From 02c82103170054ca4a3db934a1129363dcb16dc9 Mon Sep 17 00:00:00 2001 From: Dan Winship Date: Mon, 25 Apr 2022 15:28:12 -0400 Subject: [PATCH] Clean up kubelet iptables error messages Their syntax seems to have gotten mangled in the structured logging migration... --- pkg/kubelet/kubelet_network_linux.go | 32 ++++++++++++++-------------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/pkg/kubelet/kubelet_network_linux.go b/pkg/kubelet/kubelet_network_linux.go index 343f98d8612..362a247dbdf 100644 --- a/pkg/kubelet/kubelet_network_linux.go +++ b/pkg/kubelet/kubelet_network_linux.go @@ -58,7 +58,7 @@ func (kl *Kubelet) initNetworkUtil() { for i := range iptClients { iptClient := iptClients[i] if kl.syncNetworkUtil(iptClient) { - klog.InfoS("Initialized protocol iptables rules.", "protocol", iptClient.Protocol()) + klog.InfoS("Initialized iptables rules.", "protocol", iptClient.Protocol()) go iptClient.Monitor( utiliptables.Chain("KUBE-KUBELET-CANARY"), []utiliptables.Table{utiliptables.TableMangle, utiliptables.TableNAT, utiliptables.TableFilter}, @@ -66,7 +66,7 @@ func (kl *Kubelet) initNetworkUtil() { 1*time.Minute, wait.NeverStop, ) } else { - klog.InfoS("Failed to initialize protocol iptables rules; some functionality may be missing.", "protocol", iptClient.Protocol()) + klog.InfoS("Failed to initialize iptables rules; some functionality may be missing.", "protocol", iptClient.Protocol()) } } } @@ -81,22 +81,22 @@ func (kl *Kubelet) syncNetworkUtil(iptClient utiliptables.Interface) bool { // Setup KUBE-MARK-DROP rules dropMark := getIPTablesMark(kl.iptablesDropBit) if _, err := iptClient.EnsureChain(utiliptables.TableNAT, KubeMarkDropChain); err != nil { - klog.ErrorS(err, "Failed to ensure that nat chain exists KUBE-MARK-DROP chain") + klog.ErrorS(err, "Failed to ensure that KUBE-MARK-DROP chain exists") return false } if _, err := iptClient.EnsureRule(utiliptables.Append, utiliptables.TableNAT, KubeMarkDropChain, "-j", "MARK", "--or-mark", dropMark); err != nil { - klog.ErrorS(err, "Failed to ensure marking rule for KUBE-MARK-DROP chain") + klog.ErrorS(err, "Failed to ensure that KUBE-MARK-DROP rule exists") return false } if _, err := iptClient.EnsureChain(utiliptables.TableFilter, KubeFirewallChain); err != nil { - klog.ErrorS(err, "Failed to ensure that filter table exists KUBE-FIREWALL chain") + klog.ErrorS(err, "Failed to ensure that KUBE-FIREWALL chain exists") return false } if _, err := iptClient.EnsureRule(utiliptables.Append, utiliptables.TableFilter, KubeFirewallChain, "-m", "comment", "--comment", "kubernetes firewall for dropping marked packets", "-m", "mark", "--mark", fmt.Sprintf("%s/%s", dropMark, dropMark), "-j", "DROP"); err != nil { - klog.ErrorS(err, "Failed to ensure rule to drop packet marked by the KUBE-MARK-DROP in KUBE-FIREWALL chain") + klog.ErrorS(err, "Failed to ensure that KUBE-FIREWALL rule exists") return false } @@ -110,37 +110,37 @@ func (kl *Kubelet) syncNetworkUtil(iptClient utiliptables.Interface) bool { "-m", "conntrack", "!", "--ctstate", "RELATED,ESTABLISHED,DNAT", "-j", "DROP"); err != nil { - klog.ErrorS(err, "Failed to ensure rule to drop invalid localhost packets in filter table KUBE-FIREWALL chain") + klog.ErrorS(err, "Failed to ensure rule to drop invalid localhost packets exists") return false } } if _, err := iptClient.EnsureRule(utiliptables.Prepend, utiliptables.TableFilter, utiliptables.ChainOutput, "-j", string(KubeFirewallChain)); err != nil { - klog.ErrorS(err, "Failed to ensure that filter table from OUTPUT chain jumps to KUBE-FIREWALL chain") + klog.ErrorS(err, "Failed to ensure that OUTPUT chain jumps to KUBE-FIREWALL") return false } if _, err := iptClient.EnsureRule(utiliptables.Prepend, utiliptables.TableFilter, utiliptables.ChainInput, "-j", string(KubeFirewallChain)); err != nil { - klog.ErrorS(err, "Failed to ensure that filter table INPUT chain jumps to KUBE-FIREWALL chain") + klog.ErrorS(err, "Failed to ensure that INPUT chain jumps to KUBE-FIREWALL") return false } // Setup KUBE-MARK-MASQ rules masqueradeMark := getIPTablesMark(kl.iptablesMasqueradeBit) if _, err := iptClient.EnsureChain(utiliptables.TableNAT, KubeMarkMasqChain); err != nil { - klog.ErrorS(err, "Failed to ensure that nat table exists KUBE-MARK-MASQ chain") + klog.ErrorS(err, "Failed to ensure that KUBE-MARK-MASQ chain exists") return false } if _, err := iptClient.EnsureChain(utiliptables.TableNAT, KubePostroutingChain); err != nil { - klog.ErrorS(err, "Failed to ensure that nat table exists kube POSTROUTING chain") + klog.ErrorS(err, "Failed to ensure that KUBE-POSTROUTING chain exists") return false } if _, err := iptClient.EnsureRule(utiliptables.Append, utiliptables.TableNAT, KubeMarkMasqChain, "-j", "MARK", "--or-mark", masqueradeMark); err != nil { - klog.ErrorS(err, "Failed to ensure marking rule for KUBE-MARK-MASQ chain") + klog.ErrorS(err, "Failed to ensure that KUBE-MARK-MASQ rule exists") return false } if _, err := iptClient.EnsureRule(utiliptables.Prepend, utiliptables.TableNAT, utiliptables.ChainPostrouting, "-m", "comment", "--comment", "kubernetes postrouting rules", "-j", string(KubePostroutingChain)); err != nil { - klog.ErrorS(err, "Failed to ensure that nat table from POSTROUTING chain jumps to KUBE-POSTROUTING chain") + klog.ErrorS(err, "Failed to ensure that POSTROUTING chain jumps to KUBE-POSTROUTING") return false } @@ -150,7 +150,7 @@ func (kl *Kubelet) syncNetworkUtil(iptClient utiliptables.Interface) bool { if _, err := iptClient.EnsureRule(utiliptables.Append, utiliptables.TableNAT, KubePostroutingChain, "-m", "mark", "!", "--mark", fmt.Sprintf("%s/%s", masqueradeMark, masqueradeMark), "-j", "RETURN"); err != nil { - klog.ErrorS(err, "Failed to ensure filtering rule for KUBE-POSTROUTING chain") + klog.ErrorS(err, "Failed to ensure first masquerading rule exists") return false } // Clear the mark to avoid re-masquerading if the packet re-traverses the network stack. @@ -158,7 +158,7 @@ func (kl *Kubelet) syncNetworkUtil(iptClient utiliptables.Interface) bool { // to Sprintf another bitmask). if _, err := iptClient.EnsureRule(utiliptables.Append, utiliptables.TableNAT, KubePostroutingChain, "-j", "MARK", "--xor-mark", masqueradeMark); err != nil { - klog.ErrorS(err, "Failed to ensure unmarking rule for KUBE-POSTROUTING chain") + klog.ErrorS(err, "Failed to ensure second masquerading rule exists") return false } masqRule := []string{ @@ -169,7 +169,7 @@ func (kl *Kubelet) syncNetworkUtil(iptClient utiliptables.Interface) bool { masqRule = append(masqRule, "--random-fully") } if _, err := iptClient.EnsureRule(utiliptables.Append, utiliptables.TableNAT, KubePostroutingChain, masqRule...); err != nil { - klog.ErrorS(err, "Failed to ensure SNAT rule for packets marked by KUBE-MARK-MASQ chain in nat table KUBE-POSTROUTING chain") + klog.ErrorS(err, "Failed to ensure third masquerading rule exists") return false }