DNM: Add openflow to drop traffic for nodePort service #2766
Conversation
|
/hold |
openshift-ci
bot
added
the
do-not-merge/hold
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: pliurh The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
pliurh
force-pushed
the
ocp
branch
3 times, most recently
from
6d68c87 to
2adfb7d
Compare
|
/retest-required |
1 similar comment
|
/retest-required |
|
/payload-job periodic-ci-openshift-release-master-ci-4.21-upgrade-from-stable-4.20-e2e-azure-ovn-upgrade |
|
@weliang1: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/21cb5b80-a9dc-11f0-99dd-85c13ec3b954-0 |
|
/payload-job periodic-ci-openshift-release-master-ci-4.21-upgrade-from-stable-4.20-e2e-azure-ovn-upgrade |
|
@weliang1: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/1c06a730-a9dd-11f0-9158-5b3ebbd1ad2b-0 |
|
/test pull-ci-openshift-ovn-kubernetes-master-e2e-azure-ovn-upgrade |
|
@weliang1: The specified target(s) for The following commands are available to trigger optional jobs: Use In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/test e2e-aws-ovn-fdp-qe |
|
/verified later @weliang |
openshift-ci-robot
added
verified-later
verified
|
@weliang1: This PR has been marked to be verified later by In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/retest-required |
This commit introduces new OpenFlow rules to correctly handle NodePort
service traffic in a shared gateway configuration.
The new rules address two scenarios:
1. A rule with priority 109 is added to drop traffic originating from
OVN towards a NodePort. This prevents ingress traffic from being
incorrectly forwarded to the host during OVN logical router
resynchronizations.
2. A higher-priority rule (110) is added to allow traffic from the
local host or pods destined for a NodePort service to egress to the
physical network. This ensures that local clients can access
services via their NodePort.
|
@pliurh: The following tests failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
3 participants
📑 Description
Fixes #
Additional Information for reviewers
✅ Checks
How to verify it