Comments (3)
Hi @viveksinghggits !
Right so the logging indicates there is a default deny ACL for egress traffic in the namespace where the pod with IP a.b.c.233:44064 lives and so a syn packet going from this podIP towards a.0.b.45:6443 is getting dropped.
So it mostly has to be a containerPort or one of the port types defined on the podSpec for one of the containers.
from ovn-kubernetes.
@tssurya Right, I understand. But the problem is the pod spec does't actually have a port specified and the reason is, it's not a long living pod we are not running any service (that needs to be exposed) in the pod. We create it to just run two commands. And then the pod completes/terminates. None of those two commands communicate with kueb-apiserver. And that is what's puzzling me.
2024-03-12T20:58:09.469Z|00575|acl_log(ovn_pinctrl0)|INFO|name="mongodb-logical_egressDefaultDeny", verdict=drop, severity=alert, direction=from-lport: tcp,vlan_tci=0x0000,dl_src=0a:58:0a:83:00:70,dl_dst=0a:58:0a:83:00:01,nw_src=a.b.c.112,nw_dst=d.e.f.42,nw_tos=0,nw_ecn=0,nw_ttl=64,nw_frag=no,tp_src=49562,tp_dst=6443,tcp_flags=syn
k get pods -n mongodb-logical kanister-job-wtkfb -owide
k eNAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
kanister-job-wtkfb 1/1 Running 0 35s a.b.c.112 ip-defg.zone.compute.internal <none> <none>
k exec -it -n mongodb-logical kanister-job-wtkfb -- bash
root@kanister-job-wtkfb:/# netstat -tulpn | grep :49562
root@kanister-job-wtkfb:/# cat /proc/net/tcp
sl local_address rem_address st tx_queue rx_queue tr tm->when retrnsmt uid timeout inode
And podspec is here that doesn't actually have the port specified.
from ovn-kubernetes.
This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 5 days.
from ovn-kubernetes.
Related Issues (20)
- node deletion results stale lsps and IP leaking on layer2/localnet networks HOT 1
- UT Flake: `handles a HO node is switched to a OVN node` is flaking HOT 3
- Flake e2e: ACL Logging for NetworkPolicy when the namespace's ACL logging annotation is updated
- Load Balancer Service Tests with MetalLB [It] Should ensure load balancer service works with 0 node ports when ETP=local
- Cleanup Hardware Offload docs HOT 1
- Cleanup DPU Support/Acceleration docs HOT 1
- Cleanup Kubevirt Live Migration docs HOT 2
- Cleanup MultiNetworking Docs HOT 2
- Cleanup DNS name resolver docs HOT 3
- Add proper docs for observability, grafana dashboards, metrics HOT 2
- Fix the PR labeler action
- FLAKE: External Gateway With Admin Policy Based External Route CRs e2e multiple external gateway validation Should validate ICMP connectivity to multiple external gateways for an ECMP scenario IPV4 HOT 4
- Flake: should work on secondary node interfaces for ETP=local and ETP=cluster when backend pods are also served by EgressIP HOT 2
- ovn-kube-f and ovn-kube-u image renaming was incomplete HOT 1
- Support EgressIP for user defined networks HOT 1
- Flake: [FAIL] External Gateway With Admin Policy Based External Route CRs e2e non-vxlan external gateway through a gateway pod Should validate ICMP connectivity to an external gateway's loopback address via a gateway pod [It] ipv4 HOT 9
- [FAIL] e2e egress firewall policy validation with external containers [It] Should validate the egress firewall policy functionality for allowed IP HOT 9
- Upgrades tests operation cancelled
- e2e EgressQoS validation -- account for single stack cluster
- Transit switch subnet overlap check is missing HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from ovn-kubernetes.