Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 2017399

Summary:	Issues with errors and performance of Network Policies when using OVN
Product:	OpenShift Container Platform	Reporter:	Andy Bartlett <andbartl>
Component:	Networking	Assignee:	Jaime Caamaño Ruiz <jcaamano>
Networking sub component:	ovn-kubernetes	QA Contact:	Anurag saxena <anusaxen>
Status:	CLOSED ERRATA	Docs Contact:
Severity:	urgent
Priority:	urgent	CC:	cldavey, jcaamano, jnordell, jpradhan, mleonard, nusiddiq, openshift-bugs-escalate, the_shade, trozet, zzhao
Version:	4.7
Target Milestone:	---
Target Release:	4.7.z
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	No Doc Update
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-02-22 14:34:00 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Andy Bartlett 2021-10-26 12:34:35 UTC

Description of problem:
My customer is facing issues with the performance and errors when using Network Policies when using OVN:

Failed to create pod sandbox: rpc error: code = Unknown desc = failed to create pod network sandbox k8s_pr13-8390-rtr-service-745fbffb4f-q4fj7_rws-dso-tst-13_aadc25e7-da5d-443c-9610-04ff4e1843c5_0(5e74a3e874b218302256f8af3bc91da63ec3f947edd081f2f851878d5b439110): error adding pod rws-dso-tst-13_pr13-8390-rtr-service-745fbffb4f-q4fj7 to CNI network "multus-cni-network": [rws-dso-tst-13/pr13-8390-rtr-service-745fbffb4f-q4fj7:ovn-kubernetes]: error adding container to network "ovn-kubernetes": CNI request failed with status 400: '[rws-dso-tst-13/pr13-8390-rtr-service-745fbffb4f-q4fj7 5e74a3e874b218302256f8af3bc91da63ec3f947edd081f2f851878d5b439110] [rws-dso-tst-13/pr13-8390-rtr-service-745fbffb4f-q4fj7 5e74a3e874b218302256f8af3bc91da63ec3f947edd081f2f851878d5b439110] failed to configure pod interface: error while waiting on flows for pod: timed out waiting for OVS flows '

Version-Release number of selected component (if applicable):

OCP 4.7.21


How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

Comment 4 the_shade@tut.by 2021-10-26 17:38:40 UTC

Hi all,

it seems that the issue is connected with OVN-Kubernetes CNI and Networks policies. Without ACL all is OK.
We have the same problem with performance. 

https://github.com/ovn-org/ovn-kubernetes/issues/1638

Comment 19 milti leonard 2021-11-02 18:48:31 UTC

@nusiddiq, do you have any insight on the question posed by the cu above? are there changes between the versions (4.7/4.8/4.90 that would explain the huge discrepency in the number of flows generated?

ty

Comment 26 Red Hat Bugzilla 2023-09-15 01:36:46 UTC

The needinfo request[s] on this closed bug have been removed as they have been unresolved for 365 days