From 252646b8de412abc80c61379b78dced1524cceef Mon Sep 17 00:00:00 2001 From: Tim Hockin Date: Fri, 26 May 2017 17:01:58 -0700 Subject: [PATCH] Deprecate kubelet non-masquerade-cidr Also do not install iptables rules if it is set to 0.0.0.0/0 --- cmd/kubelet/app/options/options.go | 3 ++- pkg/kubelet/network/kubenet/kubenet_linux.go | 14 ++++++++------ 2 files changed, 10 insertions(+), 7 deletions(-) diff --git a/cmd/kubelet/app/options/options.go b/cmd/kubelet/app/options/options.go index d8e2b8a1200..a825d7aa5fc 100644 --- a/cmd/kubelet/app/options/options.go +++ b/cmd/kubelet/app/options/options.go @@ -263,7 +263,8 @@ func (c *kubeletConfiguration) addFlags(fs *pflag.FlagSet) { // TODO(#40229): Remove the docker-exec-handler flag. fs.StringVar(&c.DockerExecHandlerName, "docker-exec-handler", c.DockerExecHandlerName, "Handler to use when executing a command in a container. Valid values are 'native' and 'nsenter'.") fs.MarkDeprecated("docker-exec-handler", "this flag will be removed and only the 'native' handler will be supported in the future.") - fs.StringVar(&c.NonMasqueradeCIDR, "non-masquerade-cidr", c.NonMasqueradeCIDR, "Traffic to IPs outside this range will use IP masquerade.") + fs.StringVar(&c.NonMasqueradeCIDR, "non-masquerade-cidr", c.NonMasqueradeCIDR, "Traffic to IPs outside this range will use IP masquerade. Set to '0.0.0.0/0' to never masquerade.") + fs.MarkDeprecated("non-masquerade-cidr", "will be removed in a future version") fs.StringVar(&c.PodCIDR, "pod-cidr", "", "The CIDR to use for pod IP addresses, only used in standalone mode. In cluster mode, this is obtained from the master.") fs.StringVar(&c.ResolverConfig, "resolv-conf", c.ResolverConfig, "Resolver configuration file used as the basis for the container DNS resolution configuration.") fs.BoolVar(&c.CPUCFSQuota, "cpu-cfs-quota", c.CPUCFSQuota, "Enable CPU CFS quota enforcement for containers that specify CPU limits") diff --git a/pkg/kubelet/network/kubenet/kubenet_linux.go b/pkg/kubelet/network/kubenet/kubenet_linux.go index 86224c3e46e..2b9ab97bb01 100644 --- a/pkg/kubelet/network/kubenet/kubenet_linux.go +++ b/pkg/kubelet/network/kubenet/kubenet_linux.go @@ -179,12 +179,14 @@ func (plugin *kubenetNetworkPlugin) Init(host network.Host, hairpinMode componen // TODO: move thic logic into cni bridge plugin and remove this from kubenet func (plugin *kubenetNetworkPlugin) ensureMasqRule() error { - if _, err := plugin.iptables.EnsureRule(utiliptables.Append, utiliptables.TableNAT, utiliptables.ChainPostrouting, - "-m", "comment", "--comment", "kubenet: SNAT for outbound traffic from cluster", - "-m", "addrtype", "!", "--dst-type", "LOCAL", - "!", "-d", plugin.nonMasqueradeCIDR, - "-j", "MASQUERADE"); err != nil { - return fmt.Errorf("Failed to ensure that %s chain %s jumps to MASQUERADE: %v", utiliptables.TableNAT, utiliptables.ChainPostrouting, err) + if plugin.nonMasqueradeCIDR != "0.0.0.0/0" { + if _, err := plugin.iptables.EnsureRule(utiliptables.Append, utiliptables.TableNAT, utiliptables.ChainPostrouting, + "-m", "comment", "--comment", "kubenet: SNAT for outbound traffic from cluster", + "-m", "addrtype", "!", "--dst-type", "LOCAL", + "!", "-d", plugin.nonMasqueradeCIDR, + "-j", "MASQUERADE"); err != nil { + return fmt.Errorf("Failed to ensure that %s chain %s jumps to MASQUERADE: %v", utiliptables.TableNAT, utiliptables.ChainPostrouting, err) + } } return nil }