Bug 1858183 - [kuryr] hostnetwork pod can access MCS port 22623 or 22624 on master
Summary: [kuryr] hostnetwork pod can access MCS port 22623 or 22624 on master
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Networking
Version: 4.6
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
: 4.4.z
Assignee: Michał Dulko
QA Contact: GenadiC
URL:
Whiteboard:
Depends On: 1856374
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-07-17 06:55 UTC by OpenShift BugZilla Robot
Modified: 2020-08-04 14:16 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2020-08-04 14:16:04 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Github openshift cluster-network-operator pull 715 None closed [release-4.4] [release-4.5] Bug 1858183: Block MCS and metadata for host-networking pods 2020-08-25 10:12:53 UTC
Red Hat Product Errata RHBA-2020:3128 None None None 2020-08-04 14:16:24 UTC

Comment 3 rlobillo 2020-07-27 13:27:37 UTC
Verified in 4.4.0-0.nightly-2020-07-24-031753 on top of OSP 16.1 RHOS-16.1-RHEL-8-20200723.n.0 compose.

The MCS ports are not accessible from the hostnetwork pod in a cluster with Kuryr.

$ oc create -f https://raw.githubusercontent.com/anuragthehatter/v3-testfiles/master/networking/hostnetwork-pod.json
pod/hostnetwork-pod created

(shiftstack) [stack@undercloud-0 ~]$ openstack server list
+--------------------------------------+---------------------------+--------+-------------------------------------+--------------------+--------+
| ID                                   | Name                      | Status | Networks                            | Image              | Flavor |
+--------------------------------------+---------------------------+--------+-------------------------------------+--------------------+--------+
| 5d55c485-e198-4372-b9e8-4ec9d349498e | ostest-6cgs2-worker-zkbcp | ACTIVE | ostest-6cgs2-openshift=10.196.3.1   | ostest-6cgs2-rhcos |        |
| 1a5ef833-5bdd-4334-9920-d9a7db9fd197 | ostest-6cgs2-worker-zjx4h | ACTIVE | ostest-6cgs2-openshift=10.196.1.116 | ostest-6cgs2-rhcos |        |
| e85dc144-79d7-4224-bc0d-48cbb7491ed0 | ostest-6cgs2-worker-h9jkk | ACTIVE | ostest-6cgs2-openshift=10.196.1.155 | ostest-6cgs2-rhcos |        |
| c54380d3-a63b-4689-a4ba-1fab5d439898 | ostest-6cgs2-master-2     | ACTIVE | ostest-6cgs2-openshift=10.196.2.236 | ostest-6cgs2-rhcos |        |
| d976fe8c-48b4-473e-a083-0cf116bab119 | ostest-6cgs2-master-1     | ACTIVE | ostest-6cgs2-openshift=10.196.0.146 | ostest-6cgs2-rhcos |        |
| c8899a7d-e7ee-461f-bb7d-aa23600d1ca6 | ostest-6cgs2-master-0     | ACTIVE | ostest-6cgs2-openshift=10.196.0.205 | ostest-6cgs2-rhcos |        |
+--------------------------------------+---------------------------+--------+-------------------------------------+--------------------+--------+


(shiftstack) [stack@undercloud-0 ~]$ oc get pods
NAME              READY   STATUS    RESTARTS   AGE
hostnetwork-pod   1/1     Running   0          3h


$ oc rsh hostnetwork-pod
~ $ curl -I http://10.196.0.205:22623/config/master -k
curl: (7) Failed to connect to 10.196.0.205 port 22623: Connection refused
~ $ curl -I http://10.196.0.205:22624/config/master -k
curl: (7) Failed to connect to 10.196.0.205 port 22624: Connection refused


~ $ curl -I http://10.196.0.146:22623/config/master -k
curl: (7) Failed to connect to 10.196.0.146 port 22623: Connection refused
~ $ curl -I http://10.196.0.146:22624/config/master -k
curl: (7) Failed to connect to 10.196.0.146 port 22624: Connection refused


~ $ curl -I http://10.196.2.236:22624/config/master -k
curl: (7) Failed to connect to 10.196.2.236 port 22624: Connection refused
~ $ curl -I http://10.196.2.236:22623/config/master -k
curl: (7) Failed to connect to 10.196.2.236 port 22623: Connection refused

Comment 5 errata-xmlrpc 2020-08-04 14:16:04 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (OpenShift Container Platform 4.4.15 bug fix update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:3128


Note You need to log in before you can comment on or make changes to this bug.