Tracing Openflow with ovnkube-trace

OVN and OVS traffic flows can be simulated in a single utility called ovnkube-trace. The ovnkube-trace utility runs ovn-trace, ovs-appctl ofproto/trace and ovn-detrace and correlates that information in a single output.

You can execute the ovnkube-trace binary from a dedicated container. For releases after OKD 4.7, you can also copy the binary to a local host and execute it from that host.

Installing the ovnkube-trace on local host

The ovnkube-trace tool traces packet simulations for arbitrary UDP or TCP traffic between points in an OVN-Kubernetes driven OKD cluster. Copy the ovnkube-trace binary to your local host making it available to run against the cluster.

Prerequisites

  • You installed the OpenShift CLI (oc).

  • You are logged in to the cluster with a user with cluster-admin privileges.

Procedure

  1. Create a pod variable by using the following command:

    1. $  POD=$(oc get pods -n openshift-ovn-kubernetes -l app=ovnkube-control-plane -o name | head -1 | awk -F '/' '{print $NF}')

  2. Run the following command on your local host to copy the binary from the ovnkube-control-plane pods:

    1. $  oc cp -n openshift-ovn-kubernetes $POD:/usr/bin/ovnkube-trace -c ovnkube-cluster-manager ovnkube-trace

    If you are using Fedora 8 to run the ovnkube-trace tool, you must copy the file /usr/lib/rhel8/ovnkube-trace to your local host.

  3. Make ovnkube-trace executable by running the following command:

    1. $  chmod +x ovnkube-trace

  4. Display the options available with ovnkube-trace by running the following command:

    1. $  ./ovnkube-trace -help

    Expected output

    1. Usage of ./ovnkube-trace:
    2.   -addr-family string
    3.         Address family (ip4 or ip6) to be used for tracing (default "ip4")
    4.   -dst string
    5.         dest: destination pod name
    6.   -dst-ip string
    7.         destination IP address (meant for tests to external targets)
    8.   -dst-namespace string
    9.         k8s namespace of dest pod (default "default")
    10.   -dst-port string
    11.         dst-port: destination port (default "80")
    12.   -kubeconfig string
    13.         absolute path to the kubeconfig file
    14.   -loglevel string
    15.         loglevel: klog level (default "0")
    16.   -ovn-config-namespace string
    17.         namespace used by ovn-config itself
    18.   -service string
    19.         service: destination service name
    20.   -skip-detrace
    21.         skip ovn-detrace command
    22.   -src string
    23.         src: source pod name
    24.   -src-namespace string
    25.         k8s namespace of source pod (default "default")
    26.   -tcp
    27.         use tcp transport protocol
    28.   -udp
    29.         use udp transport protocol

    The command-line arguments supported are familiar Kubernetes constructs, such as namespaces, pods, services so you do not need to find the MAC address, the IP address of the destination nodes, or the ICMP type.

    The log levels are:

    • 0 (minimal output)

    • 2 (more verbose output showing results of trace commands)

    • 5 (debug output)

Running ovnkube-trace

Run ovn-trace to simulate packet forwarding within an OVN logical network.

Prerequisites

  • You installed the OpenShift CLI (oc).

  • You are logged in to the cluster with a user with cluster-admin privileges.

  • You have installed ovnkube-trace on local host

Example: Testing that DNS resolution works from a deployed pod

This example illustrates how to test the DNS resolution from a deployed pod to the core DNS pod that runs in the cluster.

Procedure

  1. Start a web service in the default namespace by entering the following command:

    1. $ oc run web --namespace=default --image=quay.io/openshifttest/nginx --labels="app=web" --expose --port=80

  2. List the pods running in the openshift-dns namespace:

    1. oc get pods -n openshift-dns

    Example output

    1. NAME                  READY   STATUS    RESTARTS   AGE
    2. dns-default-8s42x     2/2     Running   0          5h8m
    3. dns-default-mdw6r     2/2     Running   0          4h58m
    4. dns-default-p8t5h     2/2     Running   0          4h58m
    5. dns-default-rl6nk     2/2     Running   0          5h8m
    6. dns-default-xbgqx     2/2     Running   0          5h8m
    7. dns-default-zv8f6     2/2     Running   0          4h58m
    8. node-resolver-62jjb   1/1     Running   0          5h8m
    9. node-resolver-8z4cj   1/1     Running   0          4h59m
    10. node-resolver-bq244   1/1     Running   0          5h8m
    11. node-resolver-hc58n   1/1     Running   0          4h59m
    12. node-resolver-lm6z4   1/1     Running   0          5h8m
    13. node-resolver-zfx5k   1/1     Running   0          5h

