github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-24 04:06:03 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #27136 from andyzheng0831/gci-firewall

Browse Source 
Automatic merge from submit-queue

Trusty: fix the 'ping' issue and fluentd-gcp issue #26379

This PR is mainly for being picking up the fix in #27016 and #27102 in trusty code, so that we can fix the issues in the release-1.2 branch for GCI. It contains two parts:

(1) Adding iptables rules to accept ICMP traffic, otherwise 'ping' from a pod does not work;

(2) Revising the code for cleaning up docker0 stuff including the bridge and iptables rules. I slightly refactor the code of starting kubelet and removing docker0 stuff before starting kubelet. The old code did it after starting kubelet but before restarting docker. I think doing it before starting kubelet is safter.

cc/ @roberthbailey @fabioy @dchen1107 @a-robinson @kubernetes/goog-image
This commit is contained in:
k8s-merge-robot 2016-06-10 02:33:49 -07:00 committed by GitHub
commit 38a1fb2b96
3 changed files with 19 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
cluster/gce/trusty/configure-helper.sh
View File

@ -29,16 +29,18 @@ config_hostname() {
config_ip_firewall() {
# We have seen that GCE image may have strict host firewall rules which drop
# most inbound/forwarded packets. In such a case, add rules to accept all
# TCP/UDP packets.
# TCP/UDP/ICMP packets.
if iptables -L INPUT | grep "Chain INPUT (policy DROP)" > /dev/null; then
echo "Add rules to accpet all inbound TCP/UDP packets"
echo "Add rules to accpet all inbound TCP/UDP/ICMP packets"
iptables -A INPUT -w -p TCP -j ACCEPT
iptables -A INPUT -w -p UDP -j ACCEPT
iptables -A INPUT -w -p ICMP -j ACCEPT
fi
if iptables -L FORWARD | grep "Chain FORWARD (policy DROP)" > /dev/null; then
echo "Add rules to accpet all forwarded TCP/UDP packets"
echo "Add rules to accpet all forwarded TCP/UDP/ICMP packets"
iptables -A FORWARD -w -p TCP -j ACCEPT
iptables -A FORWARD -w -p UDP -j ACCEPT
iptables -A FORWARD -w -p ICMP -j ACCEPT
fi
}
@ -182,6 +184,16 @@ assemble_kubelet_flags() {
echo "KUBELET_OPTS=\"${KUBELET_CMD_FLAGS}\"" > /etc/default/kubelet
}
start_kubelet(){
echo "Start kubelet"
# Delete docker0 to avoid interference
iptables -t nat -F || true
ip link set docker0 down || true
brctl delbr docker0 || true
. /etc/default/kubelet
/usr/bin/kubelet ${KUBELET_OPTS} 1>>/var/log/kubelet.log 2>&1
}
restart_docker_daemon() {
DOCKER_OPTS="-p /var/run/docker.pid --bridge=cbr0 --iptables=false --ip-masq=false"
if [ "${TEST_CLUSTER:-}" = "true" ]; then
@ -200,9 +212,6 @@ restart_docker_daemon() {
echo "Sleep 1 second to wait for cbr0"
sleep 1
done
# Remove docker0
ifconfig docker0 down
brctl delbr docker0
# Ensure docker daemon is really functional before exiting. Operations afterwards may
# assume it is running.
while ! docker version > /dev/null; do

5
cluster/gce/trusty/master.yaml
View File

@ -134,9 +134,8 @@ script
set -o errexit
set -o nounset
echo "Start kubelet upstart job"
. /etc/default/kubelet
/usr/bin/kubelet ${KUBELET_OPTS} 1>>/var/log/kubelet.log 2>&1
. /etc/kube-configure-helper.sh
start_kubelet
} 2>&1 | logger --priority daemon.info -t ${UPSTART_JOB}
end script

5
cluster/gce/trusty/node.yaml
View File

@ -132,9 +132,8 @@ script
set -o errexit
set -o nounset
echo "Start kubelet upstart job"
. /etc/default/kubelet
/usr/bin/kubelet ${KUBELET_OPTS} 1>>/var/log/kubelet.log 2>&1
. /etc/kube-configure-helper.sh
start_kubelet
} 2>&1 | logger --priority daemon.info -t ${UPSTART_JOB}
end script