Bug 2025467 - [OVN-K][ETP=local] Host to service backed by ovn pods doesn't work for ExternalTrafficPolicy=local
Summary: [OVN-K][ETP=local] Host to service backed by ovn pods doesn't work for Extern...
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Networking
Version: 4.10
Hardware: Unspecified
OS: Unspecified
Target Milestone: ---
: 4.10.0
Assignee: Surya Seetharaman
QA Contact: Anurag saxena
Depends On:
TreeView+ depends on / blocked
Reported: 2021-11-22 10:07 UTC by Surya Seetharaman
Modified: 2022-03-10 16:30 UTC (History)
0 users

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2022-03-10 16:29:53 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Github openshift ovn-kubernetes pull 907 0 None open Bug 2025467: ETP=local,SGW: Add DNAT rule towards 2022-01-14 21:13:56 UTC
Red Hat Product Errata RHSA-2022:0056 0 None None None 2022-03-10 16:30:17 UTC

Description Surya Seetharaman 2021-11-22 10:07:36 UTC
Description of problem:

Current traffic flow for ETP=local for host1->svc(host1IP:NP)->ovn-k pod:

1) traffic from host gets DNAT-ed to clusterIP svc using iptables
2) traffic sent to br-ex
3) hits the GR load balancer
4) gets DNAT-ed to the backend pods,
5) depending on if this is on the same node or a different one, we'll have packet delivered to the pod if its on the same node, or it passes via geneve tunnel to the destination node where the pod lives.

This neither retains the sourceIP nor respects the ETP=local. 

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. create a nodeport service with ETP=local
2. docker exec -it ovn-worker bash
3. curl ovn-workerIP:nodePort

Actual results:
It hits any backend pod i.e its treated like ETP=cluster

Expected results:
Should only hit local node pod i.e treat it like ETP=local

Additional info:

Comment 1 Surya Seetharaman 2022-01-04 11:39:37 UTC
Opened upstream fix: https://github.com/ovn-org/ovn-kubernetes/pull/2737

Comment 8 errata-xmlrpc 2022-03-10 16:29:53 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.10.3 security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.