Install OKD 4.8 on GCP

[llomgui]

Hello,

I'm trying to install a cluster on GCP using the last version 4.8. 2021-10-10.

I can't get my api healthcheck green on bootstrap node.
So the masters can't access to api-int:6443 url.

It looks like something is trying to get iptables updated but get a denied.

[ 4281.476551] audit: type=1400 audit(1634142821.537:958): avc:  denied  { ioctl } for  pid=28838 comm="ip6tables" path="/sys/fs/cgroup" dev="tmpfs" ino=1 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:cgroup_t:s0 tclass=dir permissive=0
[ 4281.500215] audit: type=1300 audit(1634142821.537:958): arch=c000003e syscall=59 success=yes exit=0 a0=c000e18600 a1=c0017ce8c0 a2=c0003fc300 a3=8 items=0 ppid=1278 pid=28838 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ip6tables" exe="/usr/sbin/xtables-legacy-multi" subj=system_u:system_r:iptables_t:s0 key=(null)
[ 4281.534146] audit: type=1309 audit(1634142821.537:958): argc=9 a0="ip6tables" a1="-w" a2="5" a3="-W" a4="100000" a5="-S" a6="KUBE-KUBELET-CANARY" a7="-t" a8="mangle"
[ 4281.549691] audit: type=1327 audit(1634142821.537:958): proctitle=6970367461626C6573002D770035002D5700313030303030002D53004B5542452D4B5542454C45542D43414E415259002D74006D616E676C65

[vrutkovs]

Please attach log bundle

[llomgui]

Hello @vrutkovs,

After checkings logs, in crio's journal, I get this error: "Failed to get system container stats" err="failed to get cgroup stats for \"/system.slice/kubelet.service\": failed to get container info for \"/system.slice/kubelet.service\": unknown container \"/system.slice/kubelet.service\"" containerName="/system.slice/kubelet.service"

Looks like it's something known: kubernetes/kubernetes#56850

Do I have do something for GCP's image?

[vrutkovs]

There is no "GCP image"

[llomgui]

Do you need more logs?
Did you try to install a cluster on GCP?

[vrutkovs]

Do you need more logs?

yes, a log bundle would be useful

Did you try to install a cluster on GCP?

We regularly test it in CI, for instance this job

[llomgui]

log-bundle.txt

Tell me if you need more @vrutkovs

[vrutkovs]

https://docs.okd.io/latest/installing/installing-troubleshooting.html#installation-bootstrap-gather_installing-troubleshooting

[llomgui]

@vrutkovs After some research and tcpdump...

4:24:40.444897 IP 35.191.9.91.38462 > 10.69.34.100.6443: Flags [S], seq 271133179, win 65535, options [mss 1420,sackOK,TS val 36362080 ecr 0,nop,wscale 8], length 0
14:24:40.464864 IP 35.191.0.27.59598 > 10.69.34.100.6443: Flags [S], seq 142091114, win 65535, options [mss 1420,sackOK,TS val 2028524283 ecr 0,nop,wscale 8], length 0
14:24:40.478777 IP 35.191.0.31.33284 > 10.69.34.100.6443: Flags [S], seq 2739842009, win 65535, options [mss 1420,sackOK,TS val 3807221964 ecr 0,nop,wscale 8], length 0

I have the same issue as before, routes are not proprely installed in masters and workers.

#733

[vrutkovs]

Right, we included the wrong commit of openshift-os, so gcp-routes files were missing.

Please check if its fixed in 4.8.0-0.okd-2021-10-24-061736, installation in CI passed

[llomgui]

Thank you, I will try a new installation today.

[llomgui]

@vrutkovs The installation is working, thank you for this release!

[vrutkovs]

Perfect, thanks!