Remove IPTablesOwnershipCleanup checks and dead code

pkg/kubelet/kubelet_network_linux.go

@@ -20,13 +20,10 @@ limitations under the License.
 package kubelet
 
 import (
-	"fmt"
 	"time"
 
 	"k8s.io/apimachinery/pkg/util/wait"
-	utilfeature "k8s.io/apiserver/pkg/util/feature"
 	"k8s.io/klog/v2"
-	"k8s.io/kubernetes/pkg/features"
 	utiliptables "k8s.io/kubernetes/pkg/util/iptables"
 	utilexec "k8s.io/utils/exec"
 )
@@ -36,16 +33,6 @@ const (
 	// or iptables-nft indicates which version of iptables the system is using
 	KubeIPTablesHintChain utiliptables.Chain = "KUBE-IPTABLES-HINT"
 
-	// KubeMarkMasqChain is the mark-for-masquerade chain
-	// TODO: clean up this logic in kube-proxy
-	KubeMarkMasqChain utiliptables.Chain = "KUBE-MARK-MASQ"
-
-	// KubeMarkDropChain is the mark-for-drop chain
-	KubeMarkDropChain utiliptables.Chain = "KUBE-MARK-DROP"
-
-	// KubePostroutingChain is kubernetes postrouting rules
-	KubePostroutingChain utiliptables.Chain = "KUBE-POSTROUTING"
-
 	// KubeFirewallChain is kubernetes firewall rules
 	KubeFirewallChain utiliptables.Chain = "KUBE-FIREWALL"
 )
@@ -74,8 +61,7 @@ func (kl *Kubelet) initNetworkUtil() {
 }
 
 // syncIPTablesRules ensures the KUBE-IPTABLES-HINT chain exists, and the martian packet
-// protection rule is installed. If the IPTablesOwnershipCleanup feature gate is disabled
+// protection rule is installed.
-// it will also synchronize additional deprecated iptables rules.
 func (kl *Kubelet) syncIPTablesRules(iptClient utiliptables.Interface) bool {
 	// Create hint chain so other components can see whether we are using iptables-legacy
 	// or iptables-nft.
@@ -125,102 +111,5 @@ func (kl *Kubelet) syncIPTablesRules(iptClient utiliptables.Interface) bool {
 		}
 	}
 
