Tuesday, 2018-10-30

*** huntxu has joined #openstack-qinling02:11
lxkonghuntxu:  i have question related to `_ensure_network_policy ` method when the k8s orchestrator initializing03:16
lxkongaccording to the method, does that mean the pod cannot be accessed from outside of the k8s cluster?03:16
lxkonghttps://www.irccloud.com/pastebin/jutpUxA5/03:17
lxkongthis is the networkpolicy in my qinling deployment03:18
lxkongseems yes, i delete that policy and now i can access the service inside the pod from outside the cluster03:21
lxkongthat is gonna be a problem03:21
lxkongif qinling and k8s are both deployed separately, qinling-engine can not talk to the runtime pod03:22
huntxulxkong: what do you mean by "deployed separately"? qinling-engine and k8s pods run on different hosts?05:35
huntxulxkong: the runtime pod is exposed via a namespaced service on pod preparation, so it's ok for qinling-engine to access the service in the pod via the k8s namespaced service05:37
huntxulxkong: before that no namespaced service are created, so even the pod is running (not serving for any functions), you cannot access to the service in pod05:39
*** mnaser has quit IRC06:16
*** mnaser has joined #openstack-qinling06:17
lxkonghuntxu: i mean, the disable-interpods-connections network policy will block the external access06:55
lxkongso if qinling-engine and k8s is running on different hosts, qinling-engine can not talk to any service exposed by the runtime pods.06:56
lxkongi've already encountered such issue06:56
lxkongi have deployed qinling(without k8s) on vm1, and i have a separate k8s cluster running on vm206:56
lxkongafter successfully confiugred that connection between them(qinling-engine is running well)06:57
lxkongi found qinling-engine fails to send http request to the service url06:57
lxkongafter deleting the network policy, it just works06:57
lxkongin our CI, qinling and k8s is running on a same VM, and that network policy doesn't block the access06:58
lxkonghuntxu:  is that clear?06:59
*** mattgo has joined #openstack-qinling08:23
huntxulxkong: Yes I understand the scenario. However when I was testing this, I can successfully access the exposed k8s service (then to the pod) from another host while there is such a network policy08:32
huntxulxkong: besides it seems to me not a problem related to whether qinling-engine runs on a different host or not. For a k8s cluster, even connections from localhost should be considered as external (not from pods inside the cluster but via a namespaced service), no?08:36
lxkonghuntxu: no, from the test i did, that network policy didn't stop connections from the master node10:45
lxkongwhich sounds...weird10:46
lxkongi have come up with a solution that only allow connection from qinling-engine ip address to the pods of qinling namespace.10:47
lxkongkind: NetworkPolicy10:48
lxkongapiVersion: networking.k8s.io/v110:48
lxkongmetadata:10:48
lxkong  namespace: qinling10:48
lxkong  name: allow-external10:48
lxkongspec:10:48
lxkong  podSelector: {}10:48
lxkong  policyTypes:10:48
lxkong  - Ingress10:48
lxkong  ingress:10:48
lxkong  - from:10:48
lxkong    - ipBlock:10:48
lxkong        cidr: 10.0.0.11/3210:48
lxkongshit..10:48
lxkonghttps://www.irccloud.com/pastebin/Nf0p5efz/10:49
lxkongsomething like this10:49
huntxulxkong: this is exactly the same solution I had come up with when I first tried to implement the isolation feature. But then I found I could access to the pod via the exposed service from another host, so things became easier then10:58
huntxulxkong: the problem with this solution is that it is difficult to determine the address that qinling-engine will use to contact the service, especially when there is some NAT between them10:59
lxkongwe could make this configurable, if not provided, then no network policy will be created11:00
lxkongallow operator add some ips or cidrs11:00
lxkongdocumentation is also needed.11:01
lxkonghuntxu: btw, could you please merge this one https://review.openstack.org/#/c/613831/?11:02
lxkongi've already tested with `QINLING_INSTALL_K8S=False`11:02
huntxulxkong: done, I've read that yesterday, but forgot to land it11:04
lxkongthanks11:04
*** huntxu has quit IRC11:30
openstackgerritMerged openstack/qinling master: Skip k8s installation if needed  https://review.openstack.org/61383111:43
*** larainema has joined #openstack-qinling11:54
openstackgerritLingxian Kong proposed openstack/qinling master: Improve the documentation  https://review.openstack.org/61419912:16
openstackgerritLingxian Kong proposed openstack/qinling master: Improve the documentation  https://review.openstack.org/61419912:34
*** mattgo has quit IRC17:22

Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!