Bug 1936443
| Summary: | Hive based OCP IPI baremetal installation fails to connect to API VIP port 22623 | |||
|---|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | Ulrich Schlueter <uschlute> | |
| Component: | Installer | Assignee: | Steven Hardy <shardy> | |
| Installer sub component: | OpenShift on Bare Metal IPI | QA Contact: | Amit Ugol <augol> | |
| Status: | CLOSED ERRATA | Docs Contact: | ||
| Severity: | high | |||
| Priority: | urgent | CC: | bschmaus, dguthrie, kiran, lars, ngupta, ohochman, pablo.iranzo, rbartal, sasha, shardy, trwest, tuado | |
| Version: | 4.8 | Keywords: | Triaged | |
| Target Milestone: | --- | |||
| Target Release: | 4.8.0 | |||
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | Doc Type: | If docs needed, set a value | ||
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 1939417 (view as bug list) | Environment: | ||
| Last Closed: | 2021-07-27 22:51:42 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 1831748, 1935163, 1939417, 1940275 | |||
|
Description
Ulrich Schlueter
2021-03-08 14:09:29 UTC
I suspect this is related to changes made during 4.7 to collect the MCS rendered config via terraform, the aim being to pass the full configuration via the Ironic config drive (so that common network configurations like bond+vlans become possible). https://github.com/openshift/installer/pull/4427 However in the hive case it's likely there are firewall rules that prevent access to the MCS port, and this is probably blocking access to the MCS on the bootstrap VM. I proposed a revert ref https://github.com/openshift/installer/pull/4722 since the full-ignition approach didn't work out for workers, so it ended up being a partial solution to the bond+vlan requirement (we're looking into alternatives) > However in the hive case it's likely there are firewall rules that prevent access to the MCS port, and this is probably blocking access to the MCS on the bootstrap VM.
In particular, there are rules both on the host *and* in the pod namespace that block access to port 22623. E.g. with a shell in a pod at PID 2451918, we see:
[root@os-ctrl-2 ~]# nsenter -t 2451918 -n iptables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A FORWARD -p tcp -m tcp --dport 22623 --tcp-flags FIN,SYN,RST,ACK SYN -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -p tcp -m tcp --dport 22624 --tcp-flags FIN,SYN,RST,ACK SYN -j REJECT --reject-with icmp-port-unreachable
[...]
-A OUTPUT -p tcp -m tcp --dport 22623 --tcp-flags FIN,SYN,RST,ACK SYN -j REJECT --reject-with icmp-port-unreachable
-A OUTPUT -p tcp -m tcp --dport 22624 --tcp-flags FIN,SYN,RST,ACK SYN -j REJECT --reject-with icmp-port-unreachable
[...]
Will this be backported to 4.7 or only 4.8+ ? (In reply to Pablo Iranzo Gómez from comment #6) > Will this be backported to 4.7 or only 4.8+ ? I am planning to backport it to 4.7, I'll clone this bug and propose the backport manually since the automated cherry-pick on https://github.com/openshift/installer/pull/4722 failed *** Bug 1932799 has been marked as a duplicate of this bug. *** Verified: Was able to deploy a spoke cluster with hive. Hub cluster version: 4.8.0-0.nightly-2021-04-30-201824 Hive version: hive-operator.v1.1.2 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: OpenShift Container Platform 4.8.2 bug fix and security update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2021:2438 The needinfo request[s] on this closed bug have been removed as they have been unresolved for 365 days |