-
Notifications
You must be signed in to change notification settings - Fork 338
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Question]: Need help understanding the source of a connection that is being dropped because of network policy #4217
Comments
Hi @viveksinghggits ! Right so the logging indicates there is a default deny ACL for egress traffic in the namespace where the pod with IP a.b.c.233:44064 lives and so a syn packet going from this podIP towards a.0.b.45:6443 is getting dropped. So it mostly has to be a containerPort or one of the port types defined on the podSpec for one of the containers. |
@tssurya Right, I understand. But the problem is the pod spec does't actually have a port specified and the reason is, it's not a long living pod we are not running any service (that needs to be exposed) in the pod. We create it to just run two commands. And then the pod completes/terminates. None of those two commands communicate with kueb-apiserver. And that is what's puzzling me.
And podspec is here that doesn't actually have the port specified. |
This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 5 days. |
This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 5 days. |
After further investigation it does look like the application that we were running in the pod tried to talk to apiserver because we were importing a package and that package had |
Hey Folks,
I was not able to figure out the proper channel to ask the question, that's why reaching out here. If this is the not the right place, please feel free to let me know.
So, in the logs from pods
-l app=ovnkube-node
from namespaceopenshift-ovn-kubernetes
we can see that a pod is trying to communicate with kubernetes api serverWe see a pod in the concerned namespace with IP
a.b.c.233
but we don't think (kind of sure) that the commands used in this pod are making any connections with kube-apisever. And I am not able to find out which exact process from that pod is trying to make connection with the api-server. I tried to exec into the pod to see if which process is running on port44064
(netstat
) but couldn't see a process on that port. Am I understanding the log incorrectly here or there is actually a process in the pod that is making a connection with kue-apiserver?If there are some other ways to figure that out, I would appreciate that.
The text was updated successfully, but these errors were encountered: