High number of redundant kubeproxy rules is noticed in RHOCP4 since version 4.15 with OpenshiftSDN

Solution Verified - Updated -

Issue

  • Why are the alerts NodeProxyApplySlow and ClusterProxyApplySlow firing in RHOCP 4.15 with OpenshiftSDN network plugin?
  • Why is there a high quantity of redundant kubeproxy rules in the OCP nodes since RHOCP 4.15?

    $ iptables -nvL -t nat | grep 'masquerade traffic for openshift-ingress'
    0     0 KUBE-MARK-MASQ  all  --  !tun0  *       0.0.0.0/0            0.0.0.0/0            
    /* masquerade traffic for openshift-ingress/router-nodeport-<svc-name>:http external destinations */
    0     0 KUBE-MARK-MASQ  all  --  !tun0  *       0.0.0.0/0            0.0.0.0/0 
    /* masquerade traffic for openshift-ingress/router-nodeport-<svc-name>:http external destinations */
    0     0 KUBE-MARK-MASQ  all  --  !tun0  *       0.0.0.0/0            0.0.0.0/0 
    /* masquerade traffic for openshift-ingress/router-nodeport-<svc-name>:http external destinations */
    [...]
    $ iptables -nvL -t nat | grep 'masquerade traffic for openshift-ingress' | wc -l
    289530 <----- High quantity of duplicate rules
    

Environment

  • Red Hat OpenShift Container Platform (RHOCP)
    • 4.15
    • 4.16

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content