An Edge-termination Route keep generating "Failed to find pool for" error message even though the traffic works just fine

[jokoyuliantoro]

Setup Details

CIS Version : 2.17.0
Build: f5networks/k8s-bigip-ctlr:latest
BIGIP Version: Big IP 17.1.0.1
AS3 Version: 3.50.2
Agent Mode: AS3
Orchestration: OSCP
Orchestration Version: 4.10.17
Pool Mode: Cluster
Additional Setup details: SDN without tunnel

Description

Traffic to an edge-termination Route keep generation iRule error in /var/log/ltm:

Rule /ocp-cis/Shared/openshift_passthrough_irule <CLIENT_DATA>: Failed to find pool for <pool_name>

The real traffic actually works with 200 OK returned. But the error log keep appearing for any incoming request.

Steps To Reproduce

1. Apply this yaml to OCP:

-------------------
apiVersion: apps/v1
kind: Deployment
metadata:
  name: app101
  namespace: ns100
spec:
  replicas: 2  # Adjust as needed
  selector:
    matchLabels:
      app: app101
  template:
    metadata:
      labels:
        app: app101
    spec:
      containers:
      - name: app101
        image: mendhak/http-https-echo:31
        ports:
        - containerPort: 8080
        env:
        - name: HTTP_PORT
          value: "8080"
---
apiVersion: v1
kind: Service
metadata:
  name: app101-service
  namespace: ns100
spec:
  selector:
    app: app101
  ports:
  - protocol: TCP
    port: 8080
    targetPort: 8080
    name: http
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: self-signed
  namespace: ns100
spec:
  selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: app101-cert
  namespace: ns100
spec:
  dnsNames:
    - app101.corp.com
  secretName: app101-cert-tls
  issuerRef:
    name: self-signed
---
apiVersion: route.openshift.io/v1
kind: Route
metadata:
  name: app101-route
  namespace: ns100
  annotations:
    cert-utils-operator.redhat-cop.io/certs-from-secret: app101-cert-tls
spec:
  host: app101.corp.com
  tls:
    termination: edge
    insecureEdgeTerminationPolicy: None
  to:
    kind: Service
    name: app101-service
-------------------

2. Run 'tail -f /var/log/ltm' via CLI of BIG-IP.

3. Run from BIG-IP CLI: curl -kv --resolve app101.corp.com:443: https://app101.corp.com/

Expected Result

There should be no error message in the /var/log/ltm

Actual Result

[root@bigip2:Active:In Sync] tmp # tail -f /var/log/ltm -n1
Jul  2 07:34:07 bigip2.local debug tmm1[10349]: Rule /ocp-cis/Shared/openshift_passthrough_irule <CLIENT_DATA>: Failed to find pool for app101.corp.com

CIS yaml

[cloud-user@ocp-provisioner loadtest]$ cat ../cis-manual/f5-cis-deploy.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: f5-cis
  namespace: f5-big-ip-cis
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app: k8s-bigip-ctlr
  strategy:
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 1
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: k8s-bigip-ctlr
      name: k8s-bigip-ctlr
    spec:
      serviceAccount: bigip-ctlr
      serviceAccountName: bigip-ctlr
      securityContext:
        runAsUser: 1000730001
        runAsGroup: 1000730001
      containers:
        - name: k8s-bigip-ctlr
          image: "f5networks/k8s-bigip-ctlr:latest"
          args:
            # See https://clouddocs.f5.com/containers/latest/userguide/config-parameters.html
            # for more configuration options.
            # When insecure=true, this enables insecure SSL communication to the BIG-IP system."
            - "--bigip-username=$(BIGIP_USERNAME)"
            - "--bigip-password=$(BIGIP_PASSWORD)"
            - "--bigip-url=10.1.10.245"
            - "--bigip-partition=ocp-cis"
            - "--insecure=true"
            - "--pool-member-type=cluster"
            - "--manage-routes=true"
            - "--route-vserver-addr=10.1.10.200"
            - "--route-http-vserver=ocp-cis-http-vs"
            - "--route-https-vserver=ocp-cis-https-vs"
            - "--vs-snat-pool-name=/Common/snatpool1"
          command:
            - /app/bin/k8s-bigip-ctlr
          env:
            - name: BIGIP_USERNAME
              valueFrom:
                secretKeyRef:
                  key: username
                  name: bigip-login
            - name: BIGIP_PASSWORD
              valueFrom:
                secretKeyRef:
                  key: password
                  name: bigip-login

[trinaths]

@jokoyuliantoro Is this error continuous ?

[jokoyuliantoro]

Yes, it is continuous.

[jokoyuliantoro]

For your consideration, @trinaths

[root@bigip2:Active:Standalone] tmp # diff openshift_passthrough_irule-after openshift_passthrough_irule-before
139d138
<                                                                       set edge_class "/ocp-cis/Shared/ssl_edge_servername_dg"
143d141
<                                                                               set dflt_pool_edge ""
146,148d143
<                                                                               # Get pool for Edge Class
<                                                                               set dflt_pool_edge [class match -value $servername_lower equals $edge_class]
<
158c153
<                                                                                       if { ($dflt_pool_edge == "") and ($dflt_pool_passthrough == "") } then {
---
>                                                                                       if { $dflt_pool_passthrough == "" } then {
161,165c156
<                                                                                               if { $dflt_pool_edge ne "" } {
<                                                                                                       pool $dflt_pool_edge
<                                                                                               } else {
<                                                                                                       pool $dflt_pool_passthrough
<                                                                                               }
---
>                                                                                               pool $dflt_pool_passthrough
[root@bigip2:Active:Standalone] tmp #

[trinaths]

@jokoyuliantoro Please verify this issue with 2.19 and share your findings.