  3. Run the following ovnkube-trace command to verify DNS resolution is working:

    1. $ ./ovnkube-trace \
    2.   -src-namespace default \ (1)
    3.   -src web \ (2)
    4.   -dst-namespace openshift-dns \ (3)
    5.   -dst dns-default-p8t5h \ (4)
    6.   -udp -dst-port 53 \ (5)
    7.   -loglevel 0 (6)
    1Namespace of the source pod
    2Source pod name
    3Namespace of destination pod
    4Destination pod name
    5Use the udp transport protocol. Port 53 is the port the DNS service uses.
    6Set the log level to 0 (0 is minimal and 5 is debug)

    Example output if the src&dst pod lands on the same node:

    1. ovn-trace source pod to destination pod indicates success from web to dns-default-p8t5h
    2. ovn-trace destination pod to source pod indicates success from dns-default-p8t5h to web
    3. ovs-appctl ofproto/trace source pod to destination pod indicates success from web to dns-default-p8t5h
    4. ovs-appctl ofproto/trace destination pod to source pod indicates success from dns-default-p8t5h to web
    5. ovn-detrace source pod to destination pod indicates success from web to dns-default-p8t5h
    6. ovn-detrace destination pod to source pod indicates success from dns-default-p8t5h to web

    Example output if the src&dst pod lands on a different node:

    1. ovn-trace source pod to destination pod indicates success from web to dns-default-8s42x
    2. ovn-trace (remote) source pod to destination pod indicates success from web to dns-default-8s42x
    3. ovn-trace destination pod to source pod indicates success from dns-default-8s42x to web
    4. ovn-trace (remote) destination pod to source pod indicates success from dns-default-8s42x to web
    5. ovs-appctl ofproto/trace source pod to destination pod indicates success from web to dns-default-8s42x
    6. ovs-appctl ofproto/trace destination pod to source pod indicates success from dns-default-8s42x to web
    7. ovn-detrace source pod to destination pod indicates success from web to dns-default-8s42x
    8. ovn-detrace destination pod to source pod indicates success from dns-default-8s42x to web

    The ouput indicates success from the deployed pod to the DNS port and also indicates that it is successful going back in the other direction. So you know bi-directional traffic is supported on UDP port 53 if my web pod wants to do dns resolution from core DNS.

If for example that did not work and you wanted to get the ovn-trace, the ovs-appctl of proto/trace and ovn-detrace, and more debug type information increase the log level to 2 and run the command again as follows:

  1. $ ./ovnkube-trace \
  2.   -src-namespace default \
  3.   -src web \
  4.   -dst-namespace openshift-dns \
  5.   -dst dns-default-467qw \
  6.   -udp -dst-port 53 \
  7.   -loglevel 2

The output from this increased log level is too much to list here. In a failure situation the output of this command shows which flow is dropping that traffic. For example an egress or ingress network policy may be configured on the cluster that does not allow that traffic.

Example: Verifying by using debug output a configured default deny

This example illustrates how to identify by using the debug output that an ingress default deny policy blocks traffic.

Procedure

  1. Create the following YAML that defines a deny-by-default policy to deny ingress from all pods in all namespaces. Save the YAML in the deny-by-default.yaml file:

    1. kind: NetworkPolicy
    2. apiVersion: networking.k8s.io/v1
    3. metadata:
    4.   name: deny-by-default
    5.   namespace: default
    6. spec:
    7.   podSelector: {}
    8.   ingress: []

  2. Apply the policy by entering the following command:

    1. $ oc apply -f deny-by-default.yaml

    Example output

    1. networkpolicy.networking.k8s.io/deny-by-default created

  3. Start a web service in the default namespace by entering the following command:

    1. $ oc run web --namespace=default --image=quay.io/openshifttest/nginx --labels="app=web" --expose --port=80

  4. Run the following command to create the prod namespace:

    1. $ oc create namespace prod

  5. Run the following command to label the prod namespace:

    1. $ oc label namespace/prod purpose=production

  6. Run the following command to deploy an alpine image in the prod namespace and start a shell:

    1. $ oc run test-6459 --namespace=prod --rm -i -t --image=alpine -- sh

  7. Open another terminal session.

  8. In this new terminal session run ovn-trace to verify the failure in communication between the source pod test-6459 running in namespace prod and destination pod running in the default namespace:

    1. $ ./ovnkube-trace \
    2.  -src-namespace prod \
    3.  -src test-6459 \
    4.  -dst-namespace default \
    5.  -dst web \
    6.  -tcp -dst-port 80 \
    7.  -loglevel 0

    Example output

    1. ovn-trace source pod to destination pod indicates failure from test-6459 to web

  9. Increase the log level to 2 to expose the reason for the failure by running the following command:

    1. $ ./ovnkube-trace \
    2.  -src-namespace prod \
    3.  -src test-6459 \
    4.  -dst-namespace default \
    5.  -dst web \
    6.  -tcp -dst-port 80 \
    7.  -loglevel 2

    Example output

    1. ...
    2. ------------------------------------------------
    3.  3. ls_out_acl_hint (northd.c:7454): !ct.new && ct.est && !ct.rpl && ct_mark.blocked == 0, priority 4, uuid 12efc456
    4.     reg0[8] = 1;
    5.     reg0[10] = 1;
    6.     next;
    7.  5. ls_out_acl_action (northd.c:7835): reg8[30..31] == 0, priority 500, uuid 69372c5d
    8.     reg8[30..31] = 1;
    9.     next(4);
    10.  5. ls_out_acl_action (northd.c:7835): reg8[30..31] == 1, priority 500, uuid 2fa0af89
    11.     reg8[30..31] = 2;
    12.     next(4);
    13.  4. ls_out_acl_eval (northd.c:7691): reg8[30..31] == 2 && reg0[10] == 1 && (outport == @a16982411286042166782_ingressDefaultDeny), priority 2000, uuid 447d0dab
    14.     reg8[17] = 1;
    15.     ct_commit { ct_mark.blocked = 1; }; (1)
    16.     next;
    17. ...
    1Ingress traffic is blocked due to the default deny policy being in place.

  10. Create a policy that allows traffic from all pods in a particular namespaces with a label purpose=production. Save the YAML in the web-allow-prod.yaml file:

    1. kind: NetworkPolicy
    2. apiVersion: networking.k8s.io/v1
    3. metadata:
    4.  name: web-allow-prod
    5.  namespace: default
    6. spec:
    7.  podSelector:
    8.    matchLabels:
    9.      app: web
    10.  policyTypes:
    11.  - Ingress
    12.  ingress:
    13.  - from:
    14.    - namespaceSelector:
    15.        matchLabels:
    16.          purpose: production

  11. Apply the policy by entering the following command:

    1. $ oc apply -f web-allow-prod.yaml

  12. Run ovnkube-trace to verify that traffic is now allowed by entering the following command:

    1. $ ./ovnkube-trace \
    2. -src-namespace prod \
    3. -src test-6459 \
    4. -dst-namespace default \
    5. -dst web \
    6. -tcp -dst-port 80 \
    7. -loglevel 0

    Expected output

    1. ovn-trace source pod to destination pod indicates success from test-6459 to web
    2. ovn-trace destination pod to source pod indicates success from web to test-6459
    3. ovs-appctl ofproto/trace source pod to destination pod indicates success from test-6459 to web
    4. ovs-appctl ofproto/trace destination pod to source pod indicates success from web to test-6459
    5. ovn-detrace source pod to destination pod indicates success from test-6459 to web
    6. ovn-detrace destination pod to source pod indicates success from web to test-6459

  13. Run the following command in the shell that was opened in step six to connect nginx to the web-server:

    1. wget -qO- --timeout=2 http://web.default

    Expected output

    1. <!DOCTYPE html>
    2. <html>
    3. <head>
    4. <title>Welcome to nginx!</title>
    5. <style>
    6.  body {
    7.    width: 35em;
    8.    margin: 0 auto;
    9.    font-family: Tahoma, Verdana, Arial, sans-serif;
    10.  }
    11. </style>
    12. </head>
    13. <body>
    14. <h1>Welcome to nginx!</h1>
    15. <p>If you see this page, the nginx web server is successfully installed and
    16. working. Further configuration is required.</p>
    18. <p>For online documentation and support please refer to
    19. <a href="http://nginx.org/">nginx.org</a>.<br/>
    20. Commercial support is available at
    21. <a href="http://nginx.com/">nginx.com</a>.</p>
    23. <p><em>Thank you for using nginx.</em></p>
    24. </body>
    25. </html>

Additional resources