kuryr-daemon default port can be used as local port by another process

Bug #1829188 reported by Alexey Perevalov
12
This bug affects 1 person
Affects Status Importance Assigned to Milestone
kuryr-kubernetes
Fix Released
Medium
Alexey Perevalov

Bug Description

Now-days most linux based OSes have following local port range
net.ipv4.ip_local_port_range = 32768 60999
The default port for CNI Daemon is 50036 and it's in local port range.
If default port was used during deployment we have non-zero probability what that
port port (50036) already was used as local port.

For example:

[root@ccm ~]# netstat -ltapn |grep 50036
tcp 0 0 127.0.0.1:50036 127.0.0.1:2379 ESTABLISHED 7924/kube-apiserver
tcp 0 0 127.0.0.1:2379 127.0.0.1:50036 ESTABLISHED 7783/etcd

In this case daemon won't start, due to address already in use error.

It's not always issue and bug can be worked around just by adding bind_address option into daemon section.

Changed in kuryr-kubernetes:
assignee: nobody → Alexey Perevalov (alexeyperevalov)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to kuryr-kubernetes (master)

Fix proposed to branch: master
Review: https://review.opendev.org/660152

Changed in kuryr-kubernetes:
status: New → In Progress
Changed in kuryr-kubernetes:
importance: Undecided → Medium
Changed in kuryr-kubernetes:
assignee: Alexey Perevalov (alexeyperevalov) → Michal Dulko (michal-dulko-f)
Changed in kuryr-kubernetes:
assignee: Michal Dulko (michal-dulko-f) → Alexey Perevalov (alexeyperevalov)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to kuryr-kubernetes (master)

Reviewed: https://review.opendev.org/660152
Committed: https://git.openstack.org/cgit/openstack/kuryr-kubernetes/commit/?id=c8a87bf2fd65212d5e0a00db0435dea521b8b97e
Submitter: Zuul
Branch: master

commit c8a87bf2fd65212d5e0a00db0435dea521b8b97e
Author: Alexey Perevalov <email address hidden>
Date: Mon May 20 18:11:42 2019 +0300

    Use non local port for CNI Daemon

    This port 50036 can be already used in the system, due
    to it's in range for egress ports.

    Closes-Bug: 1829188

    Change-Id: Ieee291893ca342867eb408d65402a8576327ac6d
    Signed-off-by: Alexey Perevalov <email address hidden>

Changed in kuryr-kubernetes:
status: In Progress → Fix Released
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/kuryr-kubernetes 1.1.0

This issue was fixed in the openstack/kuryr-kubernetes 1.1.0 release.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.