Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: virt handler fails to use nftables because of missing nft binary: {"component":"virt-handler","level":"info","msg":"failed to load nftable ipv4-nat","pos":"common.go:243","reason":"exec: \"nft\": executable file not found in $PATH","timestamp":"2021-10-08T11:56:56.745518Z"} Consequence of missing nft binary are missing rules for service-mesh, meaning that VMs with no explicit ports have isto-proxy sidecar in non-ready state. Version-Release number of selected component (if applicable): How reproducible: Steps to Reproduce: 1. Set logVerbosity to 5 2. Create a VM with masquerade binding Actual results: the above log is in the virt-handler log Expected results: virt-handler should use nftables by default Additional info:
We have identified another discrepancy between U/S and D/S and have to postpone this to 4.9.2.
Verified. OCP version - 4.9.18. Virt-handler 4.9.3-1. Deployed VM with istio-proxy container and a svc with port 22 as targetPort. Successfully connected to the VM with ssh via port 22.
Back to dev. Verification steps didn't cover fix. Needs update
For verification: 1. Create a VM with masquerade interface and no specific ports defined 2. Check that all containers in the virt-launcher pod remain Ready
Verified. OCP version - 4.9. virt-handler v4.9.3-4. Deployed two vms, one with specified ports for the masquerade iface, the other without. Both vms - Are unreachable on port 22, Reachable on istio ports - 8000+ Can reach outside (8.8.8.8 for example).
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (OpenShift Virtualization 4.9.3 Images), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2022:0641