Description of problem: Current traffic flow for ETP=local for host1->svc(host1IP:NP)->ovn-k pod: 1) traffic from host gets DNAT-ed to clusterIP svc using iptables 2) traffic sent to br-ex 3) hits the GR load balancer 4) gets DNAT-ed to the backend pods, 5) depending on if this is on the same node or a different one, we'll have packet delivered to the pod if its on the same node, or it passes via geneve tunnel to the destination node where the pod lives. This neither retains the sourceIP nor respects the ETP=local. Version-Release number of selected component (if applicable): How reproducible: Always Steps to Reproduce: 1. create a nodeport service with ETP=local 2. docker exec -it ovn-worker bash 3. curl ovn-workerIP:nodePort Actual results: It hits any backend pod i.e its treated like ETP=cluster Expected results: Should only hit local node pod i.e treat it like ETP=local Additional info:
Opened upstream fix: https://github.com/ovn-org/ovn-kubernetes/pull/2737
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: OpenShift Container Platform 4.10.3 security update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2022:0056