ACS Advance with Security Group, IPTable not write to Host #4351
Description
ISSUE TYPE
- Bug Report
Advance Security Security Group
Configure Security Group Advance in AdvanceZone
CLOUDSTACK VERSION - 4.14
Cloudstack 4.14
CONFIGURATION
Advance Networking, with Security Group, on KVM
OS / ENVIRONMENT
CentOS Linux release 7.8.2003 (Core)
SUMMARY
STEPS TO REPRODUCE
Create Zone with Advance with Security Group, KVM HyperVisor
Create VM , and apply the Default Security Group.
Add on following in HyperVisor Host:
modprobe br_netfilter
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-arptables = 1
The Security Group Rules is not apply to HyperVisor
EXPECTED RESULTS
Default Ingress Rules (inboud) shall be Drop, except define in Allow Rules .
ACTUAL RESULTS
iptables is rules not generated in hypervisors , Log show:
2020-09-28 04:49:27,142 ERROR [kvm.resource.LibvirtComputingResource] (agentRequest-Handler-3:null) (logid:689bce0a) Unable to apply default network rule for nic cloudbr0 for VM i-2-81-VM
2020-09-28 04:49:27,312 ERROR [kvm.resource.LibvirtComputingResource] (agentRequest-Handler-4:null) (logid:52809b79) Unable to apply default network rule for nic cloudbr0 for VM i-2-81-VM
2020-09-28 04:49:27,312 WARN [resource.wrapper.LibvirtSecurityGroupRulesCommandWrapper] (agentRequest-Handler-4:null) (logid:52809b79) Failed to program default network rules for vm i-2-81-VM