Add option to enable port security by default for networks #418
Labels
area/networking
Networking related
kind/enhancement
Enhancement, improvement, extension
lifecycle/rotten
Nobody worked on this for 12 months (final aging stage)
platform/openstack
OpenStack platform/infrastructure
How to categorize this issue?
/area networking
/kind enhancement
/platform openstack
What would you like to be added:
A configuration option to enable the port security group setting on network creation, so ports that are created have port security enabled by default.
Why is this needed:
Some openstack providers require port security to be enabled for VM ports. When Gardener tries to create a VM port without port security it results in the following error:
"error":"Error while waiting for Worker shoot--garden--openstack-seed/openstack-seed to become ready: error during reconciliation: Error reconciling worker: Failed while waiting for all machine deployments to be ready: 'machine(s) failed: 1 error occurred: \"shoot--garden--openstack-seed-cpu-worker-z1-65978-wkphc\": Cloud provider message - machine codes error: code = [Internal] message = [failed to resolve server [Name=\"shoot--garden--openstack-seed-cpu-worker-z1-65978-wkphc\"] networks: Expected HTTP response code [201 202] when accessing [POST https://network.compute.gra9.cloud.ovh.net/v2.0/ports], but got 409 instead\n{\"NeutronError\": {\"type\": \"AddressPairAndPortSecurityRequired\", \"message\": \"Port Security must be enabled in order to have allowed address pairs on a port.\", \"detail\": \"\"}}]'","flow":"Shoot cluster reconciliation","level":"error","msg":"Error","operation":"reconcile","shoot":"garden/openstack-seed","task":"Waiting until shoot worker nodes have been reconciled","ts":"2022-03-11T14:57:59.349Z"}
As a workaround we've manually adjusted the shoot network to enable port security by default:
openstack network set shoot--garden--openstack-seed --enable-port-security
The text was updated successfully, but these errors were encountered: