From f1e7386fbc4008e8079ff0d3eb142c935ec3ba57 Mon Sep 17 00:00:00 2001 From: Dan Winship Date: Mon, 17 Jul 2023 09:37:17 -0400 Subject: [PATCH] Deprecate now-unused kubelet iptables flags --- cmd/kubelet/app/options/options.go | 6 ++++-- pkg/generated/openapi/zz_generated.openapi.go | 6 +++--- pkg/kubelet/apis/config/types.go | 16 +++++++-------- pkg/kubelet/kubelet.go | 20 ------------------- .../k8s.io/kubelet/config/v1beta1/types.go | 18 ++++++++--------- 5 files changed, 22 insertions(+), 44 deletions(-) diff --git a/cmd/kubelet/app/options/options.go b/cmd/kubelet/app/options/options.go index 2afe0652123..0328e0ec0cf 100644 --- a/cmd/kubelet/app/options/options.go +++ b/cmd/kubelet/app/options/options.go @@ -465,8 +465,10 @@ func AddKubeletConfigFlags(mainfs *pflag.FlagSet, c *kubeletconfig.KubeletConfig fs.DurationVar(&c.CPUCFSQuotaPeriod.Duration, "cpu-cfs-quota-period", c.CPUCFSQuotaPeriod.Duration, "Sets CPU CFS quota period value, cpu.cfs_period_us, defaults to Linux Kernel default") fs.BoolVar(&c.EnableControllerAttachDetach, "enable-controller-attach-detach", c.EnableControllerAttachDetach, "Enables the Attach/Detach controller to manage attachment/detachment of volumes scheduled to this node, and disables kubelet from executing any attach/detach operations") fs.BoolVar(&c.MakeIPTablesUtilChains, "make-iptables-util-chains", c.MakeIPTablesUtilChains, "If true, kubelet will ensure iptables utility rules are present on host.") - fs.Int32Var(&c.IPTablesMasqueradeBit, "iptables-masquerade-bit", c.IPTablesMasqueradeBit, "The bit of the fwmark space to mark packets for SNAT. Must be within the range [0, 31]. Please match this parameter with corresponding parameter in kube-proxy.") - fs.Int32Var(&c.IPTablesDropBit, "iptables-drop-bit", c.IPTablesDropBit, "The bit of the fwmark space to mark packets for dropping. Must be within the range [0, 31].") + fs.Int32Var(&c.IPTablesMasqueradeBit, "iptables-masquerade-bit", c.IPTablesMasqueradeBit, "Has no effect; use kube-proxy parameters to configure the KUBE-MARK-MASQ chain.") + fs.MarkDeprecated("iptables-masquerade-bit", "This flag has no effect and will be removed in a future version.") + fs.Int32Var(&c.IPTablesDropBit, "iptables-drop-bit", c.IPTablesDropBit, "Has no effect; kubelet no longer creates a KUBE-MARK-DROP chain") + fs.MarkDeprecated("iptables-drop-bit", "This flag has no effect and will be removed in a future version.") fs.StringVar(&c.ContainerLogMaxSize, "container-log-max-size", c.ContainerLogMaxSize, " Set the maximum size (e.g. 10Mi) of container log file before it is rotated.") fs.Int32Var(&c.ContainerLogMaxFiles, "container-log-max-files", c.ContainerLogMaxFiles, " Set the maximum number of container log files that can be present for a container. The number must be >= 2.") fs.StringSliceVar(&c.AllowedUnsafeSysctls, "allowed-unsafe-sysctls", c.AllowedUnsafeSysctls, "Comma-separated whitelist of unsafe sysctls or unsafe sysctl patterns (ending in *). Use these at your own risk.") diff --git a/pkg/generated/openapi/zz_generated.openapi.go b/pkg/generated/openapi/zz_generated.openapi.go index 504b7d0bc15..672aee5c91e 100644 --- a/pkg/generated/openapi/zz_generated.openapi.go +++ b/pkg/generated/openapi/zz_generated.openapi.go @@ -57905,21 +57905,21 @@ func schema_k8sio_kubelet_config_v1beta1_KubeletConfiguration(ref common.Referen }, "makeIPTablesUtilChains": { SchemaProps: spec.SchemaProps{ - Description: "makeIPTablesUtilChains, if true, causes the Kubelet ensures a set of iptables rules are present on host. These rules will serve as utility rules for various components, e.g. kube-proxy. The rules will be created based on iptablesMasqueradeBit and iptablesDropBit. Default: true", + Description: "makeIPTablesUtilChains, if true, causes the Kubelet to create the KUBE-IPTABLES-HINT chain in iptables as a hint to other components about the configuration of iptables on the system. Default: true", Type: []string{"boolean"}, Format: "", }, }, "iptablesMasqueradeBit": { SchemaProps: spec.SchemaProps{ - Description: "iptablesMasqueradeBit is the bit of the iptables fwmark space to mark for SNAT. Values must be within the range [0, 31]. Must be different from other mark bits. Warning: Please match the value of the corresponding parameter in kube-proxy. Default: 14", + Description: "iptablesMasqueradeBit formerly controlled the creation of the KUBE-MARK-MASQ chain. Deprecated: no longer has any effect. Default: 14", Type: []string{"integer"}, Format: "int32", }, }, "iptablesDropBit": { SchemaProps: spec.SchemaProps{ - Description: "iptablesDropBit is the bit of the iptables fwmark space to mark for dropping