fix: [WIN-NPM] allow readiness probes #1887
Conversation
huntergregory
force-pushed
the
hgregory/03-31-readiness-probe
branch
from
e940588 to
1389016
Compare
Testing
Add deny-all policy for these Pods.
|
| // fixes #1881 | ||
| hnsRules[len(policy.ACLs)] = &NPMACLPolSettings{ | ||
| Id: policy.ACLPolicyID, | ||
| Action: hcn.ActionTypeAllow, |
There was a problem hiding this comment.
You are allowing all rules, you should add the source ip as node ip here right ?
Add a comment on this too .
|
/azp run |
|
Azure Pipelines successfully started running 2 pipeline(s). |
|
/azp run |
|
Azure Pipelines successfully started running 2 pipeline(s). |
|
/azp run |
|
Azure Pipelines successfully started running 2 pipeline(s). |
|
/azp run |
|
Azure Pipelines successfully started running 2 pipeline(s). |
| @@ -92,6 +94,11 @@ func (pMgr *PolicyManager) Bootup(epIDs []string) error { | |||
| // update Prometheus metrics on success | |||
| metrics.IncNumACLRulesBy(numLinuxBaseACLRules) | |||
| } | |||
|
|
|||
| if util.IsWindowsDP() && pMgr.NodeIP == "" { | |||
| return npmerrors.Errorf(npmerrors.BootupPolicyMgr, false, "policy manager must have a configured nodeIP in Windows") | |||
There was a problem hiding this comment.
This return error might be fatal, but should be okay for time being. We will need to make our getnodeip logic robust in case we see any failures.
Can put up a alert on this error message from telemetry.
| // Get preferred outbound ip of this machine | ||
| // source: https://stackoverflow.com/questions/23558425/how-do-i-get-the-local-ip-address-in-go | ||
| func NodeIP() (string, error) { | ||
| conn, err := net.Dial("udp", "8.8.8.8:80") |
There was a problem hiding this comment.
What if 8.8.8.8 is blocked by some NSGs or other way , will this still work ?
There was a problem hiding this comment.
from the stack overflow post, it says that this actually does not actually create a connection since it is the udp protocol. Any IP address would work here
There was a problem hiding this comment.
tested in the following way:
- Made sure NPM gets the right node IP in 100-node cluster
- On local Windows machine, got node IP by dialing 20 million different IPs
- Added deny rules for 8.8.8.8:80 in AKS NSG
Reason for Change:
Allows readiness probes no matter the NetPol configuration. This is in-line with other NetworkPolicy managers including:
Issue Fixed:
Fixes #1881
Requirements:
Notes: