0

I have a brand new IBM CP 3.1.2 cluster up and running. I've deployed my workloads on it, mostly go microservices. The containers can't start and log an error because it can't access an external redis server on port 6379.

The cluster is installed with the firewall mode to false.

I have double checked that the IP, port and credentials are correct.

I have checked that the port on the distant redis server is reachable from the nodes directly. I've checked that the calico policy is in allowed mode for outbound and inbound traffic.

I also have used a throwable busybox container, and it can't telnet the distant redis server either but it can ping it.

From the nodes :

telnet REDIS_SERVER 6379
Trying REDIS_SERVER...
Connected to REDIS_SERVER.
Escape character is '^]'.

From the busybox container, inside the cluster (kubectl run -i --rm --tty busybox --image=busybox -- sh) :

telnet REDIS_SERVER 6379

ping REDIS_SERVER
64 bytes from REDIS_SERVER: seq=0 ttl=59 time=1.415 ms
64 bytes from REDIS_SERVER: seq=1 ttl=59 time=1.376 ms
64 bytes from REDIS_SERVER: seq=2 ttl=59 time=1.674 ms
64 bytes from REDIS_SERVER: seq=3 ttl=59 time=1.705 ms

Is there something that I'm missing ?

Melchizedeck
  • 11
  • 2

2 Answers2

1

The port was blocked because of a missing istio egress policy.

Once I've added the egress policy my pods were able to communicate with the distant REDIS server.

Melchizedeck
  • 11
  • 2
0

If I understood correctly the telnet failed inside of your pod, is that correct? You can ping it but cannot telnet? Does it happens if you go to other pod?

Fernnado Ewald
  • 1
  • 1
  • Yes, inside the pod the telnet fails. I've launched a tcpdump and I can't see any traffic going when the telnet is launched. But I can ping it. It happens in all the pods. – Melchizedeck Apr 26 '19 at 06:40