Bug 1856289: Block MCS and metadata for host-networking pods #698
Conversation
openshift-ci-robot
added
the
approved
|
I'm a bit not sure if this is required, as e.g. ovn-kubernetes does not block it. I'm checking the regular openshift-sdn now. |
It does now. openshift/ovn-kubernetes#170 There's some discussion in https://bugzilla.redhat.com/show_bug.cgi?id=1849205 about the fact that we need to be doing this at a lower level rather than requiring every network plugin to implement this independently. |
Oh, thank you for linking that patch, I wasn't aware of it and only checked ovn-kubernetes a while ago. I see it's not blocking the metadata server, should I remove that part from the patch? |
|
yes, the eventual decision was that we only block the metadata server from pods, but we block the MCS from everywhere |
This commit adds an init container to kuryr-daemon pods that will execute iptables commands to block access to machine-config-server for pods that run on host networking. It should not be required at all after ignition.
|
Looks good to me. I assume it was tested? |
|
/retest |
dulek
changed the title
openshift-ci-robot
added
bugzilla/severity-high
|
@dulek: This pull request references Bugzilla bug 1856289, which is valid. The bug has been moved to the POST state. The bug has been updated to refer to the pull request using the external bug tracker. 3 validation(s) were run on this bug
In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
Yes, I tested it and it does work fine. Just created a BZ. |
|
/lgtm |
|
/retest Please review the full test history for this PR and help us cut down flakes. |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: dulek, luis5tb, MaysaMacedo The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/retest Please review the full test history for this PR and help us cut down flakes. |
1 similar comment
|
/retest Please review the full test history for this PR and help us cut down flakes. |
|
@dulek: The following test failed, say
Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
|
@dulek: All pull requests linked via external trackers have merged: openshift/cluster-network-operator#698. Bugzilla bug 1856289 has been moved to the MODIFIED state. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/cherry-pick release-4.5 |
|
@dulek: new pull request created: #706 In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
This commit adds an init container to kuryr-daemon pods that will
execute iptables commands to block access to machine-config-server and
metadata server for pods that run on host networking. Both should not be
required after ignition.