External gateway pod deletes may not clean up ECMP routes in OVNKubernetes ICNI 2.0 with Red Hat OpenShift Container Platform 4.7

Solution In Progress - Updated -

Issue

External gateway pod deletes may not clean up ECMP routes in OVNKubernetes ICNI 2.0 with Red Hat OpenShift Container Platform 4.7

There are a few scenarios where deleting a pod acting as an external gateway will not clean up routes in the served namespaces. The OVN lr-route entries will persist even after deletion of the ICNI router namespace (including the pod with the required annotations) and the application namespace.

When one inspects the lr-route-list in OVN's northbound DB, one can see invalid routes to non-existing pods, for example routes may persist even though no more ICNI 2.0 gateway pod with the annotation exists.

The following was taken after the ICNI 2.0 gateway pod including its namespace as well as all ICNI application pods including their namespace were deleted, yet the routes persisted in the OVN database:

# oc exec -n openshift-ovn-kubernetes -it $POD -- ovn-nbctl lr-route-list GR_openshift-worker-1
Defaulting container name to ovn-controller.
Use 'oc describe pod/ovnkube-node-7s2kh -n openshift-ovn-kubernetes' to see all of the containers in this pod.
IPv4 Routes
              172.25.2.18           192.168.123.120 src-ip ecmp-symmetric-reply    # <--- invalid route
             172.25.3.171           192.168.123.120 src-ip ecmp-symmetric-reply    # <--- invalid route
            172.24.0.0/14                100.64.0.1 dst-ip
                0.0.0.0/0             192.168.123.1 dst-ip rtoe-GR_openshift-worker-1

The issue may also manifest itself in the presence of multiple different gateways for the same source IP address:

# oc exec -n openshift-ovn-kubernetes -it $POD -- ovn-nbctl lr-route-list GR_openshift-worker-1
IPv4 Routes
            192.168.0.124                192.168.123.123 src-ip ecmp-symmetric-reply
            192.168.0.125                192.168.123.123 src-ip ecmp-symmetric-reply
            192.168.0.129                192.168.123.123 src-ip ecmp ecmp-symmetric-reply
            192.168.0.129                192.168.123.123 src-ip ecmp ecmp-symmetric-reply
(...)

Environment

Red Hat OpenShift Container Platform 4.7

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content