Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-57723

openshift-sdn: No response from openshift router / Ingress when client port is 22623 or 22624

XMLWordPrintable

    • Quality / Stability / Reliability
    • False
    • Hide

      None

      Show
      None
    • None
    • Critical
    • None
    • None
    • None
    • None
    • Customer Escalated, Customer Facing
    • In Progress
    • Release Note Not Required
    • None
    • None
    • None
    • None
    • None

      Description of problem:
      Accessing any OpenShift route is not working when the client port 22623 or 22624 is used. As a customer it's not possible to control which client port is used.

      Version-Release number of selected component (if applicable):
      OCP 4.16

      How reproducible:
      100%

      Steps to Reproduce:
      1. Prepare a 4.16 cluster.
      2. Launch any web app pod (nginx, httpd, etc.).
      3. Access the URL using curl --local-port option to specify 22623 or 22624.

      Actual results:
      No response is returned from the exposed application when the client port is 22623 or 22624. Accessing the openshift webconsole ends in a timeout:

      $ time curl -vvv -m10 --retry 0 -k --local-port 22624-22624 https://console-openshift-console.apps.anowak.sandbox230.opentlc.com/ ; ss -tpn | grep curl
* Host console-openshift-console.apps.anowak.sandbox230.opentlc.com:443 was resolved.
* IPv6: (none)
* IPv4: 35.158.196.125, 52.58.253.75
*   Trying 35.158.196.125:443...
* Local port: 22624
* ipv4 connect timeout after 4999ms, move on!
*   Trying 52.58.253.75:443...
* Local port: 22624
* Connection timed out after 10002 milliseconds
* closing connection #0
curl: (28) Connection timed out after 10002 milliseconds

real	0m10.012s
user	0m0.004s
sys	0m0.007s

      Connection is stale in SYN-SENT:

      SYN-SENT   0	  1	 192.168.68.67:22624  35.158.196.125:443  users:(("curl",pid=694815,fd=5))

      Expected results:
      A response is returned regardless of the client port.

      Additional info:
      There was already a similar issue reported in OCPBUGS-37541, the iptables rules on the nodes should be more selective that external traffic is not blocked:

      Chain OPENSHIFT-BLOCK-OUTPUT (2 references)
target     prot opt source               destination
REJECT     tcp  --  anywhere             anywhere             tcp dpt:22623 flags:FIN,SYN,RST,ACK/SYN reject-with icmp-port-unreachable
REJECT     tcp  --  anywhere             anywhere             tcp dpt:22624 flags:FIN,SYN,RST,ACK/SYN reject-with icmp-port-unreachable

              sdn-team-bot sdn-team bot
              rhn-support-anowak Andreas Nowak
              None
              None
              Huiran Wang Huiran Wang
              None
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: