With custom networking, authentication operator never goes healthy about cluster-ingress-operator HOT 4 CLOSED

I've confirmed that this is still an issue using v4.1.0.

from cluster-ingress-operator.

I'm continuing to debug the same problem with ovn-kubernetes. Two notes so far:

1. If you're running iptables in the root network namespace from a container, you need iptables 1.8+ running in nft mode, not legacy mode. We've decided the right way to handle this is to just mount the host's / on /host in the container and then install iptables wrapper scripts that do, eg, chroot /host iptables "$@". (qv openshift/ovn-kubernetes#10, openshift/cluster-network-operator#197). This applies only to iptables-in-the-root-network-namespace though. You can use whatever iptables binary you want for rules in pod namespaces.
2. The openshift-ingress/router-default service makes use of service.Spec.HealthCheckNodePort, which was added a few releases back and which ovn-kubernetes hadn't yet implemented. I'm not sure if Calico does any service/LoadBalancer processing on its own or if it defers that entirely to kube-proxy.

from cluster-ingress-operator.

Thanks for the pointers!

Yeah, we've already found the iptables 1.8 compat issue and have a build of Calico which is compatible.

Also, Calico is deferring entirely to kube-proxy for Service load balancing. I guess we should double check that kube-proxy is actually doing that correctly in the build we're using.

from cluster-ingress-operator.

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

from cluster-ingress-operator.