Uploaded image for project: 'OpenShift Logging'
  1. OpenShift Logging
  2. LOG-7827

Vector pods keep raising `Watcher Stream received an error` when networkPolicy.ruleSet is RestrictIngressEgress.

XMLWordPrintable

    • Incidents & Support
    • False
    • Hide

      None

      Show
      None
    • False
    • NEW
    • NEW
    • Release Note Not Required
    • Logging - Sprint 278
    • Important

      Description of problem:

      When networkPolicy.ruleSet is RestrictIngressEgress, collector pods keep raising below error:

      2025-10-11T03:39:29.179098Z  WARN vector::kubernetes::reflector: Watcher Stream received an error. Retrying. error=WatchFailed(ReadEvents(Custom { kind: Other, error: Service(hyper::Error(Body, Kind(TimedOut))) }))
      2025-10-11T03:39:47.007582Z ERROR kube_client::client::builder: failed with error client error (Connect)
      2025-10-11T03:39:47.007612Z  WARN vector::kubernetes::reflector: Watcher Stream received an error. Retrying. error=WatchStartFailed(Service(hyper_util::client::legacy::Error(Connect, ConnectError("dns error", Custom { kind: Uncategorized, error: "failed to lookup address information: Name or service not known" }))))
      2025-10-11T03:39:47.813574Z ERROR kube_client::client::builder: failed with error client error (Connect)
      2025-10-11T03:39:47.813599Z  WARN vector::kubernetes::reflector: Watcher Stream received an error. Retrying. error=WatchStartFailed(Service(hyper_util::client::legacy::Error(Connect, ConnectError("dns error", Custom { kind: Uncategorized, error: "failed to lookup address information: Name or service not known" }))))
      2025-10-11T03:39:48.163546Z ERROR kube_client::client::builder: failed with error client error (Connect) 

      Version-Release number of selected component (if applicable):

      cluster-logging.v6.4.0

      How reproducible:

      Always

      Steps to Reproduce:

      1. Create CLF and set networkPolicy.ruleSet to RestrictIngressEgress, e.g.: 

      apiVersion: observability.openshift.io/v1
      kind: ClusterLogForwarder
      metadata:
        name: clf-74397
        namespace: openshift-logging
      spec:
        collector:
          networkPolicy:
            ruleSet: RestrictIngressEgress
        managementState: Managed
        outputs:
        - lokiStack:
            authentication:
              token:
                from: serviceAccount
            dataModel: Viaq
            target:
              name: loki-74397
              namespace: openshift-logging
          name: lokistack
          tls:
            ca:
              key: ca-bundle.crt
              secretName: lokistack-secret-74397
          type: lokiStack
        pipelines:
        - inputRefs:
          - infrastructure
          - audit
          - application
          name: forward-to-lokistack
          outputRefs:
          - lokistack
        serviceAccount:
          name: logcollector-74397 

      2. Wait for several minutes, then check collector pods' log

      Actual results:

      Collector pods keep raising errors when networkPolicy.ruleSet is `RestrictIngressEgress`.

      Expected results:

      No error in collector pods.

      Additional info:

              rh-ee-calee Calvin Lee
              qitang@redhat.com Qiaoling Tang
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved: