github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-26 21:17:23 +00:00
Code Issues Projects Releases Wiki Activity

Clean up kubelet iptables error messages

Browse Source 
Their syntax seems to have gotten mangled in the structured logging
migration...
This commit is contained in:
Dan Winship 2022-04-25 15:28:12 -04:00
parent b7e977d497
commit 02c8210317
1 changed files with 16 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
pkg/kubelet/kubelet_network_linux.go
View File

@ -58,7 +58,7 @@ func (kl *Kubelet) initNetworkUtil() {
for i := range iptClients { for i := range iptClients {
iptClient := iptClients[i] iptClient := iptClients[i]
if kl.syncNetworkUtil(iptClient) { if kl.syncNetworkUtil(iptClient) {
klog.InfoS("Initialized protocol iptables rules.", "protocol", iptClient.Protocol()) klog.InfoS("Initialized iptables rules.", "protocol", iptClient.Protocol())
go iptClient.Monitor( go iptClient.Monitor(
utiliptables.Chain("KUBE-KUBELET-CANARY"), utiliptables.Chain("KUBE-KUBELET-CANARY"),
[]utiliptables.Table{utiliptables.TableMangle, utiliptables.TableNAT, utiliptables.TableFilter}, []utiliptables.Table{utiliptables.TableMangle, utiliptables.TableNAT, utiliptables.TableFilter},
@ -66,7 +66,7 @@ func (kl *Kubelet) initNetworkUtil() {
1*time.Minute, wait.NeverStop, 1*time.Minute, wait.NeverStop,
) )
} else { } else {
klog.InfoS("Failed to initialize protocol iptables rules; some functionality may be missing.", "protocol", iptClient.Protocol()) klog.InfoS("Failed to initialize iptables rules; some functionality may be missing.", "protocol", iptClient.Protocol())
} }
} }
} }
@ -81,22 +81,22 @@ func (kl *Kubelet) syncNetworkUtil(iptClient utiliptables.Interface) bool {
// Setup KUBE-MARK-DROP rules // Setup KUBE-MARK-DROP rules
dropMark := getIPTablesMark(kl.iptablesDropBit) dropMark := getIPTablesMark(kl.iptablesDropBit)
if _, err := iptClient.EnsureChain(utiliptables.TableNAT, KubeMarkDropChain); err != nil { if _, err := iptClient.EnsureChain(utiliptables.TableNAT, KubeMarkDropChain); err != nil {
klog.ErrorS(err, "Failed to ensure that nat chain exists KUBE-MARK-DROP chain") klog.ErrorS(err, "Failed to ensure that KUBE-MARK-DROP chain exists")
return false return false
} }
if _, err := iptClient.EnsureRule(utiliptables.Append, utiliptables.TableNAT, KubeMarkDropChain, "-j", "MARK", "--or-mark", dropMark); err != nil { if _, err := iptClient.EnsureRule(utiliptables.Append, utiliptables.TableNAT, KubeMarkDropChain, "-j", "MARK", "--or-mark", dropMark); err != nil {
klog.ErrorS(err, "Failed to ensure marking rule for KUBE-MARK-DROP chain") klog.ErrorS(err, "Failed to ensure that KUBE-MARK-DROP rule exists")
return false return false
} }
if _, err := iptClient.EnsureChain(utiliptables.TableFilter, KubeFirewallChain); err != nil { if _, err := iptClient.EnsureChain(utiliptables.TableFilter, KubeFirewallChain); err != nil {
klog.ErrorS(err, "Failed to ensure that filter table exists KUBE-FIREWALL chain") klog.ErrorS(err, "Failed to ensure that KUBE-FIREWALL chain exists")
return false return false
} }
if _, err := iptClient.EnsureRule(utiliptables.Append, utiliptables.TableFilter, KubeFirewallChain, if _, err := iptClient.EnsureRule(utiliptables.Append, utiliptables.TableFilter, KubeFirewallChain,
