docs/stable/advance/security-group/

[giscus[bot]]

docs/stable/advance/security-group/

None

https://kubeovn.github.io/docs/stable/advance/security-group/

[QEDQCD]

现象
创建绑定安全组的pod报错
Failed to create pod sandbox: rpc error: code = Unknown desc = failed to setup network for sandbox "": plugin type="kube-ovn" failed (add): RPC failed; request ip return 500 configure nic eth0 for pod failed: gateway check of 10.0.0.1 canceled after 6 retries

安全组配置
cat sg.yaml
apiVersion: kubeovn.io/v1
kind: SecurityGroup
metadata:
name: sg-test
spec:
allowSameGroupTraffic: true
egressRules:

• ipVersion: ipv4
  policy: allow
  priority: 1
  protocol: all
  remoteAddress: 0.0.0.0/0
  remoteType: address
  ingressRules:
• ipVersion: ipv4
  policy: allow
  priority: 1
  protocol: all
  remoteAddress: 0.0.0.0/0
  remoteType: address

pod配置
cat pod.yaml
apiVersion: v1
kind: Pod
metadata:
labels:
app: static
annotations:
ovn.kubernetes.io/port_security: 'true'
ovn.kubernetes.io/security_groups: 'sg-test'
name: sg-pod
namespace: default
spec:
nodeName: worker-1
containers:

• image: docker.io/library/nginx:alpine
  imagePullPolicy: IfNotPresent
  command: ["sleep"]
  args: ["infinity"]
  name: test

关键点：当pod关联的subnet 网关检查配置关闭时不出现该问题
disableGatewayCheck: true
网关检查配置开启时 disableGatewayCheck: false时出现该问题