-
Notifications
You must be signed in to change notification settings - Fork 113
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Support an explicit allowlist for MAC's #139
Conversation
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: stbenjam The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
/test-integration |
/test-centos-integration |
In OpenShift, we have a pivot from a "bootstrap" VM to the cluster Metal3 pod, but there's a short time where both could exist. The bootstrap knows which mac's it needs to respond to, which is only the k8s control plane hosts. This adds an optional feature to our dnsmasq container that blocks DHCP requests from anything but hosts in the allowlist. We are not using dnsmasq native features for ignoring clients as DHCPv6 clients is done based on DUID, so the workaround is to block using iptables.
When I try a dnsmasq container using this on the bootstrap container I get multiple lines of
I wonder if we need a iptable related package in the container? Failing that maybe we run these commands in startironic.sh. |
This might be because of the base image I used (I cherry-picked your batch into downstream ironic image), trying again. but maybe if there are different behaviours in different images we should consider using startironic.sh anyways? |
We did remove iptables from the image ref #104 because of similar errors IIRC? Since this is specific to the bootstrap VM putting the logic into startironic.sh seems reasonable to me? |
Thanks, I moved it over to openshift/installer#3079 |
I think we can close this since it can be solved only on the openshift/installer side. /close |
@stbenjam: Closed this PR. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
In OpenShift, we have a pivot from a "bootstrap" VM to the cluster
Metal3 pod, but there's a short time where both could exist. The
bootstrap knows which mac's it needs to respond to, which is only the
k8s control plane hosts. This adds an optional feature to our dnsmasq
configuration that allows permitting an explicit list of mac's.