{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes-sigs/cri-o/issues/1804","repository_url":"https://api.github.com/repos/kubernetes-sigs/cri-o","labels_url":"https://api.github.com/repos/kubernetes-sigs/cri-o/issues/1804/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes-sigs/cri-o/issues/1804/comments","events_url":"https://api.github.com/repos/kubernetes-sigs/cri-o/issues/1804/events","html_url":"https://github.com/kubernetes-sigs/cri-o/issues/1804","id":361828304,"node_id":"MDU6SXNzdWUzNjE4MjgzMDQ=","number":1804,"title":"cri-o needs cni workaround","user":{"login":"mike-nguyen","id":18013877,"node_id":"MDQ6VXNlcjE4MDEzODc3","avatar_url":"https://avatars1.githubusercontent.com/u/18013877?v=4","gravatar_id":"","url":"https://api.github.com/users/mike-nguyen","html_url":"https://github.com/mike-nguyen","followers_url":"https://api.github.com/users/mike-nguyen/followers","following_url":"https://api.github.com/users/mike-nguyen/following{/other_user}","gists_url":"https://api.github.com/users/mike-nguyen/gists{/gist_id}","starred_url":"https://api.github.com/users/mike-nguyen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mike-nguyen/subscriptions","organizations_url":"https://api.github.com/users/mike-nguyen/orgs","repos_url":"https://api.github.com/users/mike-nguyen/repos","events_url":"https://api.github.com/users/mike-nguyen/events{/privacy}","received_events_url":"https://api.github.com/users/mike-nguyen/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":11,"created_at":"2018-09-19T16:26:37Z","updated_at":"2018-11-01T15:12:11Z","closed_at":null,"author_association":"NONE","body":"<!--\r\nIf you are reporting a new issue, make sure that we do not have any duplicates\r\nalready open. You can ensure this by searching the issue list for this\r\nrepository. If there is a duplicate, please close your issue and add a comment\r\nto the existing issue instead.\r\n\r\nIf you suspect your issue is a bug, please edit your issue description to\r\ninclude the BUG REPORT INFORMATION shown below. If you fail to provide this\r\ninformation within 7 days, we cannot debug your issue and will close it. We\r\nwill, however, reopen it if you later provide the information.\r\n\r\nFor more information about reporting issues, see\r\nhttps://github.com/kubernetes-sigs/cri-o/blob/master/CONTRIBUTING.md#reporting-issues\r\n\r\n---------------------------------------------------\r\nGENERAL SUPPORT INFORMATION\r\n---------------------------------------------------\r\n\r\nThe GitHub issue tracker is for bug reports and feature requests.\r\nGeneral support for **CRI-O** can be found at the following locations:\r\n\r\n- IRC - #cri-o channel on irc.freenode.org\r\n- Slack - kubernetes.slack.com #sig-node channel\r\n- Post a question on StackOverflow, using the CRI-O tag\r\n\r\n---------------------------------------------------\r\nBUG REPORT INFORMATION\r\n---------------------------------------------------\r\nUse the commands below to provide key information from your environment:\r\nYou do NOT have to include this information if this is a FEATURE REQUEST\r\n-->\r\n\r\n**Description**\r\nPort forwarding from the container to the host doesn't seem to be working.  I need to run with `hostNetwork: true` to workaround it.\r\n\r\nI am using kubelet to deploy a static nginx pod with containerPort:80 and hostPort:80.  When kubelet is using docker, I can `curl http://localhost:80` and I get the nginx default page.  When I switch kubelet to run with crio, I can see the container running but `curl http://localhost:80` does not respond.  This is a similar issue I was seeing with exposing ports using podman.\r\n\r\ncri-o might need a version of https://github.com/containers/libpod/pull/1431\r\nmheon mentioned:\r\n> You can probably vendor libpod's pkg/firewall and then modify your netns setup code to run it though you might need to store more information than you do right now, libpod already stores the whole CNI response CRI-O does not\r\n\r\n\r\n**Steps to reproduce the issue:**\r\n1. \r\n ```\r\ncat << EOF > /etc/kubernetes/manifests/static-pod.yaml\r\napiVersion: v1\r\nkind: Pod\r\nmetadata:\r\n  name: static-web\r\n  labels:\r\n    role: myrole\r\nspec:\r\n  containers:\r\n    - name: web\r\n      image: docker.io/nginx\r\n      ports:\r\n        - name: web\r\n          containerPort: 80\r\n          hostPort: 80\r\nEOF\r\n```\r\n2.\r\n```\r\ncat << EOF > /etc/kubernetes/kubeletconfig\r\nkind: KubeletConfiguration\r\napiVersion: kubelet.config.k8s.io/v1beta1\r\nclusterDomain: kube.local\r\nclusterDNS: [10.254.0.10]\r\ncgroupDriver: systemd\r\nstaticPodPath: /etc/kubernetes/manifests/\r\nauthorization:\r\n  mode: AlwaysAllow\r\nauthentication:\r\n  anonymous:\r\n    enabled: true\r\n  webhook:\r\n    enabled: false\r\nEOF\r\n```\r\n3.\r\nstart kubelet\r\n`/usr/bin/hyperkube kubelet --config /etc/kubernetes/kubeletconfig --container-runtime=remote --container-runtime-endpoint=unix:///var/run/crio/crio.sock --runtime-request-timeout=10m`\r\n4\r\n`curl http://localhost:80`\r\n\r\n**Describe the results you received:**\r\nCannot access the nginx container through the exposed host port\r\n\r\n**Describe the results you expected:**\r\nAble to access the nginx container through the exposed host port\r\n\r\n**Additional information you deem important (e.g. issue happens only occasionally):**\r\nAlways happens\r\n\r\n**Output of `crio --version`:**\r\n\r\n```\r\ncrio version 1.11.4\r\ncri-o-1.11.4-2.rhaos3.11.gite0c89d8.el7_5.x86_64\r\n```\r\n**Additional Environment Information**\r\nRHCOS 4.0.5796 in AWS"},"comment":{"url":"https://api.github.com/repos/kubernetes-sigs/cri-o/issues/comments/435072436","html_url":"https://github.com/kubernetes-sigs/cri-o/issues/1804#issuecomment-435072436","issue_url":"https://api.github.com/repos/kubernetes-sigs/cri-o/issues/1804","id":435072436,"node_id":"MDEyOklzc3VlQ29tbWVudDQzNTA3MjQzNg==","user":{"login":"ashcrow","id":22706,"node_id":"MDQ6VXNlcjIyNzA2","avatar_url":"https://avatars3.githubusercontent.com/u/22706?v=4","gravatar_id":"","url":"https://api.github.com/users/ashcrow","html_url":"https://github.com/ashcrow","followers_url":"https://api.github.com/users/ashcrow/followers","following_url":"https://api.github.com/users/ashcrow/following{/other_user}","gists_url":"https://api.github.com/users/ashcrow/gists{/gist_id}","starred_url":"https://api.github.com/users/ashcrow/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ashcrow/subscriptions","organizations_url":"https://api.github.com/users/ashcrow/orgs","repos_url":"https://api.github.com/users/ashcrow/repos","events_url":"https://api.github.com/users/ashcrow/events{/privacy}","received_events_url":"https://api.github.com/users/ashcrow/received_events","type":"User","site_admin":false},"created_at":"2018-11-01T15:12:11Z","updated_at":"2018-11-01T15:12:11Z","author_association":"CONTRIBUTOR","body":"If we can get this looked at soon I'd appreciate it. This work blocks a card @mike-nguyen is trying to close out."}}
{"actor":{"display_login":"ashcrow"}}