-
Bug
-
Resolution: Obsolete
-
Normal
-
None
-
4.13, 4.12, 4.11, 4.10, 4.14, 4.15, 4.16, 4.17, 4.18
-
Quality / Stability / Reliability
-
False
-
-
None
-
Important
-
No
-
None
-
None
-
None
-
None
-
Release Note Not Required
-
N/A
-
None
-
None
-
None
-
None
Description of problem:
There's an issue with internal NLBs as documented by https://issues.redhat.com/browse/OCPBUGS-9026: the NLB's Client IP Preservation feature causes connections to fail if a client pod tries to establish a connection to a router pod on the same node.
The reason has to do with SNAT'ing, DNAT'ing, and conntrack tables, but in short, the Client IP Preservation cause Kube Proxy to drop connections that go out to the internal NLB and come back to the same host.
The problem and workarounds have been documented in https://docs.google.com/document/d/10wPILm1WDBP1wQULqAcwD_NvnMRjZm8bHgdHMIH8Goo/edit#
This bug is to add at least a warning, and possible workaround instructions to the doc explaining this scenario. The doc page that it should be added to is https://docs.openshift.com/container-platform/4.13/networking/configuring_ingress_cluster_traffic/configuring-ingress-cluster-traffic-aws.html
Version-Release number of selected component (if applicable):
4.10 - 4.14
How reproducible:
It's docs...100%?
Steps to Reproduce:
1. https://docs.openshift.com/container-platform/4.13/networking/configuring_ingress_cluster_traffic/configuring-ingress-cluster-traffic-aws.html
Actual results:
No warning about internal NLBs
Expected results:
Warning about internal NLBs
Additional info:
The Network Edge team will provide a documentation update suggestion and the docs team can tweak as they see fit.
- is related to
-
OCPBUGS-58456 CCM/AWS - hairpin connection failed when Service type-LoadBalancer NLB with internal scheme
-
- ASSIGNED
-
- relates to
-
RFE-2106 Disable Client IP preservation in AWS NLB for sharded ingress service
-
- Approved
-