-	if !utilfeature.DefaultFeatureGate.Enabled(features.IPTablesOwnershipCleanup) {
-		ok := kl.syncIPTablesRulesDeprecated(iptClient)
-		if !ok {
-			return false
-		}
-	}
-
 	return true
 }
-
-// syncIPTablesRulesDeprecated ensures deprecated iptables rules are present:
-//  1. In nat table, KUBE-MARK-DROP rule to mark connections for dropping
-//     Marked connection will be drop on INPUT/OUTPUT Chain in filter table
-//  2. In nat table, KUBE-MARK-MASQ rule to mark connections for SNAT
-//     Marked connection will get SNAT on POSTROUTING Chain in nat table
-func (kl *Kubelet) syncIPTablesRulesDeprecated(iptClient utiliptables.Interface) bool {
-	// Setup KUBE-MARK-DROP rules
-	dropMark := getIPTablesMark(kl.iptablesDropBit)
-	if _, err := iptClient.EnsureChain(utiliptables.TableNAT, KubeMarkDropChain); err != nil {
-		klog.ErrorS(err, "Failed to ensure that KUBE-MARK-DROP chain exists")
-		return false
-	}
-	if _, err := iptClient.EnsureRule(utiliptables.Append, utiliptables.TableNAT, KubeMarkDropChain, "-j", "MARK", "--or-mark", dropMark); err != nil {
-		klog.ErrorS(err, "Failed to ensure that KUBE-MARK-DROP rule exists")
-		return false
-	}
-	if _, err := iptClient.EnsureChain(utiliptables.TableFilter, KubeFirewallChain); err != nil {
-		klog.ErrorS(err, "Failed to ensure that KUBE-FIREWALL chain exists")
-		return false
-	}
-	if _, err := iptClient.EnsureRule(utiliptables.Append, utiliptables.TableFilter, KubeFirewallChain,
-		"-m", "comment", "--comment", "kubernetes firewall for dropping marked packets",
-		"-m", "mark", "--mark", fmt.Sprintf("%s/%s", dropMark, dropMark),
-		"-j", "DROP"); err != nil {
-		klog.ErrorS(err, "Failed to ensure that KUBE-FIREWALL rule exists")
-		return false
-	}
-
-	// Setup KUBE-MARK-MASQ rules
-	masqueradeMark := getIPTablesMark(kl.iptablesMasqueradeBit)
-	if _, err := iptClient.EnsureChain(utiliptables.TableNAT, KubeMarkMasqChain); err != nil {
-		klog.ErrorS(err, "Failed to ensure that KUBE-MARK-MASQ chain exists")
-		return false
-	}
-	if _, err := iptClient.EnsureChain(utiliptables.TableNAT, KubePostroutingChain); err != nil {
-		klog.ErrorS(err, "Failed to ensure that KUBE-POSTROUTING chain exists")
-		return false
-	}
-	if _, err := iptClient.EnsureRule(utiliptables.Append, utiliptables.TableNAT, KubeMarkMasqChain, "-j", "MARK", "--or-mark", masqueradeMark); err != nil {
-		klog.ErrorS(err, "Failed to ensure that KUBE-MARK-MASQ rule exists")
-		return false
-	}
-	if _, err := iptClient.EnsureRule(utiliptables.Prepend, utiliptables.TableNAT, utiliptables.ChainPostrouting,
-		"-m", "comment", "--comment", "kubernetes postrouting rules", "-j", string(KubePostroutingChain)); err != nil {
-		klog.ErrorS(err, "Failed to ensure that POSTROUTING chain jumps to KUBE-POSTROUTING")
-		return false
-	}
-
-	// Set up KUBE-POSTROUTING to unmark and masquerade marked packets
-
-	// NOTE: kube-proxy (in iptables and ipvs modes) creates identical copies of these
-	// rules. If you want to change these rules in the future, you MUST do so in a way
-	// that will interoperate correctly with skewed versions of the rules created by
-	// kube-proxy.
-
-	if _, err := iptClient.EnsureRule(utiliptables.Append, utiliptables.TableNAT, KubePostroutingChain,
-		"-m", "mark", "!", "--mark", fmt.Sprintf("%s/%s", masqueradeMark, masqueradeMark),
-		"-j", "RETURN"); err != nil {
-		klog.ErrorS(err, "Failed to ensure first masquerading rule exists")
-		return false
-	}
-	// Clear the mark to avoid re-masquerading if the packet re-traverses the network stack.
-	// We know the mark bit is currently set so we can use --xor-mark to clear it (without needing
-	// to Sprintf another bitmask).
-	if _, err := iptClient.EnsureRule(utiliptables.Append, utiliptables.TableNAT, KubePostroutingChain,
-		"-j", "MARK", "--xor-mark", masqueradeMark); err != nil {
-		klog.ErrorS(err, "Failed to ensure second masquerading rule exists")
-		return false
-	}
-	masqRule := []string{
-		"-m", "comment", "--comment", "kubernetes service traffic requiring SNAT",
-		"-j", "MASQUERADE",
-	}
-	if iptClient.HasRandomFully() {
-		masqRule = append(masqRule, "--random-fully")
-	}
-	if _, err := iptClient.EnsureRule(utiliptables.Append, utiliptables.TableNAT, KubePostroutingChain, masqRule...); err != nil {
-		klog.ErrorS(err, "Failed to ensure third masquerading rule exists")
-		return false
-	}
-
-	return true
-}
-
-// getIPTablesMark returns the fwmark given the bit
-func getIPTablesMark(bit int) string {
-	value := 1 << uint(bit)
-	return fmt.Sprintf("%#08x", value)
-}

pkg/kubelet/kubelet_network_test.go

@@ -1,46 +0,0 @@
-//go:build linux
-// +build linux
-
-/*
-Copyright 2016 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package kubelet
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestGetIPTablesMark(t *testing.T) {
-	tests := []struct {
-		bit    int
-		expect string
-	}{
-		{
-			14,
-			"0x00004000",
-		},
-		{
-			15,
-			"0x00008000",
-		},
-	}
-	for _, tc := range tests {
-		res := getIPTablesMark(tc.bit)
-		assert.Equal(t, tc.expect, res, "input %d", tc.bit)
-	}
-}

pkg/proxy/iptables/proxier.go

@@ -370,6 +370,7 @@ var iptablesJumpChains = []iptablesJumpChain{
 	{utiliptables.TableFilter, kubeProxyFirewallChain, utiliptables.ChainForward, "kubernetes load balancer firewall", []string{"-m", "conntrack", "--ctstate", "NEW"}},
 	{utiliptables.TableNAT, kubeServicesChain, utiliptables.ChainOutput, "kubernetes service portals", nil},
 	{utiliptables.TableNAT, kubeServicesChain, utiliptables.ChainPrerouting, "kubernetes service portals", nil},
+	{utiliptables.TableNAT, kubePostroutingChain, utiliptables.ChainPostrouting, "kubernetes postrouting rules", nil},
 }
 
 // Duplicates of chains created in pkg/kubelet/kubelet_network_linux.go; we create these
@@ -377,10 +378,6 @@ var iptablesJumpChains = []iptablesJumpChain{
 var iptablesKubeletJumpChains = []iptablesJumpChain{
 	{utiliptables.TableFilter, kubeletFirewallChain, utiliptables.ChainInput, "", nil},
 	{utiliptables.TableFilter, kubeletFirewallChain, utiliptables.ChainOutput, "", nil},
-
-	// Move this to iptablesJumpChains once IPTablesOwnershipCleanup is GA and kubelet
-	// no longer creates this chain,
-	{utiliptables.TableNAT, kubePostroutingChain, utiliptables.ChainPostrouting, "kubernetes postrouting rules", nil},
 }
 
 // When chains get removed from iptablesJumpChains, add them here so they get cleaned up
@@ -868,11 +865,6 @@ func (proxier *Proxier) syncProxyRules() {
 	// this so that it is easier to flush and change, for example if the mark
 	// value should ever change.
 
-	// NOTE: kubelet creates identical copies of these rules. If you want to change
-	// these rules in the future, you MUST do so in a way that will interoperate
-	// correctly with skewed versions of the rules created by kubelet. (Remove this
-	// comment once IPTablesOwnershipCleanup is GA.)
-
 	proxier.natRules.Write(
 		"-A", string(kubePostroutingChain),
 		"-m", "mark", "!", "--mark", fmt.Sprintf("%s/%s", proxier.masqueradeMark, proxier.masqueradeMark),

pkg/proxy/ipvs/proxier.go

@@ -1693,11 +1693,6 @@ func (proxier *Proxier) writeIptablesRules() {
 	// this so that it is easier to flush and change, for example if the mark
 	// value should ever change.
 
-	// NOTE: kubelet creates identical copies of these rules. If you want to change
-	// these rules in the future, you MUST do so in a way that will interoperate
-	// correctly with skewed versions of the rules created by kubelet. (Remove this
-	// comment once IPTablesOwnershipCleanup is GA.)
-
 	proxier.natRules.Write(
 		"-A", string(kubePostroutingChain),
 		"-m", "mark", "!", "--mark", fmt.Sprintf("%s/%s", proxier.masqueradeMark, proxier.masqueradeMark),