Skip to content

Commit 4c4fc0d

Browse files
kelbrown20kelbrown20
committed
OSDOCS#6574: MicroShift Auditing exposed network settings
1 parent a5222c6 commit 4c4fc0d

6 files changed

+178
-1
lines changed

‎microshift_networking/microshift-networking-settings.adoc

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,3 +38,11 @@ include::modules/microshift-deploying-a-load-balancer.adoc[leveloffset=+1]
3838
include::modules/microshift-blocking-nodeport-access.adoc[leveloffset=+1]
3939

4040
include::modules/microshift-mDNS.adoc[leveloffset=+1]
41+
42+
include::modules/microshift-exposed-audit-ports.adoc[leveloffset=+1]
43+
44+
include::modules/microshift-exposed-audit-ports-hostnetwork.adoc[leveloffset=+1]
45+
46+
include::modules/microshift-exposed-audit-ports-hostport.adoc[leveloffset=+1]
47+
48+
include::modules/microshift-exposed-audit-ports-loadbalancer.adoc[leveloffset=+1]

‎modules/microshift-configuring-ovn.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ $ sudo cp /etc/microshift/ovn.yaml.default /etc/microshift/ovn.yaml
2121
+
2222
[source, yaml]
2323
----
24-
$ cat /etc/microshift/ovn.yaml.default
24+
$ cat /etc/microshift/ovn.yaml
2525
----
2626
+
2727
.Example YAML file with default maximum transmission unit (MTU) value

‎modules/microshift-exposed-audit-ports-hostnetwork.adoc

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * microshift_networking/microshift-networking-settings.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="microshift-exposed-audit-ports-hostnetwork_{context}"]
7+
8+
== hostNetwork
9+
10+
When a pod is configured with the `hostNetwork:true` setting, the pod is running in the host network namespace. This configuration can independently open host ports. {microshift-short} component logs cannot be used to track this case, the ports are subject to firewalld rules. If the port opens in firewalld, you can view the port opening in the firewalld debug log.
11+
12+
.Prerequisites
13+
14+
* You have root user access to your build host.
15+
16+
.Procedure
17+
18+
. Optional: You can check that the `hostNetwork:true` parameter is set in your ovnkube-node pod by using the following example command:
19+
+
20+
[source,terminal]
21+
----
22+
$ sudo oc get pod -n openshift-ovn-kubernetes <ovnkube-node-pod-name> -o json | jq -r '.spec.hostNetwork' true
23+
----
24+
25+
. Enable debug in the firewalld log by running the following command:
26+
+
27+
[source,terminal]
28+
----
29+
$ sudo vi /etc/sysconfig/firewalld
30+
FIREWALLD_ARGS=--debug=10
31+
----
32+
33+
. Restart the firewalld service:
34+
+
35+
[source,terminal]
36+
----
37+
$ sudo systemctl restart firewalld.service
38+
----
39+
40+
. To verify that the debug option was added properly, run the following command:
41+
+
42+
[source,terminal]
43+
----
44+
$ sudo systemd-cgls -u firewalld.service
45+
----
46+
+
47+
The firewalld debug log is stored in the `/var/log/firewalld` path.
48+
+
49+
.Example logs for when the port open rule is added:
50+
[source,terminal]
51+
----
52+
2023-06-28 10:46:37 DEBUG1: config.getZoneByName('public')
53+
2023-06-28 10:46:37 DEBUG1: config.zone.7.addPort('8080', 'tcp')
54+
2023-06-28 10:46:37 DEBUG1: config.zone.7.getSettings()
55+
2023-06-28 10:46:37 DEBUG1: config.zone.7.update('...')
56+
2023-06-28 10:46:37 DEBUG1: config.zone.7.Updated('public')
57+
----
58+
+
59+
.Example logs for when the port open rule is removed:
60+
[source,terminal]
61+
----
62+
2023-06-28 10:47:57 DEBUG1: config.getZoneByName('public')
63+
2023-06-28 10:47:57 DEBUG2: config.zone.7.Introspect()
64+
2023-06-28 10:47:57 DEBUG1: config.zone.7.removePort('8080', 'tcp')
65+
2023-06-28 10:47:57 DEBUG1: config.zone.7.getSettings()
66+
2023-06-28 10:47:57 DEBUG1: config.zone.7.update('...')
67+
2023-06-28 10:47:57 DEBUG1: config.zone.7.Updated('public')
68+
----

‎modules/microshift-exposed-audit-ports-hostport.adoc

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * microshift_networking/microshift-networking-settings.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="microshift-exposed-audit-ports-hostport_{context}"]
7+
== hostPort
8+
9+
You can access the hostPort setting logs in {microshift-short}. The following logs are examples for the hostPort setting:
10+
11+
.Procedure
12+
13+
* You can access the logs by running the following command:
14+
+
15+
[source,terminal]
16+
----
17+
$ journalctl -u crio | grep "local port"
18+
----
19+
+
20+
.Example CRI-O logs when the host port is opened:
21+
[source,terminal]
22+
----
23+
$ Jun 25 16:27:37 rhel92 crio[77216]: time="2023-06-25 16:27:37.033003098+08:00" level=info msg="Opened local port tcp:443"
24+
----
25+
+
26+
.Example CRI-O logs when the host port is closed:
27+
[source,terminal]
28+
----
29+
$ Jun 25 16:24:11 rhel92 crio[77216]: time="2023-06-25 16:24:11.342088450+08:00" level=info msg="Closing host port tcp:443"
30+
----

‎modules/microshift-exposed-audit-ports-loadbalancer.adoc

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * microshift_networking/microshift-networking-settings.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="microshift-exposed-audit-ports-loadbalancer_{context}"]
7+
8+
== NodePort and LoadBalancer service
9+
10+
OVN-Kubernetes opens host ports for `NodePort` and `LoadBalancer` service types. These services add iptables rules that take the ingress traffic from the host port and forwards it to the clusterIP. Logs for the `NodePort` and `LoadBalancer` services are presented in the following examples:
11+
12+
.Procedure
13+
14+
. To access the name of your `ovnkube-master` pods, run the following command:
15+
+
16+
[source,terminal]
17+
----
18+
$ oc get pods -n openshift-ovn-kubernetes | awk '/ovnkube-master/{print $1}'
19+
----
20+
+
21+
.Example `ovnkube-master` pod name
22+
[source,terminal]
23+
----
24+
ovnkube-master-n2shv
25+
----
26+
27+
. You can access the `NodePort` and `LoadBalancer` services logs using your `ovnkube-master` pod and running the following example command:
28+
+
29+
[source,terminal]
30+
----
31+
$ oc logs -n openshift-ovn-kubernetes <ovnkube-master-pod-name> ovnkube-master | grep -E "OVN-KUBE-NODEPORT|OVN-KUBE-EXTERNALIP"
32+
----
33+
+
34+
--
35+
*NodePort service:*
36+
37+
.Example logs in the ovnkube-master container of the ovnkube-master pod when a host port is open:
38+
[source,terminal]
39+
----
40+
$ I0625 09:07:00.992980 2118395 iptables.go:27] Adding rule in table: nat, chain: OVN-KUBE-NODEPORT with args: "-p TCP -m addrtype --dst-type LOCAL --dport 32718 -j DNAT --to-destination 10.96.178.142:8081" for protocol: 0
41+
----
42+
43+
.Example logs in the ovnkube-master container of the ovnkube-master pod when a host port is closed:
44+
[source,terminal]
45+
----
46+
$ Deleting rule in table: nat, chain: OVN-KUBE-NODEPORT with args: "-p TCP -m addrtype --dst-type LOCAL --dport 32718 -j DNAT --to-destination 10.96.178.142:8081" for protocol: 0
47+
----
48+
49+
*LoadBalancer service:*
50+
51+
.Example logs in the ovnkube-master container of the ovnkube-master pod when a host port is open:
52+
[source,terminal]
53+
----
54+
$ I0625 09:34:10.406067 128902 iptables.go:27] Adding rule in table: nat, chain: OVN-KUBE-EXTERNALIP with args: "-p TCP -d 172.16.47.129 --dport 8081 -j DNAT --to-destination 10.43.114.94:8081" for protocol: 0
55+
----
56+
57+
.Example logs in the ovnkube-master container of the ovnkube-master pod when a host port is closed:
58+
[source,terminal]
59+
----
60+
$ I0625 09:37:00.976953 128902 iptables.go:63] Deleting rule in table: nat, chain: OVN-KUBE-EXTERNALIP with args: "-p TCP -d 172.16.47.129 --dport 8081 -j DNAT --to-destination 10.43.114.94:8081" for protocol: 0
61+
----
62+
--

‎modules/microshift-exposed-audit-ports.adoc

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * microshift_networking/microshift-networking-settings.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id="microshift-exposed-audit-ports_{context}"]
7+
= Auditing exposed network ports
8+
9+
On {microshift-short}, the host port can be opened by a workload in the following cases. You can check logs to view the network services.

0 commit comments

Comments
 (0)