Uploaded image for project: 'Maistra'
  1. Maistra
  2. MAISTRA-2411

Additional Ingress Gateway doesn't create NetworkPolicy to allow ingress traffic for new gateway pod

    XMLWordPrintable

Details

    • Bug
    • Resolution: Done
    • Major
    • maistra-2.0.7
    • maistra-2.0.5.1
    • openshift, operator
    • None
    • Sprint 8

    Description

      When a new Ingress Gateway is created using spec.gateways.additionaIngress in SMCP, operator is not creating needed NetworkPolicy for the new Ingress Gateway like it does for the default istio-ingressgateway. This causes 503 from the route of the new gateway and it was very difficult to pinpoint the issue as documentation for `additionaIngress` is hard to find.

      SMCP change:

      spec:
....
  gateways:
    additionalIngress:
      istio-internal-ingressgateway:
        enabled: true
        service:
          metadata:
            labels:
              app: istio-internal-ingressgateway
              istio: internal-ingressgateway
          type: ClusterIP

      oc -n istio-system get svc -l app=istio-internal-ingressgateway,istio=internal-ingressgateway

NAME                            TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)                              AGE
istio-internal-ingressgateway   ClusterIP   172.21.176.240   <none>        15021/TCP,80/TCP,443/TCP,15443/TCP   15h

oc -n istio-system get po -l app=istio-internal-ingressgateway,istio=internal-ingressgateway
NAME                                            READY   STATUS    RESTARTS   AGE
istio-internal-ingressgateway-c849c648d-2wz5h   1/1     Running   0          15h

oc -n istio-system get route -l istio-internal-ingressgateway,istio=internal-ingressgateway
NAME                            HOST/PORT                                                                       PATH   SERVICES                        PORT   TERMINATION   WILDCARD
istio-internal-ingressgateway   istio-internal-ingressgateway-istio-system.xxx.upi.containers.appdomain.cloud          istio-internal-ingressgateway   8080                 None

      oc -n istio-system get networkpolicy -o custom-columns=NAME:.metadata.name,POD-SELECTOR:.spec.podSelector.matchLabels

NAME                          POD-SELECTOR
istio-expose-route-basic      map[maistra.io/expose-route:true]
istio-grafana-ingress         map[app:grafana]
istio-ingressgateway          map[istio:ingressgateway]
istio-istiod-basic            map[app:istiod istio.io/rev:basic]
istio-jaeger-ingress          map[app.kubernetes.io/instance:jaeger app.kubernetes.io/managed-by:jaeger-operator app.kubernetes.io/part-of:jaeger]
istio-kiali-ingress           map[app:kiali]
istio-mesh-basic              <none>
istio-prometheus-ingress      map[app:prometheus]

      Expected Result:
      A new NetworkPolicy is created for new Ingress gateway

      Work Around:
      Create NetworkPolicy manually in istio-system namespace

      apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: istio-internal-ingressgateway
  namespace: istio-system
spec:
  ingress:
  - {}
  podSelector:
    matchLabels:
      istio: internal-ingressgateway
  policyTypes:
  - Ingress

      Attachments

        Issue Links

          is cloned by

          Bug - A problem that impairs or prevents the functions of the product. MAISTRA-2578 Additional Ingress Gateway doesn't create NetworkPolicy to allow ingress traffic for new gateway pod

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Closed
          is documented by

          Task - Represents a small unit of work that is not end-user facing. OSSM-2938 Release notes for OSSM 1.1.17/2.0.7 zstream release

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Closed
          links to

          GitHub openshift/openshift-docs#45652: OSSMDOC-467: Service Mesh 2.2 release notes

          Activity

            People

              jeesmon Jeesmon Jacob (Inactive)
              jeesmon Jeesmon Jacob (Inactive)
              Votes:
              1 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: