OKD upgrade 4.6 to 4.7 failed that happened a large number of multicast packets to attack the firewall

[gkitlin]

Describe the bug

Install method: Use metal bare installed on VMWare.
Network: VLAN1 & VLAN2

VMs in VLAN1: master(01,02,03), worker(01,02)
VMs in VLAN2: worker(03,04,05,06), ADFS( use the “Multicast” of NLB operation mode)

1. I installed the OKD 4.6 cluster successfully.
2. I executed to upgrade 4.6.0-0.okd-2021-02-14-205305 to 4.7.0-0.okd-2021-04-24-103438 version.
3. About 30 mins later, the network happened abnormal. I found the firewall's CPU overloaded 100% caused the network crash.
4. I dump the worker04 interface traffic in VLAN2, found the interface received a large number of packets from MS-NLB-VirtServer-Multicast. It seems many packets don't relate to the OKD cluster.
5. From the VMWare statistics, the worker(03,04,05,06) generated 10GB/s multicast packets to transmit to the firewall.

I have some questions, please help to answer.

1. Is it a bug? Can the OKD cluster operation in the NLB multicast network?
2. In the OKD 4.6 version above, when the cluster received a multicast packet, is it forward to who or not forward?
3. Why the OKD 4.6 version above that activated the "allmulti" option in the network interface? Because I don't want to receive irrelevant multicast from the network.
4. In my case, can I deduce it to multicast looping in the network?

Version
Oringial version: 4.6.0-0.okd-2021-02-14-205305
Target version: 4.7.0-0.okd-2021-04-24-103438

[vrutkovs]

That certainly sounds like an OVN bug. I don't think its specific to OKD (unless there is a bug in NetworkManager or some host bits)

Could you file an issue in bugzilla.redhat.com?

[gkitlin]

Ok, I created an issue in bugzilla. Thank you very much!