Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Security Rule creation on Azure failure #221

Closed
chidambaramgvmware opened this issue May 10, 2023 · 0 comments · Fixed by #230
Closed

Security Rule creation on Azure failure #221

chidambaramgvmware opened this issue May 10, 2023 · 0 comments · Fixed by #230

Comments

@chidambaramgvmware
Copy link

Describe the bug
Nephe unable to realize ANP on Azure due to length of Rule description exceeding the Azure limit of 140 characters

To Reproduce
Create a ANP for Azure where the combined length of rule name, namespace & rule scope exceeds 140 characters.

Expected
Nephe could abbreviate the rule description if it's longer than the cloud supported limit & proceed with Rule creation on the cloud.

Actual behavior

2023-05-10T19:56:59.329Z>-------DEBUG>--controllers.NetworkPolicy>------networkpolicy/networkpolicy.go:716>-----Updating AppliedToSecurityGroup rules for anp>--{"anp": "cloud-vm-policy-1c87f2b820236500f7da2b0277e0d9ac", "name": "proj-search-fix-fca416c6aec34674cba15d1cc3d60d8c-dev-vms-561895781aea31582680e0059500cf0e", "added": [{"Rule":{"FromPort":22,"FromSrcIP":[{"IP":"0.0.0.0","Mask":"AAAAAA=="}],"FromSecurityGroups":null,"Protocol":6},"AppliedToGrp":"proj-search-fix-fca416c6aec34674cba15d1cc3d60d8c-dev-vms-561895781aea31582680e0059500cf0e//subscriptions/58bbb0ce-e26a-4bbc-a49c-284f63c25e2e/resourcegroups/dhruver-vnet-2-rg/providers/microsoft.network/virtualnetworks/dhruver-vnet-2"},{"Rule":{"FromPort":22,"FromSrcIP":[{"IP":"::","Mask":"AAAAAA=="}],"FromSecurityGroups":null,"Protocol":6},"AppliedToGrp":"proj-search-fix-fca416c6aec34674cba15d1cc3d60d8c-dev-vms-561895781aea31582680e0059500cf0e//subscriptions/58bbb0ce-e26a-4bbc-a49c-284f63c25e2e/resourcegroups/dhruver-vnet-2-rg/providers/microsoft.network/virtualnetworks/dhruver-vnet-2"}], "removed": [], "allRules": [{"Rule":{"FromPort":22,"FromSrcIP":[{"IP":"0.0.0.0","Mask":"AAAAAA=="}],"FromSecurityGroups":null,"Protocol":6},"AppliedToGrp":"proj-search-fix-fca416c6aec34674cba15d1cc3d60d8c-dev-vms-561895781aea31582680e0059500cf0e//subscriptions/58bbb0ce-e26a-4bbc-a49c-284f63c25e2e/resourcegroups/dhruver-vnet-2-rg/providers/microsoft.network/virtualnetworks/dhruver-vnet-2"},{"Rule":{"FromPort":22,"FromSrcIP":[{"IP":"::","Mask":"AAAAAA=="}],"FromSecurityGroups":null,"Protocol":6},"AppliedToGrp":"proj-search-fix-fca416c6aec34674cba15d1cc3d60d8c-dev-vms-561895781aea31582680e0059500cf0e//subscriptions/58bbb0ce-e26a-4bbc-a49c-284f63c25e2e/resourcegroups/dhruver-vnet-2-rg/providers/microsoft.network/virtualnetworks/dhruver-vnet-2"}]}
2023-05-10T19:56:59.330Z>-------DEBUG>--azure-plugin>---azure/azure_security.go:945>----Fetching vm resources from cloud>-------{"account": "proj-search-fix-fca416c6aec34674cba15d1cc3d60d8c/58bbb0ce-e26a-4bbc-a49c-westus-a51b8973b540e19cbcc3fa0fe79f06e5", "resource-filters": "configured"}
2023-05-10T19:56:59.442Z>-------DEBUG>--azure-plugin>---azure/azure_security.go:945>----Vm instances from cloud>{"service": "COMPUTE", "account": "proj-search-fix-fca416c6aec34674cba15d1cc3d60d8c/58bbb0ce-e26a-4bbc-a49c-westus-a51b8973b540e19cbcc3fa0fe79f06e5", "instances": 2}
