github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-31 15:25:57 +00:00
Code Issues Projects Releases Wiki Activity

NodePorts understand OnlyLocal

Browse Source
This commit is contained in:
bprashanth 2016-09-26 11:24:35 -07:00
parent 5f4c8c241e
commit 93f9b54cab
1 changed files with 18 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
pkg/proxy/iptables/proxier.go
View File

@ -1070,10 +1070,14 @@ func (proxier *Proxier) syncProxyRules() {
"-m", protocol, "-p", protocol, "-m", protocol, "-p", protocol,
"--dport", fmt.Sprintf("%d", svcInfo.nodePort), "--dport", fmt.Sprintf("%d", svcInfo.nodePort),
} }
// Nodeports need SNAT. if !svcInfo.onlyNodeLocalEndpoints {
writeLine(natRules, append(args, "-j", string(KubeMarkMasqChain))...) // Nodeports need SNAT, unless they're local.
// Jump to the service chain. writeLine(natRules, append(args, "-j", string(KubeMarkMasqChain))...)
writeLine(natRules, append(args, "-j", string(svcChain))...) // Jump to the service chain.
writeLine(natRules, append(args, "-j", string(svcChain))...)
} else {
writeLine(natRules, append(args, "-j", string(svcXlbChain))...)
}
} }
// If the service has no endpoints then reject packets. // If the service has no endpoints then reject packets.
@ -1173,6 +1177,16 @@ func (proxier *Proxier) syncProxyRules() {
localEndpointChains = append(localEndpointChains, endpointChains[i]) localEndpointChains = append(localEndpointChains, endpointChains[i])
} }
} }
// First rule in the chain redirects all pod -> external vip traffic to the
// Service's ClusterIP instead. This happens whether or not we have local
// endpoints.
args = []string{
"-A", string(svcXlbChain),
"-m", "comment", "--comment",
fmt.Sprintf(`"Redirect pods trying to reach external loadbalancer VIP to clusterIP"`),
}
writeLine(natRules, append(args, "-s", proxier.clusterCIDR, "-j", string(svcChain))...)
numLocalEndpoints := len(localEndpointChains) numLocalEndpoints := len(localEndpointChains)
if numLocalEndpoints == 0 { if numLocalEndpoints == 0 {
// Blackhole all traffic since there are no local endpoints // Blackhole all traffic since there are no local endpoints