Version: OCP 4.10 Platform: GCP Please specify: IPI What happened? Looking at the installer [1] code, It opens up a FW to 4 IPs. Two of them are expected according to link [2] however it is not expected to have the other 2 IPs below to be opened up as they are required for network load balancers and not internal TCP/UDP load balancers 209.85.152.0/22 209.85.204.0/22 Customer's cluster is an internal cluster therefore they are not expecting these IPs to be in the firewall. [1] https://github.com/openshift/installer/blob/b8e2c497249948adffba128dac0713b521b3ce4a/data/data/gcp/cluster/network/firewall.tf#L27 [2] https://cloud.google.com/load-balancing/docs/health-checks#fw-rule What did you expect to happen? It is expected to have only these two IPs 35.191.0.0/16, 130.211.0.0/22 to be open in firewall when doing restricted installation. How to reproduce it (as minimally and precisely as possible)? N/A Anything else we need to know?
The team has reviewed this BZ: 35.191.0.0/16, 130.211.0.0/22 are only needed for network load balancers, but including them in the firewall rules is harmless as they cannot route to the internal LB and those IPs are owned by Google. Custom firewall rules can be provided through UPI installs.
There was a mistake in my previous comment: 209.85.152.0/22, 209.85.204.0/22 are the IPs needed for network load balancers.
Reopening this. We should be able to restrict the firewall rules to the minimum requirement. Will investigate and report if there are any unforeseen issues.
Mark as verified accorinding to the last 3 comments, thanks!
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Important: OpenShift Container Platform 4.13.0 security update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2023:1326