github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2026-02-22 07:03:28 +00:00
Code Issues Projects Releases Wiki Activity

test: Read /proc/net/nf_conntrack instead of using conntrack binary

Browse Source 
The distroless-iptables image no longer includes the conntrack binary
as of v0.8.7 (removed in kubernetes/release#4223 since kube-proxy no
longer needs it after kubernetes#126847).

Update the KubeProxy CLOSE_WAIT timeout test to read /proc/net/nf_conntrack
directly instead of using the conntrack command. The file contains the
same connection tracking data and is accessible from the privileged
host-network pod.

Signed-off-by: Davanum Srinivas <davanum@gmail.com>
This commit is contained in:
Davanum Srinivas
2026-01-25 20:40:33 +00:00
parent 766a195b2a
commit 404bf4b04d
1 changed files with 12 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
test/e2e/network/kube_proxy.go
View File

@@ -218,11 +218,12 @@ var _ = common.SIGDescribe("KubeProxy", func() {
if netutils.IsIPv6String(ip) {
ipFamily = "ipv6"
}
// Obtain the corresponding conntrack entry on the host checking
// the nf_conntrack file from the pod e2e-net-exec.
// Obtain the corresponding conntrack entry on the host by reading
// /proc/net/nf_conntrack directly from the pod e2e-net-exec.
// This avoids dependency on the conntrack binary.
// It retries in a loop if the entry is not found.
cmd := fmt.Sprintf("conntrack -L -f %s -d %v "+
"| grep -m 1 'CLOSE_WAIT.*dport=%v' ",
cmd := fmt.Sprintf("cat /proc/net/nf_conntrack "+
"| grep -m 1 -E '%s.*CLOSE_WAIT.*dst=%v.*dport=%v'",
ipFamily, ip, testDaemonTCPPort)
if err := wait.PollImmediate(2*time.Second, epsilonSeconds*time.Second, func() (bool, error) {
result, err := e2epodoutput.RunHostCmd(fr.Namespace.Name, "e2e-net-exec", cmd)
@@ -232,14 +233,15 @@ var _ = common.SIGDescribe("KubeProxy", func() {
return false, nil
}
framework.Logf("conntrack entry for node %v and port %v: %v", serverNodeInfo.nodeIP, testDaemonTCPPort, result)
// Timeout in seconds is available as the third column of the matched entry
// /proc/net/nf_conntrack format: ipv4 2 tcp 6 <timeout> <state> src=... dst=...
// Timeout in seconds is available as the fifth column (index 4)
line := strings.Fields(result)
if len(line) < 3 {
if len(line) < 5 {
return false, fmt.Errorf("conntrack entry does not have a timeout field: %v", line)
}
timeoutSeconds, err := strconv.Atoi(line[2])
timeoutSeconds, err := strconv.Atoi(line[4])
if err != nil {
return false, fmt.Errorf("failed to convert matched timeout %s to integer: %w", line[2], err)
return false, fmt.Errorf("failed to convert matched timeout %s to integer: %w", line[4], err)
}
if math.Abs(float64(timeoutSeconds-expectedTimeoutSeconds)) < epsilonSeconds {
return true, nil
@@ -247,9 +249,9 @@ var _ = common.SIGDescribe("KubeProxy", func() {
return false, fmt.Errorf("wrong TCP CLOSE_WAIT timeout: %v expected: %v", timeoutSeconds, expectedTimeoutSeconds)
}); err != nil {
// Dump all conntrack entries for debugging
result, err2 := e2epodoutput.RunHostCmd(fr.Namespace.Name, "e2e-net-exec", "conntrack -L")
result, err2 := e2epodoutput.RunHostCmd(fr.Namespace.Name, "e2e-net-exec", "cat /proc/net/nf_conntrack")
if err2 != nil {
framework.Logf("failed to obtain conntrack entry: %v %v", result, err2)
framework.Logf("failed to read /proc/net/nf_conntrack: %v %v", result, err2)
}
framework.Logf("conntrack entries for node %v: %v", serverNodeInfo.nodeIP, result)
framework.Failf("no valid conntrack entry for port %d on node %s: %v", testDaemonTCPPort, serverNodeInfo.nodeIP, err)