ELBs to Instances. All Instances will go "OutOfService" and connectivity is lost.

OpenShift does not auto-heal this case. 

Version-Release number of selected component (if applicable):

openshift-ansible release-3.11

How reproducible:

100%

Steps to Reproduce:

Re-run security-groups to update for any changes.

Actual results:

Rules allowing Service LoadBalancer ELBs access to Instances are removed.

Expected results:

Rules allowing Service LoadBalancer ELBs access to Instances should be maintained.

Additional info:

This could be fixed in openshift-ansible, or in the OpenShift Service LoadBalancer implementation for auto-heal.

Comment 5 errata-xmlrpc 2019-10-18 01:34:44 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:3139


Note You need to log in before you can comment on or make changes to this bug.