Uploaded image for project: 'OpenShift Request For Enhancement'
  1. OpenShift Request For Enhancement
  2. RFE-7489

Missing endpoint slices for open ports the operator uses

XMLWordPrintable

    • Icon: Feature Request Feature Request
    • Resolution: Unresolved
    • Icon: Undefined Undefined
    • None
    • 4.16, 4.18, 4.17
    • Network - Core
    • None
    • None
    • Product / Portfolio Work
    • None
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      1. Proposed title of this feature request

      Missing endpoint slices for open ports the operator uses

      2. What is the nature and description of the request?

      The communication matrix project (see approved design) aims to automatically generate an accurate and up-to-date communication flows matrix that can be delivered to customers as part of product documentation for all ingress flows of OpenShift (see documented communication matrix example]), ports that won't appear in this matrix would be block for use.

      The communication matrix consists of the cluster's endpoint slices which are created automatically for every service on the cluster.
      Some of your operators include open ports with missing services, and by that there are missing endpoint slices.

      Please add services to the following ports:

      • openshift-sdn:
        • 18080 (worker and master nodes, TCP protocol)
        • 9444 (master node, TCP protocol)
        • 9445 (master node, TCP protocol)
        • 53 (worker and master node, TCP and UDP protocols)
      • ovn-kuberentes:
        • 9107 (worker and master nodes, TCP protocol)
        • 10256 (worker and master nodes, TCP protocol)
        • 6081 (worker and master nodes, UDP protocol)
      • cluster-network-operator:
        • 8080 (master node, TCP protocol)

      3. Why does the customer need this? (List the business requirements here)

      The communication matrix is designed to help customers apply nftables rules based on the required ports for operating an OpenShift cluster.
      Its purpose is to enhance cluster security by ensuring that only necessary ports are exposed. To achieve accurate documentation, all ports must have corresponding EndpointSlices.

      4. List any affected packages or components.

      openshift-sdn, ovn-kuberenetes, cluster-network-operator

              mcurry@redhat.com Marc Curry
              rh-ee-shmoran Shir Moran
              None
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Created:
                Updated:
                None
                None