wicket: preflight could check NTP connectivity from all (or several?) IPs in the service pool

oxidecomputer / omicron

Omicron: Oxide control plane

Mozilla Public License 2.0

245 stars 38 forks source link

wicket: preflight could check NTP connectivity from all (or several?) IPs in the service pool #6622

Open iliana opened 2 weeks ago

iliana commented 2 weeks ago

If firewall rules are opened up only for the service pool IP that attempted to make an NTP query during preflight, it's very likely that the boundary NTP zones will come up with different IPs and fail to make connectivity. Preflight could check that several or all of the IPs in the service pool have the ability to reach NTP servers.

jgallagher commented 2 weeks ago

I think the current implementation is slightly worse than the issue describes. During preflight uplink, the IP making the request will be one of the uplink addresses provided at RSS time, which is not part of the service IP pool at all.