mirror of
https://github.com/k3s-io/kubernetes.git
synced 2025-07-23 03:41:45 +00:00
Clean up kubelet iptables error messages
Their syntax seems to have gotten mangled in the structured logging migration...
This commit is contained in:
parent
b7e977d497
commit
02c8210317
@ -58,7 +58,7 @@ func (kl *Kubelet) initNetworkUtil() {
|
||||
for i := range iptClients {
|
||||
iptClient := iptClients[i]
|
||||
if kl.syncNetworkUtil(iptClient) {
|
||||
klog.InfoS("Initialized protocol iptables rules.", "protocol", iptClient.Protocol())
|
||||
klog.InfoS("Initialized iptables rules.", "protocol", iptClient.Protocol())
|
||||
go iptClient.Monitor(
|
||||
utiliptables.Chain("KUBE-KUBELET-CANARY"),
|
||||
[]utiliptables.Table{utiliptables.TableMangle, utiliptables.TableNAT, utiliptables.TableFilter},
|
||||
@ -66,7 +66,7 @@ func (kl *Kubelet) initNetworkUtil() {
|
||||
1*time.Minute, wait.NeverStop,
|
||||
)
|
||||
} else {
|
||||
klog.InfoS("Failed to initialize protocol iptables rules; some functionality may be missing.", "protocol", iptClient.Protocol())
|
||||
klog.InfoS("Failed to initialize iptables rules; some functionality may be missing.", "protocol", iptClient.Protocol())
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -81,22 +81,22 @@ func (kl *Kubelet) syncNetworkUtil(iptClient utiliptables.Interface) bool {
|
||||
// Setup KUBE-MARK-DROP rules
|
||||
dropMark := getIPTablesMark(kl.iptablesDropBit)
|
||||
if _, err := iptClient.EnsureChain(utiliptables.TableNAT, KubeMarkDropChain); err != nil {
|
||||
klog.ErrorS(err, "Failed to ensure that nat chain exists KUBE-MARK-DROP chain")
|
||||
klog.ErrorS(err, "Failed to ensure that KUBE-MARK-DROP chain exists")
|
||||
return false
|
||||
}
|
||||
if _, err := iptClient.EnsureRule(utiliptables.Append, utiliptables.TableNAT, KubeMarkDropChain, "-j", "MARK", "--or-mark", dropMark); err != nil {
|
||||
klog.ErrorS(err, "Failed to ensure marking rule for KUBE-MARK-DROP chain")
|
||||
klog.ErrorS(err, "Failed to ensure that KUBE-MARK-DROP rule exists")
|
||||
return false
|
||||
}
|
||||
if _, err := iptClient.EnsureChain(utiliptables.TableFilter, KubeFirewallChain); err != nil {
|
||||
klog.ErrorS(err, "Failed to ensure that filter table exists KUBE-FIREWALL chain")
|
||||
klog.ErrorS(err, "Failed to ensure that KUBE-FIREWALL chain exists")
|
||||
return false
|
||||
}
|
||||
if _, err := iptClient.EnsureRule(utiliptables.Append, utiliptables.TableFilter, KubeFirewallChain,
|
||||
"-m", "comment", "--comment", "kubernetes firewall for dropping marked packets",
|
||||
"-m", "mark", "--mark", fmt.Sprintf("%s/%s", dropMark, dropMark),
|
||||
"-j", "DROP"); err != nil {
|
||||
klog.ErrorS(err, "Failed to ensure rule to drop packet marked by the KUBE-MARK-DROP in KUBE-FIREWALL chain")
|
||||
klog.ErrorS(err, "Failed to ensure that KUBE-FIREWALL rule exists")
|
||||
return false
|
||||
}
|
||||
|
||||
@ -110,37 +110,37 @@ func (kl *Kubelet) syncNetworkUtil(iptClient utiliptables.Interface) bool {
|
||||
"-m", "conntrack",
|
||||
"!", "--ctstate", "RELATED,ESTABLISHED,DNAT",
|
||||
"-j", "DROP"); err != nil {
|
||||
klog.ErrorS(err, "Failed to ensure rule to drop invalid localhost packets in filter table KUBE-FIREWALL chain")
|
||||
klog.ErrorS(err, "Failed to ensure rule to drop invalid localhost packets exists")
|
||||
return false
|
||||
}
|
||||
}
|
||||
|
||||
if _, err := iptClient.EnsureRule(utiliptables.Prepend, utiliptables.TableFilter, utiliptables.ChainOutput, "-j", string(KubeFirewallChain)); err != nil {
|
||||
klog.ErrorS(err, "Failed to ensure that filter table from OUTPUT chain jumps to KUBE-FIREWALL chain")
|
||||
klog.ErrorS(err, "Failed to ensure that OUTPUT chain jumps to KUBE-FIREWALL")
|
||||
return false
|
||||
}
|
||||
if _, err := iptClient.EnsureRule(utiliptables.Prepend, utiliptables.TableFilter, utiliptables.ChainInput, "-j", string(KubeFirewallChain)); err != nil {
|
||||
klog.ErrorS(err, "Failed to ensure that filter table INPUT chain jumps to KUBE-FIREWALL chain")
|
||||
klog.ErrorS(err, "Failed to ensure that INPUT chain jumps to KUBE-FIREWALL")
|
||||
return false
|
||||
}
|
||||
|
||||
// Setup KUBE-MARK-MASQ rules
|
||||
masqueradeMark := getIPTablesMark(kl.iptablesMasqueradeBit)
|
||||
if _, err := iptClient.EnsureChain(utiliptables.TableNAT, KubeMarkMasqChain); err != nil {
|
||||
klog.ErrorS(err, "Failed to ensure that nat table exists KUBE-MARK-MASQ chain")
|
||||
klog.ErrorS(err, "Failed to ensure that KUBE-MARK-MASQ chain exists")
|
||||
return false
|
||||
}
|
||||
if _, err := iptClient.EnsureChain(utiliptables.TableNAT, KubePostroutingChain); err != nil {
|
||||
klog.ErrorS(err, "Failed to ensure that nat table exists kube POSTROUTING chain")
|
||||
klog.ErrorS(err, "Failed to ensure that KUBE-POSTROUTING chain exists")
|
||||
return false
|
||||
}
|
||||
if _, err := iptClient.EnsureRule(utiliptables.Append, utiliptables.TableNAT, KubeMarkMasqChain, "-j", "MARK", "--or-mark", masqueradeMark); err != nil {
|
||||
klog.ErrorS(err, "Failed to ensure marking rule for KUBE-MARK-MASQ chain")
|
||||
klog.ErrorS(err, "Failed to ensure that KUBE-MARK-MASQ rule exists")
|
||||
return false
|
||||
}
|
||||
if _, err := iptClient.EnsureRule(utiliptables.Prepend, utiliptables.TableNAT, utiliptables.ChainPostrouting,
|
||||
"-m", "comment", "--comment", "kubernetes postrouting rules", "-j", string(KubePostroutingChain)); err != nil {
|
||||
klog.ErrorS(err, "Failed to ensure that nat table from POSTROUTING chain jumps to KUBE-POSTROUTING chain")
|
||||
klog.ErrorS(err, "Failed to ensure that POSTROUTING chain jumps to KUBE-POSTROUTING")
|
||||
return false
|
||||
}
|
||||
|
||||
@ -150,7 +150,7 @@ func (kl *Kubelet) syncNetworkUtil(iptClient utiliptables.Interface) bool {
|
||||
if _, err := iptClient.EnsureRule(utiliptables.Append, utiliptables.TableNAT, KubePostroutingChain,
|
||||
"-m", "mark", "!", "--mark", fmt.Sprintf("%s/%s", masqueradeMark, masqueradeMark),
|
||||
"-j", "RETURN"); err != nil {
|
||||
klog.ErrorS(err, "Failed to ensure filtering rule for KUBE-POSTROUTING chain")
|
||||
klog.ErrorS(err, "Failed to ensure first masquerading rule exists")
|
||||
return false
|
||||
}
|
||||
// Clear the mark to avoid re-masquerading if the packet re-traverses the network stack.
|
||||
@ -158,7 +158,7 @@ func (kl *Kubelet) syncNetworkUtil(iptClient utiliptables.Interface) bool {
|
||||
// to Sprintf another bitmask).
|
||||
if _, err := iptClient.EnsureRule(utiliptables.Append, utiliptables.TableNAT, KubePostroutingChain,
|
||||
"-j", "MARK", "--xor-mark", masqueradeMark); err != nil {
|
||||
klog.ErrorS(err, "Failed to ensure unmarking rule for KUBE-POSTROUTING chain")
|
||||
klog.ErrorS(err, "Failed to ensure second masquerading rule exists")
|
||||
return false
|
||||
}
|
||||
masqRule := []string{
|
||||
@ -169,7 +169,7 @@ func (kl *Kubelet) syncNetworkUtil(iptClient utiliptables.Interface) bool {
|
||||
masqRule = append(masqRule, "--random-fully")
|
||||
}
|
||||
if _, err := iptClient.EnsureRule(utiliptables.Append, utiliptables.TableNAT, KubePostroutingChain, masqRule...); err != nil {
|
||||
klog.ErrorS(err, "Failed to ensure SNAT rule for packets marked by KUBE-MARK-MASQ chain in nat table KUBE-POSTROUTING chain")
|
||||
klog.ErrorS(err, "Failed to ensure third masquerading rule exists")
|
||||
return false
|
||||
}
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user