fix(firewall): open node to master ICMP security group #15339

maximumG · 2023-04-20T08:34:17Z

Cilium health check mechanism requires ICMP and TCP/4240 port to be opened between every nodes in the cluster, including control plane nodes. If one of these 2 checks fails the node is considered as unreachable.

We only open ICMP echo request (type 8) from node to master.

linux-foundation-easycla · 2023-04-20T08:34:23Z

The committers listed above are authorized under a signed CLA.

✅ login: maximumG / name: Maxime Gerges (7f5b0dd)

k8s-ci-robot · 2023-04-20T08:34:27Z

Welcome @maximumG!

It looks like this is your first PR to kubernetes/kops 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes/kops has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

k8s-ci-robot · 2023-04-20T08:34:28Z

Hi @maximumG. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Cilium health check mechanism requires ICMP and TCP/4240 port to be opened between every node in the cluster including control plane nodes. If one of these 2 checks fails the node is considered as unreachable.

olemarkus · 2023-04-27T13:51:03Z

Thanks. I think I am somewhat convinced it is practical to allow this traffic.

/ok-to-test

pkg/model/awsmodel/firewall.go

olemarkus · 2023-04-28T10:36:28Z

You probably need to run ./hack/update-expected.sh to fix the tests.

maximumG · 2023-05-02T19:36:38Z

tests/integration/update_cluster/minimal-ipv6-calico/kubernetes.tf

weird to see a change in here, especially regading the protocol parameter, switching from a valid value 4 to -1 🤔 . Any idea why this may happened @olemarkus

maximumG · 2023-05-02T19:36:58Z

tests/integration/update_cluster/privatecalico/kubernetes.tf

  from_port                = 0
-  protocol                 = "4"
-  security_group_id        = aws_security_group.masters-privatecalico-example-com.id
+  protocol                 = "-1"


weird to see a change in here, especially regading the protocol parameter, switching from a valid value 4 to -1 🤔 . Any idea why this may happened @olemarkus

It's an artifact of the diff. Changing "4" to "ipip" caused that rule to sort after the "all-0to0-nodes" rule.

maximumG

some calico related test are failing because the integration tests were modified and the ipip protocol switch from value 4 to -1.

olemarkus · 2023-05-07T10:32:02Z

/retest

maximumG · 2023-07-07T13:59:21Z

@olemarkus is there any way I can help to finalize this PR ?

johngmyers · 2023-07-08T02:22:58Z

tests/integration/update_cluster/minimal-ipv6-cilium/kubernetes.tf

@@ -1029,6 +1029,15 @@ resource "aws_security_group_rule" "from-nodes-minimal-ipv6-example-com-ingress-
  type                     = "ingress"
 }

+resource "aws_security_group_rule" "from-nodes-minimal-ipv6-example-com-ingress-icmp-8to8-masters-minimal-ipv6-example-com" {
+  from_port                = 8


ICMPv6 echo is not type 8.

k8s-ci-robot · 2023-07-08T02:23:10Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from olemarkus. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

johngmyers · 2023-07-08T02:39:58Z

pkg/model/awsmodel/firewall.go

 				switch protocol {
 				case ProtocolIPIP:
-					name = "ipip"
+					awsName = "ipip"


ipip is not a valid value for the IpProtocol field of an IpPermission.

// The IP protocol name (tcp, udp, icmp, icmpv6) or number (see Protocol Numbers
// (http://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml)).

johngmyers · 2023-07-08T02:42:06Z

Please test your change works on an IPv6 cluster.

k8s-ci-robot · 2023-10-20T21:10:55Z

@maximumG: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-kops-e2e-k8s-aws-calico	`b35b7a9`	link	true	`/test pull-kops-e2e-k8s-aws-calico`
pull-kops-kubernetes-e2e-ubuntu-gce-build	`b35b7a9`	link	true	`/test pull-kops-kubernetes-e2e-ubuntu-gce-build`

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

bkmzio · 2024-02-06T14:20:33Z

@maximumG, may I inquire if there's a chance to consolidate or merge the changes? Your input would be greatly appreciated!

