Loading...

XML

Word

Printable

Type: Bug
Resolution: Done-Errata
Priority: Major
Fix Version/s: 4.15.0
Affects Version/s: 4.13.z
Component/s: Networking / ovn-kubernetes
Labels:

Severity:
Critical
Regression:
No
Sprint:
SDN Sprint 246, SDN Sprint 247, SDN Sprint 248, SDN Sprint 249
sprint_count:
4
Blocked:
False
Blocked Reason:

Hide

None

Show
None
Release Note Type:
Enhancement
Release Note Status:
In Progress
Documentation Type:

Network
Target Version:

4.15.0

SFDC Cases Counter:
SFDC Cases Links:

PX Impact Score:
PX Priority Data:
PX Technical Impact Notes:
customers who need session affinity
PX Impact Range:
PX Review Complete:
PX Technical Impact:

UDP Packets are subject to SNAT in a self-managed OCP 4.13.13 cluster on Azure (OVN-K as CNI) using a Load Balancer Service with `externalTrafficPolicy: Local`. UDP Packets correctly arrive to the Node hosting the Pod but the source IP seen by the Pod is the OVN GW Router of the Node.

I've reproduced the customer scenario with the following steps:

Deploy a blank enviroment on Azure using [demo lab | https://demo.redhat.com/catalog?item=babylon-catalog-prod/azure-gpte.open-environment-azure-subscription.prod&utm_source=webapp&utm_medium=share-link ]
Install an OCP 4.13.13 cluster with the installer
Use this GitHub repo to deploy a simple UDP server
Run `oc apply -f server.yaml` to deploy Deployment and Service resources
application listens on 10001 for UDP traffic, while the load balancer listens on 10001 for UDP traffic and forward it on 10001 pod port
Using nc from the bastion host to connect to the external load balancer IP and starting writing something

This is issue is very critical because it is blocking customer business.

blocks

OCPBUGS-28819 [4.14.z] Azure - OCP IPI Installation UDP packets are subject to SNAT with LB Service using ETP equals to Local (OVN-Kubernetes as CNI)

Closed

clones

OCPBUGS-24219 Azure - OCP IPI Installation UDP packets are subject to SNAT with LB Service using ETP equals to Local (OVN-Kubernetes as CNI)

Verified

is blocked by

OCPBUGS-24219 Azure - OCP IPI Installation UDP packets are subject to SNAT with LB Service using ETP equals to Local (OVN-Kubernetes as CNI)

Verified

is cloned by

OCPBUGS-28819 [4.14.z] Azure - OCP IPI Installation UDP packets are subject to SNAT with LB Service using ETP equals to Local (OVN-Kubernetes as CNI)

Closed

links to

openshift/ovn-kubernetes#2045: OCPBUGS-28818: Support Permanent Session Affinity

RHSA-2023:7198 OpenShift Container Platform 4.15 security update

(1 links to)

Assignee:: Surya Seetharaman

Reporter:: Giovanni Luca Izzi

QA Contact:: Arti Sood

Votes:: 0 Vote for this issue

Watchers:: 7 Start watching this issue

Created:: 2024/02/01 11:57 AM

Updated:: 2024/02/27 9:08 PM

Resolved:: 2024/02/27 9:08 PM

Details

Description

Attachments

Issue Links

Activity

People

Dates