Kubespray: docker container do not network after install kubespray

[gamggi]

i install kubernetes by kubespray. after, docker container don't access network.

ex)

host$docker run -it ubuntu /bin/bash (host)

container# apt update (in container)
Err:1 http://security.ubuntu.com/ubuntu bionic-security InRelease
Temporary failure resolving 'security.ubuntu.com'
Err:2 http://archive.ubuntu.com/ubuntu bionic InRelease
Temporary failure resolving 'archive.ubuntu.com'
Err:3 http://archive.ubuntu.com/ubuntu bionic-updates InRelease
Temporary failure resolving 'archive.ubuntu.com'

host$ kubectl run --image ubuntu ubuntu -it /bin/bash

pod# apt update
Get:1 http://security.ubuntu.com/ubuntu bionic-security InRelease [88.7 kB]
Get:2 http://security.ubuntu.com/ubuntu bionic-security/restricted amd64 Packages [31.0 kB]
Get:3 http://security.ubuntu.com/ubuntu bionic-security/universe amd64 Packages [826 kB]
Get:4 http://security.ubuntu.com/ubuntu bionic-security/main amd64 Packages [836 kB]

pod can access network, but container can't access network :(

Environment:

• Cloud provider or hardware configuration:
  GCP
• OS (printf "$(uname -srm)\n$(cat /etc/os-release)\n"):
  NAME="Ubuntu" VERSION="18.04.4 LTS (Bionic Beaver)"

• Version of Ansible (ansible --version):
  2.7.16

• Version of Python (python --version):
  3/6/9

Kubespray version (commit) (git rev-parse --short HEAD):
57bb7aa5

Network plugin used:
calico

Full inventory with variables (ansible -i inventory/sample/inventory.ini all -m debug -a "var=hostvars[inventory_hostname]"):

Command used to invoke ansible:

Output of ansible run:

Anything else do we need to know:

[adriendelsalle]

Hi @gamggi . Any progress on this ? It looks like a DNS problem on your side.

I'm facing a very similar issue but instead of

Err:1 http://security.ubuntu.com/ubuntu bionic-security InRelease
Temporary failure resolving 'security.ubuntu.com'
...

I get:

$ sudo docker run -it ubuntu /bin/bash
root@751cdf1ea9b6:/# apt-get update
Err:1 http://archive.ubuntu.com/ubuntu focal InRelease                         
  Could not connect to archive.ubuntu.com:80 (91.189.88.152), connection timed out Could not connect to archive.ubuntu.com:80 (91.189.88.142), connection timed out
Err:2 http://archive.ubuntu.com/ubuntu focal-updates InRelease                 
  Unable to connect to archive.ubuntu.com:http:
Err:3 http://archive.ubuntu.com/ubuntu focal-backports InRelease               
  Unable to connect to archive.ubuntu.com:http:
Err:4 http://security.ubuntu.com/ubuntu focal-security InRelease               
  Could not connect to security.ubuntu.com:80 (91.189.88.142), connection timed out Could not connect to security.ubuntu.com:80 (91.189.91.39), connection timed out Could not connect to security.ubuntu.com:80 (91.189.91.38), connection timed out Could not connect to security.ubuntu.com:80 (91.189.88.152), connection timed out
Reading package lists... Done                         
W: Failed to fetch http://archive.ubuntu.com/ubuntu/dists/focal/InRelease  Could not connect to archive.ubuntu.com:80 (91.189.88.152), connection timed out Could not connect to archive.ubuntu.com:80 (91.189.88.142), connection timed out
W: Failed to fetch http://archive.ubuntu.com/ubuntu/dists/focal-updates/InRelease  Unable to connect to archive.ubuntu.com:http:
W: Failed to fetch http://archive.ubuntu.com/ubuntu/dists/focal-backports/InRelease  Unable to connect to archive.ubuntu.com:http:
W: Failed to fetch http://security.ubuntu.com/ubuntu/dists/focal-security/InRelease  Could not connect to security.ubuntu.com:80 (91.189.88.142), connection timed out Could not connect to security.ubuntu.com:80 (91.189.91.39), connection timed out Could not connect to security.ubuntu.com:80 (91.189.91.38), connection timed out Could not connect to security.ubuntu.com:80 (91.189.88.152), connection timed out
W: Some index files failed to download. They have been ignored, or old ones used instead.

The resolving seems to work but it also fails..

Trying the same thing inside a pod also works fine

$ kubectl run --image ubuntu ubuntu -it /bin/bash
root@ubuntu-5b87c5db66-kdkq4:/# apt-get update
Get:1 http://archive.ubuntu.com/ubuntu focal InRelease [265 kB]
Get:2 http://security.ubuntu.com/ubuntu focal-security InRelease [101 kB]        
Get:3 http://archive.ubuntu.com/ubuntu focal-updates InRelease [97.0 kB]
Get:4 http://archive.ubuntu.com/ubuntu focal-backports InRelease [89.2 kB]
Get:5 http://archive.ubuntu.com/ubuntu focal/multiverse amd64 Packages [177 kB]
Get:6 http://archive.ubuntu.com/ubuntu focal/main amd64 Packages [1275 kB]
Get:7 http://archive.ubuntu.com/ubuntu focal/universe amd64 Packages [11.3 MB]
Get:8 http://security.ubuntu.com/ubuntu focal-security/main amd64 Packages [8398 B]
Get:9 http://security.ubuntu.com/ubuntu focal-security/universe amd64 Packages [2298 B]
Get:10 http://archive.ubuntu.com/ubuntu focal/restricted amd64 Packages [33.4 kB]
Get:11 http://archive.ubuntu.com/ubuntu focal-updates/restricted amd64 Packages [2843 B]
Get:12 http://archive.ubuntu.com/ubuntu focal-updates/universe amd64 Packages [5652 B]
Get:13 http://archive.ubuntu.com/ubuntu focal-updates/main amd64 Packages [30.1 kB]
Fetched 13.4 MB in 3s (3983 kB/s)
Reading package lists... Done

---

Environment

Bare metal single-node cluster, 4CPU and 16GB RAM
OS: Ubuntu 18.04 LTS
Anisble: 2.9.6
Python: 3.7.5
Kubespray: 3d598857

Anyone could help please?
Thanks!

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[ifalex]

Experiencing same error. Is there any fix for this?

[adriendelsalle]

/remove-lifecycle stale

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten