OCPBUGS-79536: Removing AWS security group OVNDB ports as they are no longer used

[ssonigra]

The security group created in AWS using IPI installation was having ports mentioned as 6441 & 6442 , as these ports are no longer needed because they are not used so removing it from the installer
Making the changes as per the Bug https://redhat.atlassian.net/browse/OCPBUGS-79536

[openshift-ci]

Hi @ssonigra. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 14d8ebf8-e339-4be3-b7f5-dd3d2fbfb46d

📥 Commits

Reviewing files that changed from the base of the PR and between cac023c and f14b7b0.

📒 Files selected for processing (1)

• pkg/asset/manifests/aws/cluster.go

💤 Files with no reviewable changes (1)

• pkg/asset/manifests/aws/cluster.go

---

Walkthrough

Removed the CNI security-group ingress rule for the OVN database named "ovndb" that allowed TCP traffic on ports 6441–6442 from the cluster asset generation logic.

Changes

Cohort / File(s)	Summary
OVN Security Group Rule Removal pkg/asset/manifests/aws/cluster.go	Deleted the ingress rule entry for ovndb which permitted TCP FromPort/ToPort 6441–6442 (including description and protocol fields).

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[tthvo]

/retitle OCPBUGS-79536: aws: updating security group OVNDB ports to 6641-6642
/ok-to-test
/hold

Let's see what tests say... but why hasn't anything failed yet if the port is incorrect... 🤔

[openshift-ci-robot]

@ssonigra: This pull request references Jira Issue OCPBUGS-79536, which is invalid:

• expected the bug to target the "4.22.0" version, but no target version was set
• expected the bug to be in one of the following states: NEW, ASSIGNED, POST, but it is MODIFIED instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

The security group created in AWS using IPI installation was having ports mentioned as 6441 & 6442 instead of 6641 & 6642 , this PR is going to fix the error in the typo

Making the changes as per the Bug https://redhat.atlassian.net/browse/OCPBUGS-79536

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[tthvo]

/jira refresh

[openshift-ci-robot]

@tthvo: This pull request references Jira Issue OCPBUGS-79536, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.22.0) matches configured target version for branch (4.22.0)
• bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[ssonigra]

/retest

[ssonigra]

hello @tthvo the issue here is with what port is displayed in the AWS console , the backend code is correct its just issue with whats displayed on the AWS console under security gorup.

[tthvo]

hello @tthvo the issue here is with what port is displayed in the AWS console , the backend code is correct its just issue with whats displayed on the AWS console under security gorup.

@ssonigra Indeed. Though, the PR also changed the value for FromPort and ToPort, which determines which port range is open for this specific rule.

In other words, this configures the security group to now allow 6641-6642 while denying the previous 6441-6442 ports.

[tthvo]

The e2e jobs here indicates this change is fine... This leads me to wonder if these ports are ever used at all 🤔

[tthvo]

This leads me to wonder if these ports are ever used at all 🤔

I just did an install with a patch that does not include a rule to allow either 6441-6442 or 6641-6642 at all; and the install completed successfully. GCP and Azure codes don't seem to include these ports either... 🤔

[ssonigra]

Hello those port are used by OVNkubernetes so those are needed to make sure there is connectivity between masters and workers.here is the upstream documentaion https://docs.ovn.org/en/latest/howto/firewalld.html

[tthvo]

Hello those port are used by OVNkubernetes so those are needed to make sure there is connectivity between masters and workers.here is the upstream documentaion https://docs.ovn.org/en/latest/howto/firewalld.html

Yes, definitely... I do agree with your concern. However, this PR raises more questions than just a typo:

• The security group ingress rules define what ports (ranges) are allowed/open for in-coming traffics on the EC2 instances (i.e. nodes). They are basically firewall configurations.
• If the installer has a typo that previously allows 6441-6442 and ovn-kubernetes uses 6641-6642, then the security group has always rejected traffic to ports 6641-6642; thus, the cluster should've failed to install and should never have been functional at all since release 4.15.

That brought me to the question here: Do 6641-6642 ports actually receive any traffic at all and why not? maybe, ovn-kubernetes operates differently in openshift than upstream 🤷‍♂️ I hope this makes sense 👍

[ssonigra]

Hello Thuan, agree with you, I am testing something on my clusters, maybe we dont need the port itself , if thats the case I will raise a separate PR to remove the entry itself so the SG is not created at all...

[patrickdillon]

/retest-required

[tthvo]

/retest

[ssonigra]

/test e2e-aws-ovn-single-node

[tthvo]

Hello Thuan, agree with you, I am testing something on my clusters, maybe we dont need the port itself , if thats the case I will raise a separate PR to remove the entry itself so the SG is not created at all...

Yea, the e2e results seem to indicate the ingress rule for 6441-6441 or 6641-6642 is not needed at all. I am just as confused 😅 patrick and @yunjiang29 will probably have more background context than me 👀

[yunjiang29]

Hello Thuan, agree with you, I am testing something on my clusters, maybe we dont need the port itself , if thats the case I will raise a separate PR to remove the entry itself so the SG is not created at all...

Yea, the e2e results seem to indicate the ingress rule for 6441-6441 or 6641-6642 is not needed at all. I am just as confused 😅 patrick and @yunjiang29 will probably have more background context than me 👀

The installation tests did not use these ports either.
@zshi-redhat Do you know more about OVNDB ports? Are these ports currently being used by the network team?

[zenghui-shi]

Hello Thuan, agree with you, I am testing something on my clusters, maybe we dont need the port itself , if thats the case I will raise a separate PR to remove the entry itself so the SG is not created at all...

Yea, the e2e results seem to indicate the ingress rule for 6441-6441 or 6641-6642 is not needed at all. I am just as confused 😅 patrick and @yunjiang29 will probably have more background context than me 👀

The installation tests did not use these ports either. @zshi-redhat Do you know more about OVNDB ports? Are these ports currently being used by the network team?

These ports are used by different ovn-db transport methods:
port 6641 for ssl transport method
port 6441 for tcp transport method
There was an arch change in ovnk around 4.14 where we changed the transport method from ssl to tcp/socket if I'm not mistaken, so likely we don't need them anymore given the db connection now moved to use local sokcet.

@ssonigra For the bug, let's move it to eng team and get them review what change is needed.

[ssonigra]

Hello marty, tthov the commit has been squashed and its merged into a single commit , please review and let me know if we are good to merge it..

[ssonigra]

Commits have been squashed as requested. Ready for re-review @marty-power

[openshift-ci]

@ssonigra: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-eusc-techpreview	f14b7b0	link	false	/test e2e-aws-eusc-techpreview
ci/prow/e2e-aws-ovn-heterogeneous	39c525d	link	false	/test e2e-aws-ovn-heterogeneous

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[tthvo]

/lgtm
/approve

Thanks! I cross-ref with aws-upi-template, which also does not include the 6441-6442 port either. After this merges, we also need to make sure openshift-docs does not mention this port anymore👍

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: marty-power, tthvo

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• pkg/asset/manifests/aws/OWNERS [tthvo]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[tthvo]

/verified by CI (see above discussions too)
/tide refresh

[openshift-ci-robot]

@tthvo: This PR has been marked as verified by CI (see above discussions too).

Details

In response to this:

/verified by CI (see above discussions too)
/tide refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@ssonigra: Jira Issue Verification Checks: Jira Issue OCPBUGS-79536
✔️ This pull request was pre-merge verified.
✔️ All associated pull requests have merged.
✔️ All associated, merged pull requests were pre-merge verified.

Jira Issue OCPBUGS-79536 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓

Details

In response to this:

The security group created in AWS using IPI installation was having ports mentioned as 6441 & 6442 , as these ports are no longer needed because they are not used so removing it from the installer
Making the changes as per the Bug https://redhat.atlassian.net/browse/OCPBUGS-79536

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[ssonigra]

/cherry-pick release-4.22

[openshift-cherrypick-robot]

@ssonigra: only openshift org members may request cherry picks. If you are already part of the org, make sure to change your membership to public. Otherwise you can still do the cherry-pick manually.

Details

In response to this:

/cherry-pick release-4.22

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[ssonigra]

/cherry-pick release-4.22

[openshift-cherrypick-robot]

@ssonigra: only openshift org members may request cherry picks. If you are already part of the org, make sure to change your membership to public. Otherwise you can still do the cherry-pick manually.

Details

In response to this:

/cherry-pick release-4.22

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[ssonigra]

/cherry-pick release-4.21

[openshift-cherrypick-robot]

@ssonigra: only openshift org members may request cherry picks. If you are already part of the org, make sure to change your membership to public. Otherwise you can still do the cherry-pick manually.

Details

In response to this:

/cherry-pick release-4.21

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[ssonigra]

/cherry-pick release-4.22

[ssonigra]

/cherry-pick release-4.21

[ssonigra]

/cherry-pick release-4.20

[openshift-cherrypick-robot]

@ssonigra: new pull request created: #10667

Details

In response to this:

/cherry-pick release-4.22

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-cherrypick-robot]

@ssonigra: new pull request created: #10668

Details

In response to this:

/cherry-pick release-4.21

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-cherrypick-robot]

@ssonigra: new pull request created: #10669

Details

In response to this:

/cherry-pick release-4.20

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.