We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Describe the bug Nephe unable to realize ANP on Azure due to length of Rule description exceeding the Azure limit of 140 characters
To Reproduce Create a ANP for Azure where the combined length of rule name, namespace & rule scope exceeds 140 characters.
Expected Nephe could abbreviate the rule description if it's longer than the cloud supported limit & proceed with Rule creation on the cloud.
Actual behavior
2023-05-10T19:56:59.329Z>-------DEBUG>--controllers.NetworkPolicy>------networkpolicy/networkpolicy.go:716>-----Updating AppliedToSecurityGroup rules for anp>--{"anp": "cloud-vm-policy-1c87f2b820236500f7da2b0277e0d9ac", "name": "proj-search-fix-fca416c6aec34674cba15d1cc3d60d8c-dev-vms-561895781aea31582680e0059500cf0e", "added": [{"Rule":{"FromPort":22,"FromSrcIP":[{"IP":"0.0.0.0","Mask":"AAAAAA=="}],"FromSecurityGroups":null,"Protocol":6},"AppliedToGrp":"proj-search-fix-fca416c6aec34674cba15d1cc3d60d8c-dev-vms-561895781aea31582680e0059500cf0e//subscriptions/58bbb0ce-e26a-4bbc-a49c-284f63c25e2e/resourcegroups/dhruver-vnet-2-rg/providers/microsoft.network/virtualnetworks/dhruver-vnet-2"},{"Rule":{"FromPort":22,"FromSrcIP":[{"IP":"::","Mask":"AAAAAA=="}],"FromSecurityGroups":null,"Protocol":6},"AppliedToGrp":"proj-search-fix-fca416c6aec34674cba15d1cc3d60d8c-dev-vms-561895781aea31582680e0059500cf0e//subscriptions/58bbb0ce-e26a-4bbc-a49c-284f63c25e2e/resourcegroups/dhruver-vnet-2-rg/providers/microsoft.network/virtualnetworks/dhruver-vnet-2"}], "removed": [], "allRules": [{"Rule":{"FromPort":22,"FromSrcIP":[{"IP":"0.0.0.0","Mask":"AAAAAA=="}],"FromSecurityGroups":null,"Protocol":6},"AppliedToGrp":"proj-search-fix-fca416c6aec34674cba15d1cc3d60d8c-dev-vms-561895781aea31582680e0059500cf0e//subscriptions/58bbb0ce-e26a-4bbc-a49c-284f63c25e2e/resourcegroups/dhruver-vnet-2-rg/providers/microsoft.network/virtualnetworks/dhruver-vnet-2"},{"Rule":{"FromPort":22,"FromSrcIP":[{"IP":"::","Mask":"AAAAAA=="}],"FromSecurityGroups":null,"Protocol":6},"AppliedToGrp":"proj-search-fix-fca416c6aec34674cba15d1cc3d60d8c-dev-vms-561895781aea31582680e0059500cf0e//subscriptions/58bbb0ce-e26a-4bbc-a49c-284f63c25e2e/resourcegroups/dhruver-vnet-2-rg/providers/microsoft.network/virtualnetworks/dhruver-vnet-2"}]} 2023-05-10T19:56:59.330Z>-------DEBUG>--azure-plugin>---azure/azure_security.go:945>----Fetching vm resources from cloud>-------{"account": "proj-search-fix-fca416c6aec34674cba15d1cc3d60d8c/58bbb0ce-e26a-4bbc-a49c-westus-a51b8973b540e19cbcc3fa0fe79f06e5", "resource-filters": "configured"} 2023-05-10T19:56:59.442Z>-------DEBUG>--azure-plugin>---azure/azure_security.go:945>----Vm instances from cloud>{"service": "COMPUTE", "account": "proj-search-fix-fca416c6aec34674cba15d1cc3d60d8c/58bbb0ce-e26a-4bbc-a49c-westus-a51b8973b540e19cbcc3fa0fe79f06e5", "instances": 2} 2023-05-10T19:56:59.646Z>-------INFO>---azure-plugin>---azure/azure_security.go:977>----Building security rules>{"applied to security group": "nephe-at-proj-search-fix-fca416c6aec34674cba15d1cc3d60d8c-dev-vms-561895781aea31582680e0059500cf0e"} 2023-05-10T19:57:00.438Z>-------DEBUG>--controllers.NetworkPolicy>------runtime/asm_amd64.s:1594>-------Updating rule realization.