Bug 2031141 - Some pods not able to reach k8s api svc IP 198.223.0.1
Summary: Some pods not able to reach k8s api svc IP 198.223.0.1
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Networking
Version: 4.7
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
: 4.10.0
Assignee: Tim Rozet
QA Contact: Weibin Liang
URL:
Whiteboard:
Depends On:
Blocks: 2033672
TreeView+ depends on / blocked
 
Reported: 2021-12-10 15:22 UTC by Dan Small
Modified: 2022-04-22 14:31 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 2033672 (view as bug list)
Environment:
Last Closed: 2022-03-10 16:33:22 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github openshift ovn-kubernetes pull 875 0 None Merged [DownstreamMerge] Merge 21-12-16 2021-12-17 15:07:28 UTC
Github ovn-org ovn-kubernetes pull 2709 0 None open Remove all legacy 501 hybrid route policies in sync 2021-12-13 18:41:46 UTC
Red Hat Product Errata RHSA-2022:0056 0 None None None 2022-03-10 16:33:35 UTC

Comment 7 Weibin Liang 2022-01-10 19:30:36 UTC
Testing passed in 4.10.0-0.nightly-2022-01-10-101431

[weliang@weliang ~]$ oc exec -c ovnkube-master ovnkube-master-lnmw8 -- ovn-nbctl list logical_router_port  rtoj-GR_weliang-104-zzsht-worker-8ftgf
_uuid               : ce5bf213-b48b-4cca-97d1-89e193fc4417
enabled             : []
external_ids        : {}
gateway_chassis     : []
ha_chassis_group    : []
ipv6_prefix         : []
ipv6_ra_configs     : {}
mac                 : "0a:58:64:40:00:06"
name                : rtoj-GR_weliang-104-zzsht-worker-8ftgf
networks            : ["100.64.0.6/16"]
options             : {}
peer                : []


[weliang@weliang ~]$ oc exec -c ovnkube-master ovnkube-master-lnmw8 -- ovn-nbctl lr-policy-list ovn_cluster_router |grep 501
       501 inport == "rtos-weliang-104-zzsht-worker-8ftgf" && ip4.src == $a1009334588083407330 && ip4.dst != 10.128.0.0/14         reroute                100.64.0.6
[weliang@weliang ~]$ oc exec -c ovnkube-master ovnkube-master-lnmw8 -- ovn-nbctl list address_set a1009334588083407330
_uuid               : 772d51de-05b5-4de5-b723-bb14d957bec6
addresses           : ["10.128.2.12"]
external_ids        : {name=hybrid-route-pods-weliang-104-zzsht-worker-8ftgf_v4}
name                : a1009334588083407330
[weliang@weliang ~]$ oc exec -c ovnkube-master ovnkube-master-lnmw8 -- ovn-nbctl find logical_router_policy priority=501
_uuid               : e12322f6-e889-4359-960d-c2423458ab54
action              : reroute
external_ids        : {}
match               : "inport == \"rtos-weliang-104-zzsht-worker-8ftgf\" && ip4.src == $a1009334588083407330 && ip4.dst != 10.128.0.0/14"
nexthop             : []
nexthops            : ["100.64.0.6"]
options             : {}
priority            : 501
[weliang@weliang ~]$ oc exec -c ovnkube-master ovnkube-master-lnmw8 -- ovn-nbctl set logical_router_policy e12322f6-e889-4359-960d-c2423458ab54 nexthops=254.254.254.254
[weliang@weliang ~]$ oc exec -c ovnkube-master ovnkube-master-lnmw8 -- ovn-nbctl find logical_router_policy priority=501
_uuid               : e12322f6-e889-4359-960d-c2423458ab54
action              : reroute
external_ids        : {}
match               : "inport == \"rtos-weliang-104-zzsht-worker-8ftgf\" && ip4.src == $a1009334588083407330 && ip4.dst != 10.128.0.0/14"
nexthop             : []
nexthops            : ["254.254.254.254"]
options             : {}
priority            : 501
[weliang@weliang ~]$ oc edit ns exgw2
namespace/exgw2 edited
[weliang@weliang ~]$ oc get ns exgw2
NAME    STATUS   AGE
exgw2   Active   15m
[weliang@weliang ~]$ oc get ns exgw2 -o yaml
apiVersion: v1
kind: Namespace
metadata:
  annotations:
    k8s.ovn.org/routing-external-gws: 172.18.0.4,172.18.0.5
    openshift.io/sa.scc.mcs: s0:c25,c20
    openshift.io/sa.scc.supplemental-groups: 1000640000/10000
    openshift.io/sa.scc.uid-range: 1000640000/10000
  creationTimestamp: "2022-01-10T19:09:50Z"
  labels:
    kubernetes.io/metadata.name: exgw2
  managedFields:
  - apiVersion: v1
    fieldsType: FieldsV1
    fieldsV1:
      f:metadata:
        f:annotations:
          f:openshift.io/sa.scc.mcs: {}
          f:openshift.io/sa.scc.supplemental-groups: {}
          f:openshift.io/sa.scc.uid-range: {}
    manager: cluster-policy-controller
    operation: Update
    time: "2022-01-10T19:09:50Z"
  - apiVersion: v1
    fieldsType: FieldsV1
    fieldsV1:
      f:metadata:
        f:annotations: {}
        f:labels:
          .: {}
          f:kubernetes.io/metadata.name: {}
    manager: kubectl-create
    operation: Update
    time: "2022-01-10T19:09:50Z"
  - apiVersion: v1
    fieldsType: FieldsV1
    fieldsV1:
      f:metadata:
        f:annotations:
          f:k8s.ovn.org/routing-external-gws: {}
    manager: kubectl-edit
    operation: Update
    time: "2022-01-10T19:24:46Z"
  name: exgw2
  resourceVersion: "110254"
  uid: df68df35-74b2-42a9-bbca-8a3e98817254
spec:
  finalizers:
  - kubernetes
status:
  phase: Active
[weliang@weliang ~]$ oc exec -c ovnkube-master ovnkube-master-lnmw8 -- ovn-nbctl find logical_router_policy priority=501
_uuid               : 91f455de-16f7-4252-9da7-045513ffda3a
action              : reroute
external_ids        : {}
match               : "inport == \"rtos-weliang-104-zzsht-worker-8ftgf\" && ip4.src == $a1009334588083407330 && ip4.dst != 10.128.0.0/14"
nexthop             : []
nexthops            : ["100.64.0.6"]
options             : {}
priority            : 501
[weliang@weliang ~]$

Comment 10 errata-xmlrpc 2022-03-10 16:33:22 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.10.3 security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2022:0056


Note You need to log in before you can comment on or make changes to this bug.