Skip to content

[BUG] /usr/share/openvswitch/scripts/ovs-ctl --protocol=udp --dport=6081 enable-protocol * cannot list iptables rules, not adding a rule for udp to port 6081 #5082

Open
@zbb88888

Description

@zbb88888

Kube-OVN Version

master

Kubernetes Version

? k get node -A -o wide
NAME     STATUS   ROLES                  AGE   VERSION   INTERNAL-IP     EXTERNAL-IP   OS-IMAGE                         KERNEL-VERSION   CONTAINER-RUNTIME
debian   Ready    control-plane,worker   12m   v1.29.7   192.168.0.105   <none>        Debian GNU/Linux 12 (bookworm)   6.1.0-31-amd64   containerd://1.7.25


▶ kgp | grep ovn
kube-system   kube-ovn-cni-sxmkt                     0/1     CrashLoopBackOff    9 (105s ago)    19m   192.168.0.105   debian   <none>           <none>
kube-system   kube-ovn-controller-849978f465-jptd8   0/1     Running             3 (2m41s ago)   19m   192.168.0.105   debian   <none>           <none>
kube-system   kube-ovn-monitor-55b9fc7d44-7bpfd      0/1     CrashLoopBackOff    9 (105s ago)    19m   192.168.0.105   debian   <none>           <none>
kube-system   kube-ovn-pinger-vqb8d                  0/1     Init:0/1            0               19m   <none>          debian   <none>           <none>
kube-system   ovn-central-85cb445c7c-xmt7r           1/1     Running             0               19m   192.168.0.105   debian   <none>           <none>
kube-system   ovs-ovn-tdvfc                          1/1     Running             1 (9m53s ago)   19m   192.168.0.105   debian   <none>           <none>
(v.v) 
root@debian:~      

Operation-system/Kernel Version

▶ uname -a
Linux debian 6.1.0-31-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.128-1 (2025-02-07) x86_64 GNU/Linux