2023-05-10T19:56:59.646Z>-------INFO>---azure-plugin>---azure/azure_security.go:977>----Building security rules>{"applied to security group": "nephe-at-proj-search-fix-fca416c6aec34674cba15d1cc3d60d8c-dev-vms-561895781aea31582680e0059500cf0e"}
2023-05-10T19:57:00.438Z>-------DEBUG>--controllers.NetworkPolicy>------runtime/asm_amd64.s:1594>-------Updating rule realization.>-----{"NP": "cloud-vm-policy-1c87f2b820236500f7da2b0277e0d9ac", "Namespace": "proj-search-fix-fca416c6aec34674cba15d1cc3d60d8c", "err": "cannot create nsg nephe-at-default-dhruver-vnet-2, reason: PUT https://management.azure.com/subscriptions/58bbb0ce-e26a-4bbc-a49c-284f63c25e2e/resourceGroups/dhruver-vnet-2-rg/providers/Microsoft.Network/networkSecurityGroups/nephe-at-default-dhruver-vnet-2\n--------------------------------------------------------------------------------\nRESPONSE 400: 400 Bad Request\nERROR CODE: SecurityRuleDescriptionTooLong\n--------------------------------------------------------------------------------\n{\n "error": {\n "code": "SecurityRuleDescriptionTooLong",\n "message": "Security rule description cannot exceed 140 chars.",\n "details": []\n }\n}\n--------------------------------------------------------------------------------\n"}
2023-05-10T19:57:00.438Z>-------ERROR>--controllers.NetworkPolicy>------networkpolicy/controller.go:454>appliedToSecurityGroup operation failed>{"Name": "proj-search-fix-fca416c6aec34674cba15d1cc3d60d8c-dev-vms-561895781aea31582680e0059500cf0e", "Op": "UPDATE-RULES", "error": "cannot create nsg nephe-at-default-dhruver-vnet-2, reason: PUT https://management.azure.com/subscriptions/58bbb0ce-e26a-4bbc-a49c-284f63c25e2e/resourceGroups/dhruver-vnet-2-rg/providers/Microsoft.Network/networkSecurityGroups/nephe-at-default-dhruver-vnet-2\n--------------------------------------------------------------------------------\nRESPONSE 400: 400 Bad Request\nERROR CODE: SecurityRuleDescriptionTooLong\n--------------------------------------------------------------------------------\n{\n "error": {\n "code": "SecurityRuleDescriptionTooLong",\n "message": "Security rule description cannot exceed 140 chars.",\n "details": []\n }\n}\n--------------------------------------------------------------------------------\n"}
antrea.io/nephe/pkg/controllers/networkpolicy.(*NetworkPolicyReconciler).processCloudResponse

-------/usr/src/antrea.io/nephe/pkg/controllers/networkpolicy/controller.go:454
antrea.io/nephe/pkg/controllers/networkpolicy.(*NetworkPolicyReconciler).Start
-------/usr/src/antrea.io/nephe/pkg/controllers/networkpolicy/controller.go:532
sigs.k8s.io/controller-runtime/pkg/manager.(*runnableGroup).reconcile.func1
-------/tmp/gopath/pkg/mod/sigs.k8s.io/[email protected]/pkg/manager/runnable_group.go:219

Versions:
ToT and I believe the issue started after this fix ec6015a#diff-9a50218bc68ee339f228f800d6c6ba4c3b745e88e1d453d242a3cbb93ec68e06

Additional context

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant