Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add option to enable port security by default for networks #418

Open
scult opened this issue Mar 15, 2022 · 1 comment
Open

Add option to enable port security by default for networks #418

scult opened this issue Mar 15, 2022 · 1 comment
Assignees
Labels
area/networking Networking related kind/enhancement Enhancement, improvement, extension lifecycle/rotten Nobody worked on this for 12 months (final aging stage) platform/openstack OpenStack platform/infrastructure

Comments

@scult
Copy link

scult commented Mar 15, 2022

How to categorize this issue?
/area networking
/kind enhancement
/platform openstack

What would you like to be added:
A configuration option to enable the port security group setting on network creation, so ports that are created have port security enabled by default.

Why is this needed:
Some openstack providers require port security to be enabled for VM ports. When Gardener tries to create a VM port without port security it results in the following error:

"error":"Error while waiting for Worker shoot--garden--openstack-seed/openstack-seed to become ready: error during reconciliation: Error reconciling worker: Failed while waiting for all machine deployments to be ready: 'machine(s) failed: 1 error occurred: \"shoot--garden--openstack-seed-cpu-worker-z1-65978-wkphc\": Cloud provider message - machine codes error: code = [Internal] message = [failed to resolve server [Name=\"shoot--garden--openstack-seed-cpu-worker-z1-65978-wkphc\"] networks: Expected HTTP response code [201 202] when accessing [POST https://network.compute.gra9.cloud.ovh.net/v2.0/ports], but got 409 instead\n{\"NeutronError\": {\"type\": \"AddressPairAndPortSecurityRequired\", \"message\": \"Port Security must be enabled in order to have allowed address pairs on a port.\", \"detail\": \"\"}}]'","flow":"Shoot cluster reconciliation","level":"error","msg":"Error","operation":"reconcile","shoot":"garden/openstack-seed","task":"Waiting until shoot worker nodes have been reconciled","ts":"2022-03-11T14:57:59.349Z"}

As a workaround we've manually adjusted the shoot network to enable port security by default:
openstack network set shoot--garden--openstack-seed --enable-port-security

@scult scult added the kind/enhancement Enhancement, improvement, extension label Mar 15, 2022
@gardener-robot gardener-robot added area/networking Networking related platform/openstack OpenStack platform/infrastructure labels Mar 15, 2022
@kon-angelo kon-angelo self-assigned this Mar 17, 2022
@kon-angelo
Copy link
Contributor

Hello @scult. I tried to take a look into that but unfortunately our openstack environment does not support port security. As a matter of fact, I cannot enable it at all and so even if I do try to implement this I would be unable to make an e2e test.

I am discussing with our environment administrators about this, but for the time being I cannot progress. Therefore I would like to ask you if you can help contributing this to the openstack extension. I can provide you with support regarding what needs to be done and the discuss the feature itself. WDYT ?

@gardener-robot gardener-robot added the lifecycle/stale Nobody worked on this for 6 months (will further age) label Sep 19, 2022
@gardener-robot gardener-robot added lifecycle/rotten Nobody worked on this for 12 months (final aging stage) and removed lifecycle/stale Nobody worked on this for 6 months (will further age) labels May 29, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area/networking Networking related kind/enhancement Enhancement, improvement, extension lifecycle/rotten Nobody worked on this for 12 months (final aging stage) platform/openstack OpenStack platform/infrastructure
Projects
None yet
Development

No branches or pull requests

3 participants