OCP4: UDP NodePort traffic from a single sender is silently dropped on an OpenShift node while other senders work
Issue
- One specific sender's UDP traffic to a NodePort never reaches the backend pod. Other senders to the same NodePort work. The same sender works on other NodePorts.
- The problem often starts after the backend pod on that node restarts, and it does not recover on its own.
- A
tcpdump -i anycapture on the node shows the sender's packets arriving on the physical interface and bond, but the chain stops there: the packets never appear onbr-exorovn-k8s-mp0and never reach the pod. - The
OVN-KUBE-ETPDNAT rule counters for the NodePort do not increase with the sender's traffic. - The node's
UdpNoPortscounter (nstat -z UdpNoPorts) increases at the sender's packet rate.
Environment
- Red Hat OpenShift Container Platform 4.x
- OVN-Kubernetes CNI
- A
NodePortorLoadBalancerService for UDP withexternalTrafficPolicy: Local - An external device that sends UDP continuously from one fixed source port (for example a firewall or network device sending syslog)
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.