Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1772655

Summary:	[ovn] implement reject for empty services
Product:	OpenShift Container Platform	Reporter:	Dan Williams <dcbw>
Component:	Networking	Assignee:	Tim Rozet <trozet>
Networking sub component:	ovn-kubernetes	QA Contact:	Anurag saxena <anusaxen>
Status:	CLOSED ERRATA	Docs Contact:
Severity:	urgent
Priority:	urgent	CC:	bbennett, bmcfall, cdc, mmichels, trozet
Version:	4.3.0
Target Milestone:	---
Target Release:	4.5.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:
Clones:	1810567 (view as bug list)		Environment:
Last Closed:	2020-07-13 17:12:14 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1795790, 1805651
Bug Blocks:	1810567, 1810570

Description Dan Williams 2019-11-14 20:00:04 UTC

https://github.com/ovn-org/ovn-kubernetes/issues/928

Kubernetes expects services without endpoints to reject connections rather than blackhole them. ovn-kubernetes currently removes service VIPs from the node switch service load balancer when they have no endpoints, which blackholes the connections.

Instead, a node switch ACL should be created to reject traffic to that Service VIP which will either RST for TCP or ICMP unreach for UDP.

Comment 2 Dan Williams 2020-01-13 15:56:01 UTC

Mark's patch is here. IIRC it is complete but needed some functional testing to push it over the line:  https://github.com/putnopvut/ovn-kubernetes/tree/acl_reject

Comment 3 Dan Williams 2020-01-13 15:56:59 UTC

The PR is IPv4 only though; needs some small updates for v6.

Comment 4 Tim Rozet 2020-01-21 15:31:14 UTC

Just making sure that Mark has no intention of finishing his patch and taking this bug before I take it. Can you please confirm Mark?

Comment 5 Tim Rozet 2020-01-23 15:05:47 UTC

After talking with Mark I'll go ahead and take this.

Comment 6 Dan Williams 2020-02-28 14:34:12 UTC

https://github.com/ovn-org/ovn-kubernetes/pull/1096

Comment 7 Ben Bennett 2020-03-05 14:09:09 UTC

This ovn bug should not block 4.4.  We will keep working on it and backport to 4.4.z and 4.3.z.  I will make clones to track.

Comment 8 Tim Rozet 2020-04-14 13:56:11 UTC

Included with https://github.com/openshift/ovn-kubernetes/pull/134

Comment 14 errata-xmlrpc 2020-07-13 17:12:14 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:2409