Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-63594

Port 2041/TCP (used by konnectivity-agent) is exposed but should be internal-only.

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Undefined Undefined
    • None
    • 4.21.0
    • HyperShift
    • None
    • Quality / Stability / Reliability
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      Description of problem:

              The communication matrix project aims to automatically generate an accurate and up-to-date communication flows matrix that can be delivered to customers as part of product documentation for all ingress flows of OpenShift (see documented communication matrix example[https://docs.openshift.com/container-platform/4.16/installing/install_config/configuring-firewall.html#network-flow-matrix_configuring-firewall]). The communication matrix consists of the cluster's endpoint slices which are created automatically for every service on the cluster. Your operator includes some open ports that are not connected to a service, and by that there are missing endpoint slices. To solve this issue, please make the port 2041 as not exposed

      Version-Release number of selected component (if applicable):

              Compare between endpoint slices to open ports. compare to the ss command

      How reproducible:

              Every open port will have an endpoint slice.

      Steps to Reproduce:

       Get endpoint slices: run the following command: `oc get endpointslices -n <operator's-namespace>` 2. Get open ports: Make sure the `ss` command is available within your pod - if not use the following command to install iprune2 on your pod: `dnf install -y iproute` In order to get ports using TCP protocol run from your node: `ss -anpltH` In order to get ports using UDP protocol run from your node: `ss -anpluH` 3. Compare the ports between the outputs.

      Actual results:

          the following ports are used but don't have an endpointslice:     Ingress,TCP,2041,kube-system,proxy-agent,konnectivity-agent-zj4s9,konnectivity-agent,worker,false
      Port 2041/TCP is visible and open, even though it’s not associated with a Service and should remain internal.

      Expected results:

          to not appeare as external on the ss command

      Additional info:

      https://prow.ci.openshift.org/view/gs/test-platform-results/logs/periodic-ci-openshift-hypershift-release-4.21-periodics-e2e-aws-ovn-conformance-serial/1982613354698510336    

              cewong@redhat.com Cesar Wong
              aabugosh amal abu gosh
              None
              None
              Yu Li Yu Li
              None
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

                Created:
                Updated: