mw-0 opened a new issue, #14409:
URL: https://github.com/apache/cloudstack/issues/14409
### problem
When a CKS cluster deployed on a VPC tier is deleted, CKS revokes all TCP
allow rules for ports 6443 and 22 in the tier's network ACL list, not only
the rules it created for that cluster. Other clusters using tiers with the
same ACL list lose their rules.
#### Impact
- SSH port forwards (2222+ → 22) to cluster B's nodes are blocked by the
ACL, so operations that SSH to the nodes (e.g. scaling) fail unless
another rule allows TCP 22.
- On a conserve-mode tier the API (6443) stays reachable, because it is
behind the VPC router load balancer, which the tier ACL does not filter.
- On a non-conserve tier the API is a port forward, so it would also become
unreachable.
- Stopping and starting cluster B does not recreate the missing rules, so
the cluster cannot recover without manual ACL changes.
### versions
4.23 with KVM
### The steps to reproduce the bug
1. Create a VPC with a custom ACL list and assign it to two tiers.
2. Deploy a CKS cluster on each tier (cluster A and cluster B).
3. Note the ACL list contains a 6443 and a 22 allow rule for each cluster.
4. Delete cluster A.
#### Expected
Only cluster A's ACL rules are removed.
#### Actual
All CKS-created 6443 and 22 allow rules are removed, including cluster B's.
A manually created TCP 22 rule (created via the UI) was not removed.
Cluster B's public IP, port forwards and load balancer rule are unaffected.
### What to do about it?
- Should CKS track the ACL rules it creates per cluster (e.g. in cluster
details) and only remove those, or check whether other clusters still
need a rule before removing it?
- Should starting a stopped cluster verify and recreate missing network
rules?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
