Bug 1908782 - Unable to create IPsec-enabled cluster on GCP platform
Summary: Unable to create IPsec-enabled cluster on GCP platform
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Networking
Version: 4.7
Hardware: Unspecified
OS: Unspecified
urgent
urgent
Target Milestone: ---
: 4.7.0
Assignee: Mark Gray
QA Contact: Anurag saxena
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-12-17 15:44 UTC by Mark Gray
Modified: 2021-02-08 17:19 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: No Doc Update
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-02-08 17:19:25 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github openshift installer pull 4491 0 None closed Bug 1908782: terraform: Add rules to allow internal IPsec traffic 2021-02-07 09:17:57 UTC

Internal Links: 1916373

Description Mark Gray 2020-12-17 15:44:17 UTC 
Description of problem:

When IPsec feature is enabled and a cluster installed on GCP, the cluster does start correctly giving connectivity errors across multiple components as many operators are unavailable.

Version-Release number of selected component (if applicable): 4.7

How reproducible:
Always

Steps to Reproduce:
1. Start cluster using GCP installer with a configuration such as:

spec:
  defaultNetwork:
    type: OVNKubernetes
    ovnKubernetesConfig:
      ipsecConfig: {}

Actual results:
* Cluster fails to start

Expected results:
* Cluster start correctly

Additional info:
Comment 1 Mark Gray 2020-12-17 15:58:58 UTC 
I deployed a cluster without enabling IPsec and tried to send ESP traffic between nodes. I was unable to do this which suggests that ESP traffic is being blocked. This is probably requires firewall rules to enable IKE, ESP and Nat-t traffic.
Comment 8 zhaozhanqi 2021-01-05 12:05:08 UTC 
@anurag,  I guess this issue should be fixed according to above comment. could you help double confirm this?
Comment 10 Matthew Staebler 2021-01-14 16:21:09 UTC 
Changes were made for the IPI installation path but not for the UPI installation path. Similar changes need to be made for UPI as well.
Note You need to log in before you can comment on or make changes to this bug.