OCP4: UDP NodePort traffic from a single sender is silently dropped on an OpenShift node while other senders work

Solution Verified - Updated -

Issue

  • One specific sender's UDP traffic to a NodePort never reaches the backend pod. Other senders to the same NodePort work. The same sender works on other NodePorts.
  • The problem often starts after the backend pod on that node restarts, and it does not recover on its own.
  • A tcpdump -i any capture on the node shows the sender's packets arriving on the physical interface and bond, but the chain stops there: the packets never appear on br-ex or ovn-k8s-mp0 and never reach the pod.
  • The OVN-KUBE-ETP DNAT rule counters for the NodePort do not increase with the sender's traffic.
  • The node's UdpNoPorts counter (nstat -z UdpNoPorts) increases at the sender's packet rate.

Environment

  • Red Hat OpenShift Container Platform 4.x
  • OVN-Kubernetes CNI
  • A NodePort or LoadBalancer Service for UDP with externalTrafficPolicy: Local
  • An external device that sends UDP continuously from one fixed source port (for example a firewall or network device sending syslog)

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content