"-m", "comment", "--comment", "kubernetes firewall for dropping marked packets", "-m", "comment", "--comment", "kubernetes firewall for dropping marked packets",
"-m", "mark", "--mark", fmt.Sprintf("%s/%s", dropMark, dropMark), "-m", "mark", "--mark", fmt.Sprintf("%s/%s", dropMark, dropMark),
"-j", "DROP"); err != nil { "-j", "DROP"); err != nil {
klog.ErrorS(err, "Failed to ensure rule to drop packet marked by the KUBE-MARK-DROP in KUBE-FIREWALL chain") klog.ErrorS(err, "Failed to ensure that KUBE-FIREWALL rule exists")
return false return false
} }
@ -110,37 +110,37 @@ func (kl *Kubelet) syncNetworkUtil(iptClient utiliptables.Interface) bool {
"-m", "conntrack", "-m", "conntrack",
"!", "--ctstate", "RELATED,ESTABLISHED,DNAT", "!", "--ctstate", "RELATED,ESTABLISHED,DNAT",
"-j", "DROP"); err != nil { "-j", "DROP"); err != nil {
klog.ErrorS(err, "Failed to ensure rule to drop invalid localhost packets in filter table KUBE-FIREWALL chain") klog.ErrorS(err, "Failed to ensure rule to drop invalid localhost packets exists")
return false return false
} }
} }
if _, err := iptClient.EnsureRule(utiliptables.Prepend, utiliptables.TableFilter, utiliptables.ChainOutput, "-j", string(KubeFirewallChain)); err != nil { if _, err := iptClient.EnsureRule(utiliptables.Prepend, utiliptables.TableFilter, utiliptables.ChainOutput, "-j", string(KubeFirewallChain)); err != nil {
klog.ErrorS(err, "Failed to ensure that filter table from OUTPUT chain jumps to KUBE-FIREWALL chain") klog.ErrorS(err, "Failed to ensure that OUTPUT chain jumps to KUBE-FIREWALL")
return false return false
} }
if _, err := iptClient.EnsureRule(utiliptables.Prepend, utiliptables.TableFilter, utiliptables.ChainInput, "-j", string(KubeFirewallChain)); err != nil { if _, err := iptClient.EnsureRule(utiliptables.Prepend, utiliptables.TableFilter, utiliptables.ChainInput, "-j", string(KubeFirewallChain)); err != nil {
klog.ErrorS(err, "Failed to ensure that filter table INPUT chain jumps to KUBE-FIREWALL chain") klog.ErrorS(err, "Failed to ensure that INPUT chain jumps to KUBE-FIREWALL")
return false return false
} }
// Setup KUBE-MARK-MASQ rules // Setup KUBE-MARK-MASQ rules
masqueradeMark := getIPTablesMark(kl.iptablesMasqueradeBit) masqueradeMark := getIPTablesMark(kl.iptablesMasqueradeBit)
if _, err := iptClient.EnsureChain(utiliptables.TableNAT, KubeMarkMasqChain); err != nil { if _, err := iptClient.EnsureChain(utiliptables.TableNAT, KubeMarkMasqChain); err != nil {
klog.ErrorS(err, "Failed to ensure that nat table exists KUBE-MARK-MASQ chain") klog.ErrorS(err, "Failed to ensure that KUBE-MARK-MASQ chain exists")
return false return false
} }
if _, err := iptClient.EnsureChain(utiliptables.TableNAT, KubePostroutingChain); err != nil { if _, err := iptClient.EnsureChain(utiliptables.TableNAT, KubePostroutingChain); err != nil {
klog.ErrorS(err, "Failed to ensure that nat table exists kube POSTROUTING chain") klog.ErrorS(err, "Failed to ensure that KUBE-POSTROUTING chain exists")
return false return false
} }
if _, err := iptClient.EnsureRule(utiliptables.Append, utiliptables.TableNAT, KubeMarkMasqChain, "-j", "MARK", "--or-mark", masqueradeMark); err != nil { if _, err := iptClient.EnsureRule(utiliptables.Append, utiliptables.TableNAT, KubeMarkMasqChain, "-j", "MARK", "--or-mark", masqueradeMark); err != nil {