>-----{"NP": "cloud-vm-policy-1c87f2b820236500f7da2b0277e0d9ac", "Namespace": "proj-search-fix-fca416c6aec34674cba15d1cc3d60d8c", "err": "cannot create nsg nephe-at-default-dhruver-vnet-2, reason: PUT https://management.azure.com/subscriptions/58bbb0ce-e26a-4bbc-a49c-284f63c25e2e/resourceGroups/dhruver-vnet-2-rg/providers/Microsoft.Network/networkSecurityGroups/nephe-at-default-dhruver-vnet-2\n--------------------------------------------------------------------------------\nRESPONSE 400: 400 Bad Request\nERROR CODE: SecurityRuleDescriptionTooLong\n--------------------------------------------------------------------------------\n{\n "error": {\n "code": "SecurityRuleDescriptionTooLong",\n "message": "Security rule description cannot exceed 140 chars.",\n "details": []\n }\n}\n--------------------------------------------------------------------------------\n"} 2023-05-10T19:57:00.438Z>-------ERROR>--controllers.NetworkPolicy>------networkpolicy/controller.go:454>appliedToSecurityGroup operation failed>{"Name": "proj-search-fix-fca416c6aec34674cba15d1cc3d60d8c-dev-vms-561895781aea31582680e0059500cf0e", "Op": "UPDATE-RULES", "error": "cannot create nsg nephe-at-default-dhruver-vnet-2, reason: PUT https://management.azure.com/subscriptions/58bbb0ce-e26a-4bbc-a49c-284f63c25e2e/resourceGroups/dhruver-vnet-2-rg/providers/Microsoft.Network/networkSecurityGroups/nephe-at-default-dhruver-vnet-2\n--------------------------------------------------------------------------------\nRESPONSE 400: 400 Bad Request\nERROR CODE: SecurityRuleDescriptionTooLong\n--------------------------------------------------------------------------------\n{\n "error": {\n "code": "SecurityRuleDescriptionTooLong",\n "message": "Security rule description cannot exceed 140 chars.",\n "details": []\n }\n}\n--------------------------------------------------------------------------------\n"} antrea.io/nephe/pkg/controllers/networkpolicy.(*NetworkPolicyReconciler).processCloudResponse
-------/usr/src/antrea.io/nephe/pkg/controllers/networkpolicy/controller.go:454 antrea.io/nephe/pkg/controllers/networkpolicy.(*NetworkPolicyReconciler).Start -------/usr/src/antrea.io/nephe/pkg/controllers/networkpolicy/controller.go:532 sigs.k8s.io/controller-runtime/pkg/manager.(*runnableGroup).reconcile.func1 -------/tmp/gopath/pkg/mod/sigs.k8s.io/[email protected]/pkg/manager/runnable_group.go:219
Versions: ToT and I believe the issue started after this fix ec6015a#diff-9a50218bc68ee339f228f800d6c6ba4c3b745e88e1d453d242a3cbb93ec68e06
Additional context
The text was updated successfully, but these errors were encountered:
Successfully merging a pull request may close this issue.
Describe the bug
Nephe unable to realize ANP on Azure due to length of Rule description exceeding the Azure limit of 140 characters
To Reproduce
Create a ANP for Azure where the combined length of rule name, namespace & rule scope exceeds 140 characters.
Expected
Nephe could abbreviate the rule description if it's longer than the cloud supported limit & proceed with Rule creation on the cloud.
Actual behavior
2023-05-10T19:56:59.329Z>-------DEBUG>--controllers.NetworkPolicy>------networkpolicy/networkpolicy.go:716>-----Updating AppliedToSecurityGroup rules for anp>--{"anp": "cloud-vm-policy-1c87f2b820236500f7da2b0277e0d9ac", "name": "proj-search-fix-fca416c6aec34674cba15d1cc3d60d8c-dev-vms-561895781aea31582680e0059500cf0e", "added": [{"Rule":{"FromPort":22,"FromSrcIP":[{"IP":"0.0.0.0","Mask":"AAAAAA=="}],"FromSecurityGroups":null,"Protocol":6},"AppliedToGrp":"proj-search-fix-fca416c6aec34674cba15d1cc3d60d8c-dev-vms-561895781aea31582680e0059500cf0e//subscriptions/58bbb0ce-e26a-4bbc-a49c-284f63c25e2e/resourcegroups/dhruver-vnet-2-rg/providers/microsoft.network/virtualnetworks/dhruver-vnet-2"},{"Rule":{"FromPort":22,"FromSrcIP":[{"IP":"::","Mask":"AAAAAA=="}],"FromSecurityGroups":null,"Protocol":6},"AppliedToGrp":"proj-search-fix-fca416c6aec34674cba15d1cc3d60d8c-dev-vms-561895781aea31582680e0059500cf0e//subscriptions/58bbb0ce-e26a-4bbc-a49c-284f63c25e2e/resourcegroups/dhruver-vnet-2-rg/providers/microsoft.network/virtualnetworks/dhruver-vnet-2"}], "removed": [], "allRules": [{"Rule":{"FromPort":22,"FromSrcIP":[{"IP":"0.0.0.0","Mask":"AAAAAA=="}],"FromSecurityGroups":null,"Protocol":6},"AppliedToGrp":"proj-search-fix-fca416c6aec34674cba15d1cc3d60d8c-dev-vms-561895781aea31582680e0059500cf0e//subscriptions/58bbb0ce-e26a-4bbc-a49c-284f63c25e2e/resourcegroups/dhruver-vnet-2-rg/providers/microsoft.network/virtualnetworks/dhruver-vnet-2"},{"Rule":{"FromPort":22,"FromSrcIP":[{"IP":"::","Mask":"AAAAAA=="}],"FromSecurityGroups":null,"Protocol":6},"AppliedToGrp":"proj-search-fix-fca416c6aec34674cba15d1cc3d60d8c-dev-vms-561895781aea31582680e0059500cf0e//subscriptions/58bbb0ce-e26a-4bbc-a49c-284f63c25e2e/resourcegroups/dhruver-vnet-2-rg/providers/microsoft.network/virtualnetworks/dhruver-vnet-2"}]}
2023-05-10T19:56:59.330Z>-------DEBUG>--azure-plugin>---azure/azure_security.go:945>----Fetching vm resources from cloud>-------{"account": "proj-search-fix-fca416c6aec34674cba15d1cc3d60d8c/58bbb0ce-e26a-4bbc-a49c-westus-a51b8973b540e19cbcc3fa0fe79f06e5", "resource-filters": "configured"}
2023-05-10T19:56:59.442Z>-------DEBUG>--azure-plugin>---azure/azure_security.go:945>----Vm instances from cloud>{"service": "COMPUTE", "account": "proj-search-fix-fca416c6aec34674cba15d1cc3d60d8c/58bbb0ce-e26a-4bbc-a49c-westus-a51b8973b540e19cbcc3fa0fe79f06e5", "instances": 2}
2023-05-10T19:56:59.646Z>-------INFO>---azure-plugin>---azure/azure_security.go:977>----Building security rules>{"applied to security group": "nephe-at-proj-search-fix-fca416c6aec34674cba15d1cc3d60d8c-dev-vms-561895781aea31582680e0059500cf0e"}
2023-05-10T19:57:00.438Z>-------DEBUG>--controllers.NetworkPolicy>------runtime/asm_amd64.s:1594>-------Updating rule realization.>-----{"NP": "cloud-vm-policy-1c87f2b820236500f7da2b0277e0d9ac", "Namespace": "proj-search-fix-fca416c6aec34674cba15d1cc3d60d8c", "err": "cannot create nsg nephe-at-default-dhruver-vnet-2, reason: PUT https://management.azure.com/subscriptions/58bbb0ce-e26a-4bbc-a49c-284f63c25e2e/resourceGroups/dhruver-vnet-2-rg/providers/Microsoft.Network/networkSecurityGroups/nephe-at-default-dhruver-vnet-2\n--------------------------------------------------------------------------------\nRESPONSE 400: 400 Bad Request\nERROR CODE: SecurityRuleDescriptionTooLong\n--------------------------------------------------------------------------------\n{\n "error": {\n "code": "SecurityRuleDescriptionTooLong",\n "message": "Security rule description cannot exceed 140 chars.",\n "details": []\n }\n}\n--------------------------------------------------------------------------------\n"}
2023-05-10T19:57:00.438Z>-------ERROR>--controllers.NetworkPolicy>------networkpolicy/controller.go:454>appliedToSecurityGroup operation failed>{"Name": "proj-search-fix-fca416c6aec34674cba15d1cc3d60d8c-dev-vms-561895781aea31582680e0059500cf0e", "Op": "UPDATE-RULES", "error": "cannot create nsg nephe-at-default-dhruver-vnet-2, reason: PUT https://management.azure.com/subscriptions/58bbb0ce-e26a-4bbc-a49c-284f63c25e2e/resourceGroups/dhruver-vnet-2-rg/providers/Microsoft.Network/networkSecurityGroups/nephe-at-default-dhruver-vnet-2\n--------------------------------------------------------------------------------\nRESPONSE 400: 400 Bad Request\nERROR CODE: SecurityRuleDescriptionTooLong\n--------------------------------------------------------------------------------\n{\n "error": {\n "code": "SecurityRuleDescriptionTooLong",\n "message": "Security rule description cannot exceed 140 chars.",\n "details": []\n }\n}\n--------------------------------------------------------------------------------\n"}
antrea.io/nephe/pkg/controllers/networkpolicy.(*NetworkPolicyReconciler).processCloudResponse
Versions:
ToT and I believe the issue started after this fix ec6015a#diff-9a50218bc68ee339f228f800d6c6ba4c3b745e88e1d453d242a3cbb93ec68e06
Additional context
The text was updated successfully, but these errors were encountered: