[Starlingx-discuss] Procedure to configure rules to enable access to port in controller

[Cordoba Malibran, Erich]

Hi, 

I'm trying to enable a monitoring service in the controller. After some
debugging I realize that the access rules are managed by calico. So,
I'm trying to apply the following policy: 

apiVersion: "crd.projectcalico.org/v1"
kind: GlobalNetworkPolicy
metadata:
  name: custom-testing-port
spec:
  selector: "has(iftype) && iftype == 'oam'"
  order: 100
  applyOnForward: false
  types:
  - Ingress
  - Egress
  ingress:
  - action: Allow
    ipVersion: 4
    protocol: TCP
    destination:
      ports: [9100]
  egress:
  - action: Allow
    ipVersion: 4
    protocol: TCP


And I run this with: 

$ kubectl apply -f policy.yaml

Then I used this command to enable the access to the port.

$ sudo iptables -A INPUT -p tcp -m multiport --dports 9100 -m comment --comment "Testing port expose" -j ACCEPT 


This seems to be the same procedure as described here[0] to enable
access to horizon. 

If I do a `iptables-save | grep 9100` I can see the rules: 

-A cali-pi-custom-testing-port -p tcp -m comment --comment "cali:htmNJYyMe7qlodKr" -m multiport --dports 9100 -j MARK --set-xmark 0x10000/0x10000                                            
-A cali-pi-custom-testing-port -p tcp -m comment --comment "cali:htmNJYyMe7qlodKr" -m multiport --dports 9100 -j MARK --set-xmark 0x10000/0x10000                                            
-A INPUT -p tcp -m multiport --dports 9100 -m comment --comment "Testing port expose" -j ACCEPT                                                                                              
-A cali-pi-custom-testing-port -p tcp -m comment --comment "cali:htmNJYyMe7qlodKr" -m multiport --dports 9100 -j MARK --set-xmark 0x10000/0x10000  


However, when I try to run a curl from an external host I get a "A
communication error occurred: 'No route to host'" error. If I run this
same command from inside the controller I get the data.

$ curl http://10.10.10.3:9100/metrics

I'm sure I'm missing a step, does anybody knows what I can do next to
enable the port access? 


- [0] https://wiki.openstack.org/wiki/StarlingX/Containers/Installation#Generate_the_stx-openstack_application_tarball