Description

▶ k logs -f -n kube-system   kube-ovn-cni-sxmkt
Defaulted container "cni-server" out of: cni-server, hostpath-init (init), install-cni (init)
ovsdb-server is running with pid 40570
ovs-vswitchd is running with pid 40636
iptables v1.8.10 (legacy)
I0315 11:33:04.840350   49758 cniserver.go:33] 
-------------------------------------------------------------------------------
Kube-OVN: 
  Version:       v1.14.0
  Build:         2025-01-17_09:27:58
  Commit:        git-6b9c900
  Go Version:    go1.23.5
  Arch:          amd64
-------------------------------------------------------------------------------
I0315 11:33:04.840522   49758 init.go:17] current capabilities: cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_admin,cap_net_raw,cap_sys_chroot,cap_sys_ptrace,cap_sys_admin,cap_sys_nice,cap_mknod,cap_audit_write,cap_setfcap=ep
I0315 11:33:04.842726   49758 config.go:185] node name not specified in command line parameters, fall back to the environment variable
I0315 11:33:04.842732   49758 config.go:364] no --kubeconfig, use in-cluster kubernetes config
I0315 11:33:04.845276   49758 k8s.go:48] succeeded to dial host "https://10.96.0.1:443"
I0315 11:33:04.854041   49758 config.go:205] daemon config: &{false /etc/cni/net.d /kube-ovn/01-kube-ovn.conflist 01-kube-ovn.conflist  wlo1 br-phy 1450 1410 false mirror0 /run/openvswitch/kube-ovn-daemon.sock /run/openvswitch/db.sock  0xc000684c40 0xc00060d270 debian 10.96.0.0/12 ovn-cluster join true false false 10665 false vxlan provider  kube-system external true false true /var/lib/kubelet false 8100 8101 false 100 false}
I0315 11:33:04.856526   49758 ovs.go:138] nic mirror0 exist, configure it
I0315 11:33:04.863548   49758 cniserver.go:63] init node gw
I0315 11:33:04.869504   49758 ovs_linux.go:674] wait ovn0 gw ready
W0315 11:33:07.870558   49758 ovs.go:35] 100.64.0.2 network not ready after 3 ping to gateway 100.64.0.1
W0315 11:33:10.869769   49758 ovs.go:35] 100.64.0.2 network not ready after 6 ping to gateway 100.64.0.1
W0315 11:33:13.869780   49758 ovs.go:35] 100.64.0.2 network not ready after 9 ping to gateway 100.64.0.1
W0315 11:33:16.870660   49758 ovs.go:35] 100.64.0.2 network not ready after 12 ping to gateway 100.64.0.1
W0315 11:33:19.870141   49758 ovs.go:35] 100.64.0.2 network not ready after 15 ping to gateway 100.64.0.1
W0315 11:33:22.870908   49758 ovs.go:35] 100.64.0.2 network not ready after 18 ping to gateway 100.64.0.1
W0315 11:33:25.870872   49758 ovs.go:35] 100.64.0.2 network not ready after 21 ping to gateway 100.64.0.1
W0315 11:33:28.870572   49758 ovs.go:35] 100.64.0.2 network not ready after 24 ping to gateway 100.64.0.1
W0315 11:33:31.870282   49758 ovs.go:35] 100.64.0.2 network not ready after 27 ping to gateway 100.64.0.1
W0315 11:33:34.870090   49758 ovs.go:35] 100.64.0.2 network not ready after 30 ping to gateway 100.64.0.1
W0315 11:33:37.870331   49758 ovs.go:35] 100.64.0.2 network not ready after 33 ping to gateway 100.64.0.1
W0315 11:33:40.869780   49758 ovs.go:35] 100.64.0.2 network not ready after 36 ping to gateway 100.64.0.1
W0315 11:33:43.870110   49758 ovs.go:35] 100.64.0.2 network not ready after 39 ping to gateway 100.64.0.1
W0315 11:33:46.870507   49758 ovs.go:35] 100.64.0.2 network not ready after 42 ping to gateway 100.64.0.1
W0315 11:33:49.870206   49758 ovs.go:35] 100.64.0.2 network not ready after 45 ping to gateway 100.64.0.1
W0315 11:33:52.870310   49758 ovs.go:35] 100.64.0.2 network not ready after 48 ping to gateway 100.64.0.1
(v.v) 

▶ k exec -it -n kube-system   ovs-ovn-tdvfc    -- bash
Defaulted container "openvswitch" out of: openvswitch, hostpath-init (init)
nobody@debian:/kube-ovn$ 
nobody@debian:/kube-ovn$ 
nobody@debian:/kube-ovn$ bash -x /kube-ovn/start-ovs.sh

...
+ /usr/share/openvswitch/scripts/ovs-ctl --protocol=udp --dport=6081 enable-protocol
 * cannot list iptables rules, not adding a rule for udp to port 6081

...

Steps To Reproduce

diff --git a/dist/images/install.sh b/dist/images/install.sh
index 2db55c781..91c9483f7 100755
--- a/dist/images/install.sh
+++ b/dist/images/install.sh
@@ -98,7 +98,7 @@ EXCLUDE_IPS=""                                    # EXCLUDE_IPS for default subn
 LABEL="node-role.kubernetes.io/control-plane"     # The node label to deploy OVN DB
 DEPRECATED_LABEL="node-role.kubernetes.io/master" # The node label to deploy OVN DB in earlier versions
 NETWORK_TYPE="geneve"                             # geneve or vlan
-TUNNEL_TYPE="geneve"                              # geneve, vxlan or stt. ATTENTION: some networkpolicy cannot take effect when using vxlan and stt need custom compile ovs kernel module
+TUNNEL_TYPE="vxlan"  
  1. kk create cluster: no cni
  2. bash -x install.sh: run kube-ovn cni

Current Behavior

tunnel not setup

root@debian:~                                                                                                                                                                                                                ⍉
▶ ip a | grep 6081 
(v.v) 
root@debian:~   

Expected Behavior

tunnel should setup

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions