Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-63587

[release-4.20] Missing endpoint slices for open ports the operator uses

XMLWordPrintable

    • Quality / Stability / Reliability
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • None
    • None
    • Proposed
    • Bug Fix
    • Hide
      Previously, the Cluster API's cluster-machine-approver metrics port (9193) was incorrectly bound to all interfaces (0.0.0.0) within its Pod.
      This port is intended for internal use only and is proxied by kube-rbac-proxy. Because the port was exposed without a corresponding Kubernetes Service, it was incorrectly flagged as a missing EndpointSlice by new CI tests.

      With this update, the metrics server now correctly binds to 127.0.0.1 (localhost), making it internal to the Pod.
      Metrics scraping continues to function correctly by connecting to the kube-rbac-proxy on port 9194, which securely forwards requests to the internal 9193 port
      Show
      Previously, the Cluster API's cluster-machine-approver metrics port (9193) was incorrectly bound to all interfaces (0.0.0.0) within its Pod. This port is intended for internal use only and is proxied by kube-rbac-proxy. Because the port was exposed without a corresponding Kubernetes Service, it was incorrectly flagged as a missing EndpointSlice by new CI tests. With this update, the metrics server now correctly binds to 127.0.0.1 (localhost), making it internal to the Pod. Metrics scraping continues to function correctly by connecting to the kube-rbac-proxy on port 9194, which securely forwards requests to the internal 9193 port
    • None
    • None
    • None
    • None

      This is a clone of issue OCPBUGS-63519. The following is the description of the original issue:

      Description of problem:

          The communication matrix project aims to automatically generate an accurate and up-to-date communication flows matrix that can be delivered to customers as part of product documentation for all ingress flows of OpenShift (see documented communication matrix example[https://docs.openshift.com/container-platform/4.16/installing/install_config/configuring-firewall.html#network-flow-matrix_configuring-firewall]). The communication matrix consists of the cluster's endpoint slices which are created automatically for every service on the cluster. Your operator includes some open ports that are not connected to a service, and by that there are missing endpoint slices. To solve this issue, please connect a service to the following ports: 9193 and 9194 (master node, TCP protocol).

      Version-Release number of selected component (if applicable):

          

      How reproducible:

          Compare between endpoint slices to open ports. compare to the ss command

      Steps to Reproduce:

        1. Get endpoint slices: run the following command: `oc get endpointslices -n <operator's-namespace>` 2. Get open ports: Make sure the `ss` command is available within your pod - if not use the following command to install iprune2 on your pod: `dnf install -y iproute` In order to get ports using TCP protocol run from your node: `ss -anpltH` In order to get ports using UDP protocol run from your node: `ss -anpluH` 3. Compare the ports between the outputs.

      Actual results:

          the following ports are used but don't have an endpointslice: 
           Ingress,TCP,9193,openshift-cluster-machine-approver,machine-approve,machine-approver-capi-64d5ccdc56-q6tkb,machine-approver-controller,master,false
          Ingress,TCP,9194,openshift-cluster-machine-approver,kube-rbac-proxy,machine-approver-capi-64d5ccdc56-q6tkb,kube-rbac-proxy,master,false
              

      Expected results:

          Every open port will have an endpoint slice.

      Additional info:

          In order to resolve this issue, a service should be connected to the following ports: 9194 and 9193 (master node, TCP protocol). The endpoint slices should be created automatically once the service is up.

              ddonati@redhat.com Damiano Donati
              aabugosh amal abu gosh
              None
              None
              Milind Yadav Milind Yadav
              None
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

                Created:
                Updated: