Document URL: https://access.redhat.com/documentation/en-us/openshift_container_platform/3.11/html/cluster_administration/admin-guide-manage-pods#admin-guide-limit-pod-access-egress-pods Section Number and Name: 7.3.3. Limiting Pod Access with Egress Firewall Describe the issue: The dnsName of EgressNetworkPolicy refresh time is 30 seconds in the document. But it is different with code 1. The Egressnetworkpolicy dnsName ttl value will get from dns server domain ttl data first. https://github.com/openshift/origin/blob/v3.11.0/pkg/network/common/dns.go#L154-#L165 https://github.com/openshift/origin/blob/v3.11.0/pkg/network/common/dns.go#L173 2. If the ttl data doesn't exist, the dnsName will refresh by default 30 mintues. https://github.com/openshift/origin/blob/v3.11.0/pkg/network/common/dns.go#L17 https://github.com/openshift/origin/blob/v3.11.0/pkg/network/common/dns.go#L151 https://github.com/openshift/origin/blob/v3.11.0/pkg/network/common/dns.go#L170 https://github.com/openshift/origin/blob/v3.11.0/pkg/network/common/dns.go#L176 Suggestions for improvement: Additional information: Please confirm the dnsName of EgressNetworkPolicy refresh is same or not on OCP 3.x and 4.x.
Hi Jacob, Can you confirm whether this update about the DNS refresh time makes sense? Thanks!
@zzhao, @jdesousa, @jtanenba PTAL: https://github.com/openshift/openshift-docs/pull/29660
Hi Sorry for the delay. So the current behavior is what Mike said. I just changed the behavior so that: 1- The default TTL is 30 seconds 2- If a TTL is larger or equal than 30 min we query it again after 30 minutes 3- If a TTL is larger than 30 seconds but smaller than 30 minutes, we query it after 30 seconds. 4- If a TTL is smaller than 30 seconds we wait TTL seconds to query it again PR: https://github.com/openshift/sdn/pull/263 I know the docs bug is for 3.11 but I'm backporting this.
Filed bug https://bugzilla.redhat.com/show_bug.cgi?id=1933711 to track PR https://github.com/openshift/sdn/pull/263 which is not only doc change anymore.
The needinfo request[s] on this closed bug have been removed as they have been unresolved for 500 days