[Starlingx-discuss] Procedure to configure rules to enable access to port in controller
Hi, I'm trying to enable a monitoring service in the controller. After some debugging I realize that the access rules are managed by calico. So, I'm trying to apply the following policy: apiVersion: "crd.projectcalico.org/v1" kind: GlobalNetworkPolicy metadata: name: custom-testing-port spec: selector: "has(iftype) && iftype == 'oam'" order: 100 applyOnForward: false types: - Ingress - Egress ingress: - action: Allow ipVersion: 4 protocol: TCP destination: ports: [9100] egress: - action: Allow ipVersion: 4 protocol: TCP And I run this with: $ kubectl apply -f policy.yaml Then I used this command to enable the access to the port. $ sudo iptables -A INPUT -p tcp -m multiport --dports 9100 -m comment --comment "Testing port expose" -j ACCEPT This seems to be the same procedure as described here[0] to enable access to horizon. If I do a `iptables-save | grep 9100` I can see the rules: -A cali-pi-custom-testing-port -p tcp -m comment --comment "cali:htmNJYyMe7qlodKr" -m multiport --dports 9100 -j MARK --set-xmark 0x10000/0x10000 -A cali-pi-custom-testing-port -p tcp -m comment --comment "cali:htmNJYyMe7qlodKr" -m multiport --dports 9100 -j MARK --set-xmark 0x10000/0x10000 -A INPUT -p tcp -m multiport --dports 9100 -m comment --comment "Testing port expose" -j ACCEPT -A cali-pi-custom-testing-port -p tcp -m comment --comment "cali:htmNJYyMe7qlodKr" -m multiport --dports 9100 -j MARK --set-xmark 0x10000/0x10000 However, when I try to run a curl from an external host I get a "A communication error occurred: 'No route to host'" error. If I run this same command from inside the controller I get the data. $ curl http://10.10.10.3:9100/metrics I'm sure I'm missing a step, does anybody knows what I can do next to enable the port access? - [0] https://wiki.openstack.org/wiki/StarlingX/Containers/Installation#Generate_t...
Erich, The "No route to host" sounds like you don't have the route set to 10.10.10.3 in your external host. Check with "ip route" to see if 10.10.10.0/24 route or default route were set. I suppose you are working on a bare metal system. Mingyuan -----Original Message----- From: Cordoba Malibran, Erich [mailto:erich.cordoba.malibran@intel.com] Sent: Tuesday, July 16, 2019 0:58 To: starlingx-discuss@lists.starlingx.io Subject: [Starlingx-discuss] Procedure to configure rules to enable access to port in controller Hi, I'm trying to enable a monitoring service in the controller. After some debugging I realize that the access rules are managed by calico. So, I'm trying to apply the following policy: apiVersion: "crd.projectcalico.org/v1" kind: GlobalNetworkPolicy metadata: name: custom-testing-port spec: selector: "has(iftype) && iftype == 'oam'" order: 100 applyOnForward: false types: - Ingress - Egress ingress: - action: Allow ipVersion: 4 protocol: TCP destination: ports: [9100] egress: - action: Allow ipVersion: 4 protocol: TCP And I run this with: $ kubectl apply -f policy.yaml Then I used this command to enable the access to the port. $ sudo iptables -A INPUT -p tcp -m multiport --dports 9100 -m comment --comment "Testing port expose" -j ACCEPT This seems to be the same procedure as described here[0] to enable access to horizon. If I do a `iptables-save | grep 9100` I can see the rules: -A cali-pi-custom-testing-port -p tcp -m comment --comment "cali:htmNJYyMe7qlodKr" -m multiport --dports 9100 -j MARK --set-xmark 0x10000/0x10000 -A cali-pi-custom-testing-port -p tcp -m comment --comment "cali:htmNJYyMe7qlodKr" -m multiport --dports 9100 -j MARK --set-xmark 0x10000/0x10000 -A INPUT -p tcp -m multiport --dports 9100 -m comment --comment "Testing port expose" -j ACCEPT -A cali-pi-custom-testing-port -p tcp -m comment --comment "cali:htmNJYyMe7qlodKr" -m multiport --dports 9100 -j MARK --set-xmark 0x10000/0x10000 However, when I try to run a curl from an external host I get a "A communication error occurred: 'No route to host'" error. If I run this same command from inside the controller I get the data. $ curl http://10.10.10.3:9100/metrics I'm sure I'm missing a step, does anybody knows what I can do next to enable the port access? - [0] https://wiki.openstack.org/wiki/StarlingX/Containers/Installation#Generate_t... _______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss
Thanks Mingyuan. It turns out that I was having problems with the proxy. I was using: $ NO_PROXY=10.10.10.3 curl http://10.10.10.3:9100/metrics Instead of $ no_proxy=10.10.10.3 curl http://10.10.10.3:9100/metrics At the end, only the policy was required to enable the access to the port, the additional iptables command wasn't needed. -Erich On 7/15/19, 8:20 PM, "Qi, Mingyuan" <mingyuan.qi@intel.com> wrote: Erich, The "No route to host" sounds like you don't have the route set to 10.10.10.3 in your external host. Check with "ip route" to see if 10.10.10.0/24 route or default route were set. I suppose you are working on a bare metal system. Mingyuan -----Original Message----- From: Cordoba Malibran, Erich [mailto:erich.cordoba.malibran@intel.com] Sent: Tuesday, July 16, 2019 0:58 To: starlingx-discuss@lists.starlingx.io Subject: [Starlingx-discuss] Procedure to configure rules to enable access to port in controller Hi, I'm trying to enable a monitoring service in the controller. After some debugging I realize that the access rules are managed by calico. So, I'm trying to apply the following policy: apiVersion: "crd.projectcalico.org/v1" kind: GlobalNetworkPolicy metadata: name: custom-testing-port spec: selector: "has(iftype) && iftype == 'oam'" order: 100 applyOnForward: false types: - Ingress - Egress ingress: - action: Allow ipVersion: 4 protocol: TCP destination: ports: [9100] egress: - action: Allow ipVersion: 4 protocol: TCP And I run this with: $ kubectl apply -f policy.yaml Then I used this command to enable the access to the port. $ sudo iptables -A INPUT -p tcp -m multiport --dports 9100 -m comment --comment "Testing port expose" -j ACCEPT This seems to be the same procedure as described here[0] to enable access to horizon. If I do a `iptables-save | grep 9100` I can see the rules: -A cali-pi-custom-testing-port -p tcp -m comment --comment "cali:htmNJYyMe7qlodKr" -m multiport --dports 9100 -j MARK --set-xmark 0x10000/0x10000 -A cali-pi-custom-testing-port -p tcp -m comment --comment "cali:htmNJYyMe7qlodKr" -m multiport --dports 9100 -j MARK --set-xmark 0x10000/0x10000 -A INPUT -p tcp -m multiport --dports 9100 -m comment --comment "Testing port expose" -j ACCEPT -A cali-pi-custom-testing-port -p tcp -m comment --comment "cali:htmNJYyMe7qlodKr" -m multiport --dports 9100 -j MARK --set-xmark 0x10000/0x10000 However, when I try to run a curl from an external host I get a "A communication error occurred: 'No route to host'" error. If I run this same command from inside the controller I get the data. $ curl http://10.10.10.3:9100/metrics I'm sure I'm missing a step, does anybody knows what I can do next to enable the port access? - [0] https://wiki.openstack.org/wiki/StarlingX/Containers/Installation#Generate_t... _______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss
participants (2)
-
Cordoba Malibran, Erich
-
Qi, Mingyuan