k8s-triage-robot · 2024-05-06T14:42:27Z

The Kubernetes project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

Mark this PR as fresh with /remove-lifecycle stale
Close this PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-ci-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Apr 20, 2023

k8s-ci-robot added the cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. label Apr 20, 2023

k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Apr 20, 2023

k8s-ci-robot requested review from hakman and johngmyers April 20, 2023 08:34

k8s-ci-robot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. area/provider/aws Issues or PRs related to aws provider labels Apr 20, 2023

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels Apr 20, 2023

fix(firewall): open node to master ICMP security group

6853955

Cilium health check mechanism requires ICMP and TCP/4240 port to be opened between every node in the cluster including control plane nodes. If one of these 2 checks fails the node is considered as unreachable.

maximumG force-pushed the fix-cilium-control-plane-unreachable branch from 7f5b0dd to 6853955 Compare April 26, 2023 09:01

k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Apr 26, 2023

maximumG marked this pull request as ready for review April 26, 2023 09:04

k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Apr 26, 2023

k8s-ci-robot requested a review from olemarkus April 26, 2023 09:04

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Apr 27, 2023

olemarkus requested changes Apr 27, 2023

View reviewed changes

pkg/model/awsmodel/firewall.go Outdated Show resolved Hide resolved

k8s-ci-robot assigned olemarkus Apr 27, 2023

maximumG added 2 commits April 27, 2023 21:04

fix(firewall): use golang ICMP type instead of raw integer

0d85f4f

fix: linter warning ineffectual assignment

4e38127

maximumG requested a review from olemarkus April 28, 2023 06:52

fix(test): introduced new security group rules

b35b7a9

k8s-ci-robot removed the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label May 2, 2023

k8s-ci-robot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label May 2, 2023

maximumG commented May 2, 2023

View reviewed changes

johngmyers requested changes Jul 8, 2023

View reviewed changes

k8s-ci-robot assigned johngmyers Jul 8, 2023

johngmyers reviewed Jul 8, 2023

View reviewed changes

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label May 6, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(firewall): open node to master ICMP security group #15339

fix(firewall): open node to master ICMP security group #15339

maximumG commented Apr 20, 2023 •

edited

linux-foundation-easycla bot commented Apr 20, 2023 •

edited

k8s-ci-robot commented Apr 20, 2023

k8s-ci-robot commented Apr 20, 2023

olemarkus commented Apr 27, 2023

olemarkus commented Apr 28, 2023

maximumG May 2, 2023

maximumG May 2, 2023

johngmyers Jul 8, 2023

maximumG left a comment

olemarkus commented May 7, 2023

maximumG commented Jul 7, 2023

johngmyers Jul 8, 2023

k8s-ci-robot commented Jul 8, 2023

johngmyers Jul 8, 2023

johngmyers commented Jul 8, 2023

k8s-ci-robot commented Oct 20, 2023

bkmzio commented Feb 6, 2024

k8s-triage-robot commented May 6, 2024

fix(firewall): open node to master ICMP security group #15339

Are you sure you want to change the base?

fix(firewall): open node to master ICMP security group #15339

Conversation

maximumG commented Apr 20, 2023 • edited

linux-foundation-easycla bot commented Apr 20, 2023 • edited

k8s-ci-robot commented Apr 20, 2023

k8s-ci-robot commented Apr 20, 2023

olemarkus commented Apr 27, 2023

olemarkus commented Apr 28, 2023

maximumG May 2, 2023

Choose a reason for hiding this comment

maximumG May 2, 2023

Choose a reason for hiding this comment

johngmyers Jul 8, 2023

Choose a reason for hiding this comment

maximumG left a comment

Choose a reason for hiding this comment

olemarkus commented May 7, 2023

maximumG commented Jul 7, 2023

johngmyers Jul 8, 2023

Choose a reason for hiding this comment

k8s-ci-robot commented Jul 8, 2023

johngmyers Jul 8, 2023

Choose a reason for hiding this comment

johngmyers commented Jul 8, 2023

k8s-ci-robot commented Oct 20, 2023

bkmzio commented Feb 6, 2024

k8s-triage-robot commented May 6, 2024

maximumG commented Apr 20, 2023 •

edited

linux-foundation-easycla bot commented Apr 20, 2023 •

edited