klog.ErrorS(err, "Failed to ensure marking rule for KUBE-MARK-MASQ chain") klog.ErrorS(err, "Failed to ensure that KUBE-MARK-MASQ rule exists")
return false return false
} }
if _, err := iptClient.EnsureRule(utiliptables.Prepend, utiliptables.TableNAT, utiliptables.ChainPostrouting, if _, err := iptClient.EnsureRule(utiliptables.Prepend, utiliptables.TableNAT, utiliptables.ChainPostrouting,
"-m", "comment", "--comment", "kubernetes postrouting rules", "-j", string(KubePostroutingChain)); err != nil { "-m", "comment", "--comment", "kubernetes postrouting rules", "-j", string(KubePostroutingChain)); err != nil {
klog.ErrorS(err, "Failed to ensure that nat table from POSTROUTING chain jumps to KUBE-POSTROUTING chain") klog.ErrorS(err, "Failed to ensure that POSTROUTING chain jumps to KUBE-POSTROUTING")
return false return false
} }
@ -150,7 +150,7 @@ func (kl *Kubelet) syncNetworkUtil(iptClient utiliptables.Interface) bool {
if _, err := iptClient.EnsureRule(utiliptables.Append, utiliptables.TableNAT, KubePostroutingChain, if _, err := iptClient.EnsureRule(utiliptables.Append, utiliptables.TableNAT, KubePostroutingChain,
"-m", "mark", "!", "--mark", fmt.Sprintf("%s/%s", masqueradeMark, masqueradeMark), "-m", "mark", "!", "--mark", fmt.Sprintf("%s/%s", masqueradeMark, masqueradeMark),
"-j", "RETURN"); err != nil { "-j", "RETURN"); err != nil {
klog.ErrorS(err, "Failed to ensure filtering rule for KUBE-POSTROUTING chain") klog.ErrorS(err, "Failed to ensure first masquerading rule exists")
return false return false
} }
// Clear the mark to avoid re-masquerading if the packet re-traverses the network stack. // Clear the mark to avoid re-masquerading if the packet re-traverses the network stack.
@ -158,7 +158,7 @@ func (kl *Kubelet) syncNetworkUtil(iptClient utiliptables.Interface) bool {
// to Sprintf another bitmask). // to Sprintf another bitmask).
if _, err := iptClient.EnsureRule(utiliptables.Append, utiliptables.TableNAT, KubePostroutingChain, if _, err := iptClient.EnsureRule(utiliptables.Append, utiliptables.TableNAT, KubePostroutingChain,
"-j", "MARK", "--xor-mark", masqueradeMark); err != nil { "-j", "MARK", "--xor-mark", masqueradeMark); err != nil {
klog.ErrorS(err, "Failed to ensure unmarking rule for KUBE-POSTROUTING chain") klog.ErrorS(err, "Failed to ensure second masquerading rule exists")
return false return false
} }
masqRule := []string{ masqRule := []string{
@ -169,7 +169,7 @@ func (kl *Kubelet) syncNetworkUtil(iptClient utiliptables.Interface) bool {
masqRule = append(masqRule, "--random-fully") masqRule = append(masqRule, "--random-fully")
} }
if _, err := iptClient.EnsureRule(utiliptables.Append, utiliptables.TableNAT, KubePostroutingChain, masqRule...); err != nil { if _, err := iptClient.EnsureRule(utiliptables.Append, utiliptables.TableNAT, KubePostroutingChain, masqRule...); err != nil {
klog.ErrorS(err, "Failed to ensure SNAT rule for packets marked by KUBE-MARK-MASQ chain in nat table KUBE-POSTROUTING chain") klog.ErrorS(err, "Failed to ensure third masquerading rule exists")
return false return false
} }