From 780d5954e0bbd933fcdbe3ac1ce0b1857e543322 Mon Sep 17 00:00:00 2001 From: Dan Winship Date: Tue, 21 Nov 2017 12:25:27 -0500 Subject: [PATCH] Split out a KUBE-EXTERNAL-SERVICES chain so we don't have to run KUBE-SERVICES from INPUT --- pkg/proxy/iptables/proxier.go | 20 ++++++++++++++------ pkg/proxy/iptables/proxier_test.go | 4 ++-- 2 files changed, 16 insertions(+), 8 deletions(-) diff --git a/pkg/proxy/iptables/proxier.go b/pkg/proxy/iptables/proxier.go index fba1aae6fa5..42109ad1f4c 100644 --- a/pkg/proxy/iptables/proxier.go +++ b/pkg/proxy/iptables/proxier.go @@ -67,6 +67,9 @@ const ( // the services chain kubeServicesChain utiliptables.Chain = "KUBE-SERVICES" + // the external services chain + kubeExternalServicesChain utiliptables.Chain = "KUBE-EXTERNAL-SERVICES" + // the nodeports chain kubeNodePortsChain utiliptables.Chain = "KUBE-NODEPORTS" @@ -505,7 +508,7 @@ type iptablesJumpChain struct { } var iptablesJumpChains = []iptablesJumpChain{ - {utiliptables.TableFilter, kubeServicesChain, utiliptables.ChainInput, "kubernetes service portals"}, + {utiliptables.TableFilter, kubeExternalServicesChain, utiliptables.ChainInput, "kubernetes externally-visible service portals"}, {utiliptables.TableFilter, kubeServicesChain, utiliptables.ChainOutput, "kubernetes service portals"}, {utiliptables.TableNAT, kubeServicesChain, utiliptables.ChainOutput, "kubernetes service portals"}, {utiliptables.TableNAT, kubeServicesChain, utiliptables.ChainPrerouting, "kubernetes service portals"}, @@ -513,11 +516,16 @@ var iptablesJumpChains = []iptablesJumpChain{ {utiliptables.TableFilter, kubeForwardChain, utiliptables.ChainForward, "kubernetes forwarding rules"}, } +var iptablesCleanupOnlyChains = []iptablesJumpChain{ + // Present in kube 1.6 - 1.9. Removed by #56164 in favor of kubeExternalServicesChain + {utiliptables.TableFilter, kubeServicesChain, utiliptables.ChainInput, "kubernetes service portals"}, +} + // CleanupLeftovers removes all iptables rules and chains created by the Proxier // It returns true if an error was encountered. Errors are logged. func CleanupLeftovers(ipt utiliptables.Interface) (encounteredError bool) { // Unlink our chains - for _, chain := range iptablesJumpChains { + for _, chain := range append(iptablesJumpChains, iptablesCleanupOnlyChains...) { args := []string{ "-m", "comment", "--comment", chain.comment, "-j", string(chain.chain), @@ -576,7 +584,7 @@ func CleanupLeftovers(ipt utiliptables.Interface) (encounteredError bool) { filterChains := bytes.NewBuffer(nil) filterRules := bytes.NewBuffer(nil) writeLine(filterChains, "*filter") - for _, chain := range []utiliptables.Chain{kubeServicesChain, kubeForwardChain} { + for _, chain := range []utiliptables.Chain{kubeServicesChain, kubeExternalServicesChain, kubeForwardChain} { if _, found := existingFilterChains[chain]; found { chainString := string(chain) writeLine(filterChains, existingFilterChains[chain]) @@ -1033,7 +1041,7 @@ func (proxier *Proxier) syncProxyRules() { // Make sure we keep stats for the top-level chains, if they existed // (which most should have because we created them above). - for _, chainName := range []utiliptables.Chain{kubeServicesChain, kubeForwardChain} { + for _, chainName := range []utiliptables.Chain{kubeServicesChain, kubeExternalServicesChain, kubeForwardChain} { if chain, ok := existingFilterChains[chainName]; ok { writeLine(proxier.filterChains, chain) } else { @@ -1199,7 +1207,7 @@ func (proxier *Proxier) syncProxyRules() { // Install ICMP Reject rule in filter table for destination=externalIP and dport=svcport if len(proxier.endpointsMap[svcName]) == 0 { writeLine(proxier.filterRules, - "-A", string(kubeServicesChain), + "-A", string(kubeExternalServicesChain), "-m", "comment", "--comment", fmt.Sprintf(`"%s has no endpoints"`, svcNameString), "-m", protocol, "-p", protocol, "-d", utilproxy.ToCIDR(net.ParseIP(externalIP)), @@ -1340,7 +1348,7 @@ func (proxier *Proxier) syncProxyRules() { // chain. if len(proxier.endpointsMap[svcName]) == 0 { writeLine(proxier.filterRules, - "-A", string(kubeServicesChain), + "-A", string(kubeExternalServicesChain), "-m", "comment", "--comment", fmt.Sprintf(`"%s has no endpoints"`, svcNameString), "-m", "addrtype", "--dst-type", "LOCAL", "-m", protocol, "-p", protocol, diff --git a/pkg/proxy/iptables/proxier_test.go b/pkg/proxy/iptables/proxier_test.go index 6308d4cc0f6..63c9b345063 100644 --- a/pkg/proxy/iptables/proxier_test.go +++ b/pkg/proxy/iptables/proxier_test.go @@ -811,7 +811,7 @@ func TestExternalIPsReject(t *testing.T) { fp.syncProxyRules() - kubeSvcRules := ipt.GetRules(string(kubeServicesChain)) + kubeSvcRules := ipt.GetRules(string(kubeExternalServicesChain)) if !hasJump(kubeSvcRules, iptablestest.Reject, svcExternalIPs, svcPort) { errorf(fmt.Sprintf("Failed to a %v rule for externalIP %v with no endpoints", iptablestest.Reject, svcPortName), kubeSvcRules, t) } @@ -844,7 +844,7 @@ func TestNodePortReject(t *testing.T) { fp.syncProxyRules() - kubeSvcRules := ipt.GetRules(string(kubeServicesChain)) + kubeSvcRules := ipt.GetRules(string(kubeExternalServicesChain)) if !hasJump(kubeSvcRules, iptablestest.Reject, svcIP, svcNodePort) { errorf(fmt.Sprintf("Failed to find a %v rule for service %v with no endpoints", iptablestest.Reject, svcPortName), kubeSvcRules, t) }