From 0c5c99fd0dc6d2a1c12e594cbef39d4eda4cdb76 Mon Sep 17 00:00:00 2001 From: "Madhusudan.C.S" Date: Tue, 22 Nov 2016 12:55:25 -0800 Subject: [PATCH] Document the workaround for the Federated Ingress flapping healthchecks problem. Ref issue: https://github.com/kubernetes/kubernetes/issues/36327 and https://github.com/kubernetes/kubernetes/issues/37306 --- .../federation/federated-ingress.md | 32 +++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/docs/user-guide/federation/federated-ingress.md b/docs/user-guide/federation/federated-ingress.md index 87965a3fc7..bd45316883 100644 --- a/docs/user-guide/federation/federated-ingress.md +++ b/docs/user-guide/federation/federated-ingress.md @@ -229,6 +229,38 @@ kept running, the Federated Ingress ensures that user traffic is automatically redirected away from the failed cluster to other available clusters. +## Known issue + +GCE L7 load balancer backends and healthchecks are known to flap due +to the firewall rules from the underlying clusters in federation +clobbering each other. In order to workaround this problem, you can +install the firewall rules manually to expose the targets of all the +underlying clusters in your federation for each Federated Ingress +object so that the health checks can pass and GCE L7 load balancer +is stable. This can be done using the `gcloud` command line tool as follows: + +```shell +gcloud compute firewall-rules create \ + --source-ranges 130.211.0.0/22 --allow [] \ + --target-tags [] \ + --network +``` + +where: +1. `firewall-rule-name` can be any name. +2. `[]` is the comma separated list of node ports corresponding to the services that backs the Federated Ingress. +3. [] is the comma separated list of the target tags assigned to the nodes in a kubernetes cluster. +4. is the name of the network where the firewall rule must be installed. + +Example: +```shell +gcloud compute firewall-rules create my-federated-ingress-firewall-rule \ + --source-ranges 130.211.0.0/22 --allow tcp:30301, tcp:30061, tcp:34564 \ + --target-tags my-cluster-1-minion, my-cluster-2-minion \ + --network default +``` + + ## Troubleshooting #### I cannot connect to my cluster federation API