https://github.com/ovn-org/ovn-kubernetes/issues/928 Kubernetes expects services without endpoints to reject connections rather than blackhole them. ovn-kubernetes currently removes service VIPs from the node switch service load balancer when they have no endpoints, which blackholes the connections. Instead, a node switch ACL should be created to reject traffic to that Service VIP which will either RST for TCP or ICMP unreach for UDP.
Mark's patch is here. IIRC it is complete but needed some functional testing to push it over the line: https://github.com/putnopvut/ovn-kubernetes/tree/acl_reject
The PR is IPv4 only though; needs some small updates for v6.
Just making sure that Mark has no intention of finishing his patch and taking this bug before I take it. Can you please confirm Mark?
After talking with Mark I'll go ahead and take this.
https://github.com/ovn-org/ovn-kubernetes/pull/1096
This ovn bug should not block 4.4. We will keep working on it and backport to 4.4.z and 4.3.z. I will make clones to track.
Included with https://github.com/openshift/ovn-kubernetes/pull/134
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:2409