External application resources not accessible due to firewall changes

[Andre Kantek]

Brief Description

It was detected that stx applications are not been able to access the k8s services L4 ports. They are been blocked by the firewall.

The latest change in the firewall set applyOnForward to true and it should have been false

Severity

Major

Steps to Reproduce

L4 access requests to a pod that is mapped to a k8s service should be accessible

Actual Behavior

requests fail

Reproducibility

Reproducible

System Configuration

AIO-SX, IPV4

Load info (eg: 2022-03-10_20-00-07)

Build ID: 2023-07-15_18-00-09

Last Pass

2023-07-13_18-00-09

Workaround

kubectl patch globalnetworkpolicy controller-oam-if-gnp --type=json -p='[{"op": "replace", "path": "/spec/applyOnForward", "value": false }]'

[Ghada Khalil (gkhalil)]

Issue related to: https://storyboard.openstack.org/#!/story/2010591

[Ghada Khalil (gkhalil)]

Fixed by: https://review.opendev.org/c/starlingx/config/+/890203
Merged on Aug 2