github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2026-01-05 23:47:50 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #78547 from MikeSpreitzer/fix-76699

Browse Source 
Make iptables and ipvs modes of kube-proxy MASQUERADE --random-fully if possible
This commit is contained in:
Kubernetes Prow Robot
2019-09-03 14:34:58 -07:00
committed by GitHub
parent 975d0736b3 d86d1defa1
commit 542f3c65a0
8 changed files with 123 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
pkg/proxy/ipvs/proxier.go
View File

@@ -1710,12 +1710,20 @@ func (proxier *Proxier) createAndLinkeKubeChain() {
// Install the kubernetes-specific postrouting rules. We use a whole chain for
// this so that it is easier to flush and change, for example if the mark
// value should ever change.
writeLine(proxier.natRules, []string{
// NB: THIS MUST MATCH the corresponding code in the kubelet
masqRule := []string{
"-A", string(kubePostroutingChain),
"-m", "comment", "--comment", `"kubernetes service traffic requiring SNAT"`,
"-m", "mark", "--mark", proxier.masqueradeMark,
"-j", "MASQUERADE",
}...)
}
if proxier.iptables.HasRandomFully() {
masqRule = append(masqRule, "--random-fully")
klog.V(3).Info("Using `--random-fully` in the MASQUERADE rule for iptables")
} else {
klog.V(2).Info("Not using `--random-fully` in the MASQUERADE rule for iptables because the local version of iptables does not support it")
}
writeLine(proxier.natRules, masqRule...)
// Install the kubernetes-specific masquerade mark rule. We use a whole chain for
// this so that it is easier to flush and change, for example if the mark