{"action":"created","issue":{"url":"https://api.github.com/repos/openshift/origin/issues/14636","repository_url":"https://api.github.com/repos/openshift/origin","labels_url":"https://api.github.com/repos/openshift/origin/issues/14636/labels{/name}","comments_url":"https://api.github.com/repos/openshift/origin/issues/14636/comments","events_url":"https://api.github.com/repos/openshift/origin/issues/14636/events","html_url":"https://github.com/openshift/origin/issues/14636","id":235865633,"number":14636,"title":"Source IP preservation HealthCheck NodePort allocation does not get firewall entry","user":{"login":"kincl","id":376118,"avatar_url":"https://avatars2.githubusercontent.com/u/376118?v=4","gravatar_id":"","url":"https://api.github.com/users/kincl","html_url":"https://github.com/kincl","followers_url":"https://api.github.com/users/kincl/followers","following_url":"https://api.github.com/users/kincl/following{/other_user}","gists_url":"https://api.github.com/users/kincl/gists{/gist_id}","starred_url":"https://api.github.com/users/kincl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kincl/subscriptions","organizations_url":"https://api.github.com/users/kincl/orgs","repos_url":"https://api.github.com/users/kincl/repos","events_url":"https://api.github.com/users/kincl/events{/privacy}","received_events_url":"https://api.github.com/users/kincl/received_events","type":"User","site_admin":false},"labels":[{"id":210157112,"url":"https://api.github.com/repos/openshift/origin/labels/component/kubernetes","name":"component/kubernetes","color":"0052cc","default":false},{"id":210156114,"url":"https://api.github.com/repos/openshift/origin/labels/component/networking","name":"component/networking","color":"0052cc","default":false},{"id":118251699,"url":"https://api.github.com/repos/openshift/origin/labels/kind/bug","name":"kind/bug","color":"e11d21","default":false},{"id":826745876,"url":"https://api.github.com/repos/openshift/origin/labels/lifecycle/stale","name":"lifecycle/stale","color":"795548","default":false},{"id":210151912,"url":"https://api.github.com/repos/openshift/origin/labels/priority/P2","name":"priority/P2","color":"fbca04","default":false}],"state":"open","locked":false,"assignee":{"login":"knobunc","id":10033853,"avatar_url":"https://avatars1.githubusercontent.com/u/10033853?v=4","gravatar_id":"","url":"https://api.github.com/users/knobunc","html_url":"https://github.com/knobunc","followers_url":"https://api.github.com/users/knobunc/followers","following_url":"https://api.github.com/users/knobunc/following{/other_user}","gists_url":"https://api.github.com/users/knobunc/gists{/gist_id}","starred_url":"https://api.github.com/users/knobunc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/knobunc/subscriptions","organizations_url":"https://api.github.com/users/knobunc/orgs","repos_url":"https://api.github.com/users/knobunc/repos","events_url":"https://api.github.com/users/knobunc/events{/privacy}","received_events_url":"https://api.github.com/users/knobunc/received_events","type":"User","site_admin":false},"assignees":[{"login":"knobunc","id":10033853,"avatar_url":"https://avatars1.githubusercontent.com/u/10033853?v=4","gravatar_id":"","url":"https://api.github.com/users/knobunc","html_url":"https://github.com/knobunc","followers_url":"https://api.github.com/users/knobunc/followers","following_url":"https://api.github.com/users/knobunc/following{/other_user}","gists_url":"https://api.github.com/users/knobunc/gists{/gist_id}","starred_url":"https://api.github.com/users/knobunc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/knobunc/subscriptions","organizations_url":"https://api.github.com/users/knobunc/orgs","repos_url":"https://api.github.com/users/knobunc/repos","events_url":"https://api.github.com/users/knobunc/events{/privacy}","received_events_url":"https://api.github.com/users/knobunc/received_events","type":"User","site_admin":false}],"milestone":null,"comments":3,"created_at":"2017-06-14T12:40:53Z","updated_at":"2018-02-22T16:36:50Z","closed_at":null,"author_association":"NONE","body":"Kube 1.5 introduced beta support for preservation of source IP with LoadBalancer services which is enabled with an annotation on the service. The NodePort that is allocated for the health checks does not get a firewall entry on my OpenShift nodes but it works from localhost.