Fix/secondary nic filter#144
Conversation
gardener-prow
Bot
added
the
do-not-merge/needs-kind
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
|
gardener-prow
Bot
added
size/L
|
/kind bugfix |
|
@anluerz: The label(s) DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/kind bug |
gardener-prow
Bot
added
kind/bug
BuildClusterConfig previously collected every InternalIP entry from node.status.addresses. On nodes with a secondary NIC, such as an additional ENI in a different subnet, agents would probe the secondary IP on the nwpd port. If that port isn't reachable through the secondary NIC's security group / firewall rules, the probes fail and nwpd reports false-positive TCP connectivity failures even though the node itself is healthy. Filter the InternalIPs against the shoot's node network CIDRs so only addresses from the actual node network are used as probe targets. The CIDRs are read from the shoot-info ConfigMap's `nodeNetworks` key, which carries both the IPv4 and (for dual-stack shoots) IPv6 node network. Note: This depends on the provider extension reporting an accurate node CIDR in shoot-info; for IPv6, the AWS extension currently reports the whole VPC /56, which limits the effectiveness of the filter for IPv6 until fixed there.
anluerz
force-pushed
the
fix/secondary-nic-filter
branch
from
238e946 to
f966abe
Compare
2 participants
What this PR does / why we need it:
On nodes with a secondary NIC, such as an
additional ENI in a different subnet, agents would probe the secondary
IP on the nwpd port. If that port isn't reachable through the secondary
NIC's security group / firewall rules, the probes fail and nwpd reports
false-positive TCP connectivity failures even though the node itself is
healthy.
Which issue(s) this PR fixes:
Fixes #
Special notes for your reviewer:
Release note: