mirror of
https://github.com/k3s-io/kubernetes.git
synced 2025-07-24 04:06:03 +00:00
Corrects target in the KUBE-IPVS-FILTER chain
The target was "ACCEPT" which disabled any other check like loadBalancerSourceRanges in the KUBE-PROXY-FIREWALL chain. The target is now "RETURN".
This commit is contained in:
parent
80ddaf23a8
commit
639b9bca5d
@ -1807,13 +1807,13 @@ func (proxier *Proxier) writeIptablesRules() {
|
||||
// https://github.com/kubernetes/kubernetes/issues/72236
|
||||
proxier.filterRules.Write(
|
||||
"-A", string(kubeIPVSFilterChain),
|
||||
"-m", "set", "--match-set", proxier.ipsetList[kubeLoadBalancerSet].Name, "dst,dst", "-j", "ACCEPT")
|
||||
"-m", "set", "--match-set", proxier.ipsetList[kubeLoadBalancerSet].Name, "dst,dst", "-j", "RETURN")
|
||||
proxier.filterRules.Write(
|
||||
"-A", string(kubeIPVSFilterChain),
|
||||
"-m", "set", "--match-set", proxier.ipsetList[kubeClusterIPSet].Name, "dst,dst", "-j", "ACCEPT")
|
||||
"-m", "set", "--match-set", proxier.ipsetList[kubeClusterIPSet].Name, "dst,dst", "-j", "RETURN")
|
||||
proxier.filterRules.Write(
|
||||
"-A", string(kubeIPVSFilterChain),
|
||||
"-m", "set", "--match-set", proxier.ipsetList[kubeExternalIPSet].Name, "dst,dst", "-j", "ACCEPT")
|
||||
"-m", "set", "--match-set", proxier.ipsetList[kubeExternalIPSet].Name, "dst,dst", "-j", "RETURN")
|
||||
proxier.filterRules.Write(
|
||||
"-A", string(kubeIPVSFilterChain),
|
||||
"-m", "conntrack", "--ctstate", "NEW",
|
||||
|
Loading…
Reference in New Issue
Block a user