\r\n\r\n##### Further Reading\r\nhttps://github.com/kubernetes/community/blob/master/contributors/design-proposals/external-lb-source-ip-preservation.md\r\nhttps://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#annotation-to-modify-the-loadbalancer-behavior-for-preservation-of-source-ip\r\n\r\n##### Version\r\n```\r\noc v1.5.0\r\nkubernetes v1.5.2+43a9be4\r\nfeatures: Basic-Auth GSSAPI Kerberos SPNEGO\r\n```\r\n\r\n##### Steps To Reproduce\r\n1. Create a service of type LoadBalancer with annotation for external-traffic\r\n```\r\n    {\r\n      \"kind\": \"Service\",\r\n      \"apiVersion\": \"v1\",\r\n      \"metadata\": {\r\n        \"name\": \"example-service\",\r\n        \"annotations\": {\r\n            \"service.beta.kubernetes.io/external-traffic\": \"OnlyLocal\"\r\n        }\r\n      },\r\n      \"spec\": {\r\n        \"ports\": [{\r\n          \"port\": 8765,\r\n          \"targetPort\": 9376\r\n        }],\r\n        \"selector\": {\r\n          \"app\": \"example\"\r\n        },\r\n        \"type\": \"LoadBalancer\"\r\n      }\r\n    }\r\n```\r\n2. Get the service object\r\n```\r\n$ oc get svc example-service -o yaml\r\napiVersion: v1\r\nkind: Service\r\nmetadata:\r\n  annotations:\r\n    service.beta.kubernetes.io/external-traffic: OnlyLocal\r\n    service.beta.kubernetes.io/healthcheck-nodeport: \"31155\"\r\n....\r\n```\r\n3. Attempt to connect the healthcheck nodeport from any node in the cluster to any other node in the cluster\r\n```\r\n$ curl node1:31155\r\ncurl: (7) Failed connect to node1:31155; No route to host\r\n```\r\n4. Connect to localhost:31155 on node in cluster\r\n```\r\n$ curl localhost:31155\r\n1 Service Endpoints found\r\n```\r\n\r\n##### Current Result\r\nConnection is refused because there is no iptables rule for the healthcheck nodeport\r\n\r\n##### Expected Result\r\nWhat should happen is the curl to another node in the cluster should succeed and return the number of service endpoints found\r\n"},"comment":{"url":"https://api.github.com/repos/openshift/origin/issues/comments/367740227","html_url":"https://github.com/openshift/origin/issues/14636#issuecomment-367740227","issue_url":"https://api.github.com/repos/openshift/origin/issues/14636","id":367740227,"user":{"login":"kincl","id":376118,"avatar_url":"https://avatars2.githubusercontent.com/u/376118?v=4","gravatar_id":"","url":"https://api.github.com/users/kincl","html_url":"https://github.com/kincl","followers_url":"https://api.github.com/users/kincl/followers","following_url":"https://api.github.com/users/kincl/following{/other_user}","gists_url":"https://api.github.com/users/kincl/gists{/gist_id}","starred_url":"https://api.github.com/users/kincl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kincl/subscriptions","organizations_url":"https://api.github.com/users/kincl/orgs","repos_url":"https://api.github.com/users/kincl/repos","events_url":"https://api.github.com/users/kincl/events{/privacy}","received_events_url":"https://api.github.com/users/kincl/received_events","type":"User","site_admin":false},"created_at":"2018-02-22T16:36:50Z","updated_at":"2018-02-22T16:36:50Z","author_association":"NONE","body":"This is still an issue in 3.7"}}
{"actor":{"display_login":"kincl"}}