Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-16199

Add warning about internal NLBs Client IP Preservation issue

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Obsolete
    • Icon: Normal Normal
    • None
    • 4.13, 4.12, 4.11, 4.10, 4.14, 4.15, 4.16, 4.17, 4.18
    • Quality / Stability / Reliability
    • False
    • Hide

      None

      Show
      None
    • None
    • Important
    • No
    • None
    • None
    • None
    • None
    • Release Note Not Required
    • N/A
    • None
    • None
    • None
    • None

      Description of problem:

      There's an issue with internal NLBs as documented by https://issues.redhat.com/browse/OCPBUGS-9026: the NLB's Client IP Preservation feature causes connections to fail if a client pod tries to establish a connection to a router pod on the same node.

      The reason has to do with SNAT'ing, DNAT'ing, and conntrack tables, but in short, the Client IP Preservation cause Kube Proxy to drop connections that go out to the internal NLB and come back to the same host.

      The problem and workarounds have been documented in https://docs.google.com/document/d/10wPILm1WDBP1wQULqAcwD_NvnMRjZm8bHgdHMIH8Goo/edit# 

      This bug is to add at least a warning, and possible workaround instructions to the doc explaining this scenario. The doc page that it should be added to is https://docs.openshift.com/container-platform/4.13/networking/configuring_ingress_cluster_traffic/configuring-ingress-cluster-traffic-aws.html 

      Version-Release number of selected component (if applicable):

      4.10 - 4.14

      How reproducible:

      It's docs...100%?

      Steps to Reproduce:

      1. https://docs.openshift.com/container-platform/4.13/networking/configuring_ingress_cluster_traffic/configuring-ingress-cluster-traffic-aws.html
      

      Actual results:

      No warning about internal NLBs

      Expected results:

      Warning about internal NLBs

      Additional info:

      The Network Edge team will provide a documentation update suggestion and the docs team can tweak as they see fit.

              ocp-docs-bot OCP DocsBot
              gspence@redhat.com Grant Spence (Inactive)
              None
              None
              Hongan Li Hongan Li
              None
              Votes:
              0 Vote for this issue
              Watchers:
              8 Start watching this issue

                Created:
                Updated:
                Resolved: