Closed antoninbas closed 4 years ago
@jianjuns @abhiraut FYI
@wenyingd let me know if you need more information. I know we don't explicitly document that we support Photon OS, but the kernel looks recent to me and so I'm surprised that we see this error. If you want me to try to install something on my Photon OS VM, please let me know. Unfortunately I cannot give you SSH access since the VM is running locally on my laptop...
@antoninbas It looks photon doesn't support "ct" feature on the OVS. Could you help check the OVS kernel module version on the testing VM? In my memory, the OVS kernel module version should be higher than 2.6.
I remember @edwardbadboy found an issue that photos OS didn't compile multiple conntrack zone support by default. It looks like similar.
I just saw this: https://github.com/vmware/photon/blob/master/SPECS/linux/linux-esx.spec#L322
Maybe a slightly more recent version of Photon OS will work?
Yes, I guess so.
Hi Antonin,
Would you check the following command output?
grep CONFIG_NF_CONNTRACK_ZONES /boot/config-$(uname -r)
See if it's CONFIG_NF_CONNTRACK_ZONES=y
. If not, it's the cause of the failure.
It could be when they compile the kernel, the zone support of conntrack module was not enabled. Previously when I tried Antrea on Photon OS, I recompiled the Photon kernel with that flag set to "y" ( https://github.com/edwardbadboy/photon/commit/a6c3c108302e1d682180c2499ccada14dd16e39f )
I thought last time Jianjun said Photon developers agreed to turn on the switch by default. Let me check if the upstream Photon has that change. If not, I can submit the pull request to Photon upstream.
I just saw this: https://github.com/vmware/photon/blob/master/SPECS/linux/linux-esx.spec#L322
Maybe a slightly more recent version of Photon OS will work?
Seems they already made the change. Let's use a more recent Photon OS version then.
I ran tdnf upgrade linux-esx
and it fixed that specific issue. Pod networking is still not working, so I'm looking into it.
Alright this was a combination of multiple things, but I managed to make it work:
tdnf upgrade linux-esx
to upragde kerneliptables -A INPUT -i gw0 -j ACCEPT
. It seems that Photon OS has a strict firewall by default.Maybe these things are worth documenting somewhere? @jianjuns
Perhaps we could solve the 3rd with antrea-agent if it's common for other CNIs to add such rules for their traffic. Right now we only add rules to FORWARD chain.
@antoninbas agreed we should document CONFIG_NF_CONNTRACK_ZONES and firewall rules. CONFIG_NF_CONNTRACK_ZONES is a known issue for Photon OS, and last time we pushed a change to enable it for the vSphere build.
Perhaps we could solve the 3rd with antrea-agent if it's common for other CNIs to add such rules for their traffic. Right now we only add rules to FORWARD chain.
maybe check if Input policy is drop and only then apply the rule ?
Describe the bug When creating a single node cluster with kubeadm on a Photon OS VM, Pod Networking does not work. For example, trying to ping the local gw0 from any Pod does not work. When looking at the Antrea agent logs, one can see the following:
BTW, @wenyingd do you think these log messages can be displayed in a more user-friendly format :) ?
If I dump the flows, I can see that table 30 is empty, and this flow is therefore missing:
Trying to add the flow manually gives the following error:
To Reproduce
Versions: Antrea: v0.5.1