{"action":"created","issue":{"url":"https://api.github.com/repos/openshift/openshift-ansible/issues/1837","repository_url":"https://api.github.com/repos/openshift/openshift-ansible","labels_url":"https://api.github.com/repos/openshift/openshift-ansible/issues/1837/labels{/name}","comments_url":"https://api.github.com/repos/openshift/openshift-ansible/issues/1837/comments","events_url":"https://api.github.com/repos/openshift/openshift-ansible/issues/1837/events","html_url":"https://github.com/openshift/openshift-ansible/issues/1837","id":151712945,"number":1837,"title":"iptables proxier not writing iptables rules","user":{"login":"metmajer","id":873565,"avatar_url":"https://avatars.githubusercontent.com/u/873565?v=3","gravatar_id":"","url":"https://api.github.com/users/metmajer","html_url":"https://github.com/metmajer","followers_url":"https://api.github.com/users/metmajer/followers","following_url":"https://api.github.com/users/metmajer/following{/other_user}","gists_url":"https://api.github.com/users/metmajer/gists{/gist_id}","starred_url":"https://api.github.com/users/metmajer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/metmajer/subscriptions","organizations_url":"https://api.github.com/users/metmajer/orgs","repos_url":"https://api.github.com/users/metmajer/repos","events_url":"https://api.github.com/users/metmajer/events{/privacy}","received_events_url":"https://api.github.com/users/metmajer/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":8,"created_at":"2016-04-28T18:35:16Z","updated_at":"2016-04-29T13:01:59Z","closed_at":null,"body":"I have recently deployed an OpenShift Origin cluster on AWS, however, I simply can't get my services to communicate with each others:\r\n\r\n- I keep getting `UnknownHost` exceptions from my Java backend application\r\n- `ping` and `telnet` give me `bad address`\r\n\r\nA conversation in #openshift-dev on IRC with @deads2k revealed that the `proxier` component is prevented from making entries to `iptables`. In fact, after deploying the applications, `journalctl | grep proxier` shows:\r\n\r\n```\r\norigin-node[22943]:... proxier.go:421] Adding new service \"easytravel/easytravel-mongodb:27017-tcp\" at 172.30.108.189:27017/TCP\r\norigin-node[22943]:... proxier.go:421] Adding new service \"easytravel/easytravel-mongodb:28017-tcp\" at 172.30.108.189:28017/TCP\r\norigin-node[22943]:... proxier.go:421] Adding new service \"easytravel/easytravel-backend:8080-tcp\" at 172.30.186.73:8080/TCP\r\norigin-node[22943]:... proxier.go:484] Setting endpoints for \"easytravel/easytravel-mongodb:28017-tcp\" to [10.1.2.2:28017]\r\norigin-node[22943]:... proxier.go:484] Setting endpoints for \"easytravel/easytravel-mongodb:27017-tcp\" to [10.1.2.2:27017]\r\norigin-node[22943]:... proxier.go:484] Setting endpoints for \"easytravel/easytravel-backend:8080-tcp\" to [10.1.0.3:8080]\r\n```\r\n\r\nIssuing a `sudo iptables -L` on the node that runs the `easytravel-backend` Docker container shows the following entries:\r\n\r\n```\r\nChain OUTPUT (policy ACCEPT)\r\ntarget     prot opt source               destination\r\nKUBE-SERVICES  all  --  anywhere             anywhere             /* kubernetes service portals */\r\n```\r\n\r\nHowever, `KUBE_SERVICES` is empty (where it is supposed to contain an entry to the `easytravel-mongodb` service):\r\n\r\n```\r\nChain KUBE-SERVICES (1 references)\r\ntarget     prot opt source               destination\r\n```\r\n\r\nHere's a link to a complete `journalctl` dump from the origin node: [origin-node-journalctl.log](https://dl.dropboxusercontent.com/u/14609545/origin-node-journalctl.log). Beware, it's huge."},"comment":{"url":"https://api.github.com/repos/openshift/openshift-ansible/issues/comments/215705139","html_url":"https://github.com/openshift/openshift-ansible/issues/1837#issuecomment-215705139","issue_url":"https://api.github.com/repos/openshift/openshift-ansible/issues/1837","id":215705139,"user":{"login":"metmajer","id":873565,"avatar_url":"https://avatars.githubusercontent.com/u/873565?v=3","gravatar_id":"","url":"https://api.github.com/users/metmajer","html_url":"https://github.com/metmajer","followers_url":"https://api.github.com/users/metmajer/followers","following_url":"https://api.github.com/users/metmajer/following{/other_user}","gists_url":"https://api.github.com/users/metmajer/gists{/gist_id}","starred_url":"https://api.github.com/users/metmajer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/metmajer/subscriptions","organizations_url":"https://api.github.com/users/metmajer/orgs","repos_url":"https://api.github.com/users/metmajer/repos","events_url":"https://api.github.com/users/metmajer/events{/privacy}","received_events_url":"https://api.github.com/users/metmajer/received_events","type":"User","site_admin":false},"created_at":"2016-04-29T13:01:58Z","updated_at":"2016-04-29T13:01:58Z","body":"@rhcarvalho I know. The Dockerfile you've linked to before is not the one I have used for the OpenShift deployments. Here's what it looks like:\r\n\r\n```\r\nFROM alpine:edge\r\n\r\nMAINTAINER ...\r\n\r\nENV MONGODB_DB /data/db/easyTravel/\r\nENV MONGODB_USER mongodb\r\n\r\nRUN echo http://dl-4.alpinelinux.org/alpine/edge/testing >> /etc/apk/repositories && \\\r\n    apk add --no-cache mongodb && \\\r\n    chown ${MONGODB_USER}:${MONGODB_USER} /usr/bin/mongo*\r\n\r\n# Deploy easyTravel database\r\nADD build/easyTravel-mongodb-db.tar.gz ${MONGODB_DB}\r\nRUN chown -R ${MONGODB_USER}:${MONGODB_USER} ${MONGODB_DB}\r\n\r\nVOLUME ${MONGODB_DB}\r\n\r\nEXPOSE 27017 28017\r\n\r\nUSER ${MONGODB_USER}\r\n\r\nCMD mongod --auth --rest --httpinterface --smallfiles --dbpath ${MONGODB_DB}\r\n```\r\n\r\nAs you see, I directly derived from `alpine:edge`. Any limitations known?\r\n\r\nWhat about the missing entries in `iptables`. If they are set up correctly, then the failure might not be located inside the container."}}