Uploaded image for project: 'Red Hat Workload Availability'
  1. Red Hat Workload Availability
  2. RHWA-617

Verify EgressIP support for Fence Agents Remediation (FAR) to restrict OOB network access

XMLWordPrintable

    • Icon: Story Story
    • Resolution: Unresolved
    • Icon: Undefined Undefined
    • None
    • None
    • None
    • False
    • Hide

      None

      Show
      None
    • False

      Description: Background & Problem Currently, using standard network configuration, any pod in the cluster can theoretically access the out-of-band (OOB) management network. This presents a security risk. To mitigate this, we want to restrict OOB access so that only authorized namespaces can reach it.

      Proposed Solution Configure egressIP for the openshift-workload-availability namespace. This will ensure that all traffic from FAR pods (and other components in this namespace) accessing the OOB network appears to originate from a specific, dedicated IP address rather than the general Node IP.

      Goal Validate that when egressIP is configured on the openshift-workload-availability namespace:

      1. Fence Agents Remediation (FAR) successfully utilizes the EgressIP for fencing operations.
      1. Other critical components in the namespace (specifically Self Node Remediation and Node Health Check) remain fully functional and are not negatively impacted by the network changes.

       

              Unassigned Unassigned
              vagnerfarias Vagner Farias
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Created:
                Updated: