Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-39158

network policies block HCP OpenShift Virt usage of NodePort endpoint publishing strategy

XMLWordPrintable

    • Moderate
    • None
    • Rejected
    • False
    • Hide

      None

      Show
      None

      Description of problem:

           The HostedCluster api allows for publishing HCP endpoints via nodeports. While this use case is uncommon at the moment, it could become important because nodeports give us a path for backup/restore that doesn't require a LB. LB are problematic for backup/restore because we can't always retrieve the same LB ip/hostname during restore. This depends on the LB provisioner. NodePorts give us a more predictable way to restore an HCP with the same endpoints.
      
      Today NodePort doesn't work for the KubeVirt Platform though.
      
      When we use nodeports with HCP KubeVirt, the KubeVirt VMs are unable to contact the ignition servers to retrieve ignition. If i manually disable the hypershift operator by setting replica: 0, then delete all the network policies within the HCP namespace, the VMs are able to retrieve ignition 
      
      
      Below is an example of the services section of a HostedCluster that uses nodeports.
      
      
          services:
          - service: APIServer
            servicePublishingStrategy:
              nodePort:
                address: 10.0.23.44
              type: NodePort
          - service: Ignition
            servicePublishingStrategy:
              nodePort:
                address: 10.0.23.44
              type: NodePort
          - service: Konnectivity
            servicePublishingStrategy:
              nodePort:
                address: 10.0.23.44
              type: NodePort
          - service: OAuthServer
            servicePublishingStrategy:
              nodePort:
                address: 10.0.23.44
              type: NodePort
          - service: OIDC
            servicePublishingStrategy:
              nodePort:
                address: 10.0.23.44
              type: NodePort
      
      
      
      

      Version-Release number of selected component (if applicable):

          4.18

      How reproducible:

          100%

      Steps to Reproduce:

          1. Create a HCP KubeVirt cluster with NodePort endpoints
          

      Actual results:

          KubeVirt VMs will be stuck trying to retrieve ignition indefinitely  

      Expected results:

          KubeVirt VMs retrieve ignition and boot

      Additional info:

          

            phoracek@redhat.com Petr Horacek
            rhn-engineering-dvossel David Vossel
            Liangquan Li Liangquan Li
            Votes:
            1 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated: