-
Story
-
Resolution: Unresolved
-
Undefined
-
None
-
None
-
None
-
False
-
-
False
-
-
Description: Background & Problem Currently, using standard network configuration, any pod in the cluster can theoretically access the out-of-band (OOB) management network. This presents a security risk. To mitigate this, we want to restrict OOB access so that only authorized namespaces can reach it.
Proposed Solution Configure egressIP for the openshift-workload-availability namespace. This will ensure that all traffic from FAR pods (and other components in this namespace) accessing the OOB network appears to originate from a specific, dedicated IP address rather than the general Node IP.
Goal Validate that when egressIP is configured on the openshift-workload-availability namespace:
- Fence Agents Remediation (FAR) successfully utilizes the EgressIP for fencing operations.
- Other critical components in the namespace (specifically Self Node Remediation and Node Health Check) remain fully functional and are not negatively impacted by the network changes.