github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-28 22:17:14 +00:00
Code Issues Projects Releases Wiki Activity

Ipvs: non-local access to externalTrafficPolicy:Local

Browse Source 
Allow access to externalTrafficPolicy:Local services from PODs
not on a node where a server executes. Problem described in #93456
This commit is contained in:
Lars Ekman 2020-12-05 08:32:15 +01:00
parent 61b3c028ba
commit 61085a7589
2 changed files with 12 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
pkg/proxy/ipvs/proxier.go
View File

@ -1972,7 +1972,15 @@ func (proxier *Proxier) syncEndpoint(svcPortName proxy.ServicePortName, onlyNode
} else { } else {
clusterEndpoints, localEndpoints, _, _ := proxy.CategorizeEndpoints(endpoints, svcInfo, proxier.nodeLabels) clusterEndpoints, localEndpoints, _, _ := proxy.CategorizeEndpoints(endpoints, svcInfo, proxier.nodeLabels)
if onlyNodeLocalEndpoints { if onlyNodeLocalEndpoints {
endpoints = localEndpoints if len(localEndpoints) > 0 {
endpoints = localEndpoints
} else {
// https://github.com/kubernetes/kubernetes/pull/97081
// Allow access from local PODs even if no local endpoints exist.
// Traffic from an external source will be routed but the reply
// will have the POD address and will be discarded.
endpoints = clusterEndpoints
}
} else { } else {
endpoints = clusterEndpoints endpoints = clusterEndpoints
} }

5
pkg/proxy/ipvs/proxier_test.go
View File

@ -5319,10 +5319,11 @@ func Test_EndpointSliceOnlyReadyAndTerminatingLocalWithFeatureGateDisabled(t *te
assert.Len(t, realServers1, 1, "Expected 1 real servers") assert.Len(t, realServers1, 1, "Expected 1 real servers")
assert.Equal(t, realServers1[0].String(), "10.0.1.5:80") assert.Equal(t, realServers1[0].String(), "10.0.1.5:80")
// externalIP should have 0 endpoints since the feature gate is disabled. // externalIP should have 1 (remote) endpoint since the feature gate is disabled.
realServers2, rsErr2 := ipvs.GetRealServers(externalIPServer) realServers2, rsErr2 := ipvs.GetRealServers(externalIPServer)
assert.Nil(t, rsErr2, "Expected no error getting real servers") assert.Nil(t, rsErr2, "Expected no error getting real servers")
assert.Len(t, realServers2, 0, "Expected 0 real servers") assert.Len(t, realServers2, 1, "Expected 0 real servers")
assert.Equal(t, realServers2[0].String(), "10.0.1.5:80")
fp.OnEndpointSliceDelete(endpointSlice) fp.OnEndpointSliceDelete(endpointSlice)
fp.syncProxyRules() fp.syncProxyRules()