OCPBUGS-3176: Add config knob for enabling ip forwarding#1468
OCPBUGS-3176: Add config knob for enabling ip forwarding#1468openshift-merge-robot merged 1 commit intoopenshift:masterfrom
Conversation
openshift-ci-robot
added
jira/severity-moderate
|
@trozet: This pull request references Jira Issue OCPBUGS-3176, which is valid. 3 validation(s) were run on this bug
Requesting review from QA contact: The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
Hello @trozet! Some important instructions when contributing to openshift/api: |
openshift-ci
Bot
added
the
size/S
tssurya
left a comment
tssurya
left a comment
There was a problem hiding this comment.
almost lgtm, this should fix the CI failure
With ovn-kubernetes/ovn-kubernetes#3374 and openshift/machine-config-operator#3676 we stopped enabling IP forwarding globally in the OCP host. It is now only enabled on interfaces that OVNK manages. Additionally iptables rules are put in place to limit what traffic is forwarded. This was to resolve an issue where our node by default acts as a router: https://issues.redhat.com/browse/OCPBUGS-3176 With these changes, by default in OCP we will no longer forward IP traffic. Most users should welcome this change as it means the OCP node will not be forwarding traffic unintentionally on their network. However, in case there is some corner case where a user expects traffic to be forwarded we will expose this new config knob to allow them to go back to the old behavior. Signed-off-by: Tim Rozet <trozet@redhat.com>
|
@trozet: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
|
/approve |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: knobunc, trozet, tssurya The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
|
@trozet: Jira Issue OCPBUGS-3176: All pull requests linked via external trackers have merged: Jira Issue OCPBUGS-3176 has been moved to the MODIFIED state. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
Fix included in accepted release 4.14.0-0.nightly-2023-09-11-201102 |
|
Fix included in accepted release 4.14.0-0.nightly-2023-09-12-024050 |
|
Fix included in accepted release 4.14.0-0.nightly-2023-09-15-101929 |
5 participants
With ovn-kubernetes/ovn-kubernetes#3374 and openshift/machine-config-operator#3676 we stopped enabling IP forwarding globally in the OCP host. It is now only enabled on interfaces that OVNK manages. Additionally iptables rules are put in place to limit what traffic is forwarded. This was to resolve an issue where our node by default acts as a router: https://issues.redhat.com/browse/OCPBUGS-3176
With these changes, by default in OCP we will no longer forward IP traffic. Most users should welcome this change as it means the OCP node will not be forwarding traffic unintentionally on their network. However, in case there is some corner case where a user expects traffic to be forwarded we will expose this new config knob to allow them to go back to the old behavior.