packets. Values must be within the range [0, 31]. Must be different from other mark bits. Default: 15", + Description: "iptablesDropBit formerly controlled the creation of the KUBE-MARK-DROP chain. Deprecated: no longer has any effect. Default: 15", Type: []string{"integer"}, Format: "int32", }, diff --git a/pkg/kubelet/apis/config/types.go b/pkg/kubelet/apis/config/types.go index 8021a6e0667..1bff0cec0ca 100644 --- a/pkg/kubelet/apis/config/types.go +++ b/pkg/kubelet/apis/config/types.go @@ -319,17 +319,15 @@ type KubeletConfiguration struct { // flags are not as it expects. Otherwise the Kubelet will attempt to modify // kernel flags to match its expectation. ProtectKernelDefaults bool - // If true, Kubelet ensures a set of iptables rules are present on host. - // These rules will serve as utility for various components, e.g. kube-proxy. - // The rules will be created based on IPTablesMasqueradeBit and IPTablesDropBit. + // If true, Kubelet creates the KUBE-IPTABLES-HINT chain in iptables as a hint to + // other components about the configuration of iptables on the system. MakeIPTablesUtilChains bool - // iptablesMasqueradeBit is the bit of the iptables fwmark space to mark for SNAT - // Values must be within the range [0, 31]. Must be different from other mark bits. - // Warning: Please match the value of the corresponding parameter in kube-proxy. - // TODO: clean up IPTablesMasqueradeBit in kube-proxy + // iptablesMasqueradeBit formerly controlled the creation of the KUBE-MARK-MASQ + // chain. + // Deprecated: no longer has any effect. IPTablesMasqueradeBit int32 - // iptablesDropBit is the bit of the iptables fwmark space to mark for dropping packets. - // Values must be within the range [0, 31]. Must be different from other mark bits. + // iptablesDropBit formerly controlled the creation of the KUBE-MARK-DROP chain. + // Deprecated: no longer has any effect. IPTablesDropBit int32 // featureGates is a map of feature names to bools that enable or disable alpha/experimental // features. This field modifies piecemeal the built-in default values from diff --git a/pkg/kubelet/kubelet.go b/pkg/kubelet/kubelet.go index 709e35015fb..e8918472ee8 100644 --- a/pkg/kubelet/kubelet.go +++ b/pkg/kubelet/kubelet.go @@ -371,18 +371,6 @@ func NewMainKubelet(kubeCfg *kubeletconfiginternal.KubeletConfiguration, return nil, fmt.Errorf("invalid sync frequency %d", kubeCfg.SyncFrequency.Duration) } - if kubeCfg.MakeIPTablesUtilChains { - if kubeCfg.IPTablesMasqueradeBit > 31 || kubeCfg.IPTablesMasqueradeBit < 0 { - return nil, fmt.Errorf("iptables-masquerade-bit is not valid. Must be within [0, 31]") - } - if kubeCfg.IPTablesDropBit > 31 || kubeCfg.IPTablesDropBit < 0 { - return nil, fmt.Errorf("iptables-drop-bit is not valid. Must be within [0, 31]") - } - if kubeCfg.IPTablesDropBit == kubeCfg.IPTablesMasqueradeBit { - return nil, fmt.Errorf("iptables-masquerade-bit and iptables-drop-bit must be different") - } - } - if utilfeature.DefaultFeatureGate.Enabled(features.DisableCloudProviders) && cloudprovider.IsDeprecatedInternal(cloudProvider) { cloudprovider.DisableWarningForProvider(cloudProvider) return nil, fmt.Errorf("cloud provider %q was specified, but built-in cloud providers are disabled. Please set --cloud-provider=external and migrate to an external cloud provider", cloudProvider) @@ -561,8 +549,6 @@ func NewMainKubelet(kubeCfg *kubeletconfiginternal.KubeletConfiguration, clock: clock.RealClock{}, enableControllerAttachDetach: kubeCfg.EnableControllerAttachDetach, makeIPTablesUtilChains: kubeCfg.MakeIPTablesUtilChains, - iptablesMasqueradeBit: int(kubeCfg.IPTablesMasqueradeBit), - iptablesDropBit: int(kubeCfg.IPTablesDropBit), keepTerminatedPodVolumes: keepTerminatedPodVolumes, nodeStatusMaxImages: nodeStatusMaxImages, tracer: tracer, @@ -1276,12 +1262,6 @@ type Kubelet struct { // config iptables util rules makeIPTablesUtilChains bool - // The bit of the fwmark space to mark packets for SNAT. - iptablesMasqueradeBit int - - // The bit of the fwmark space to mark packets for dropping. - iptablesDropBit int - // The AppArmor validator for checking whether AppArmor is supported. appArmorValidator apparmor.Validator diff --git a/staging/src/k8s.io/kubelet/config/v1beta1/types.go b/staging/src/k8s.io/kubelet/config/v1beta1/types.go index 16f4831cd01..b1ad1353fca 100644 --- a/staging/src/k8s.io/kubelet/config/v1beta1/types.go +++ b/staging/src/k8s.io/kubelet/config/v1beta1/types.go @@ -548,22 +548,20 @@ type KubeletConfiguration struct { // Default: false // +optional ProtectKernelDefaults bool `json:"protectKernelDefaults,omitempty"` - // makeIPTablesUtilChains, if true, causes the Kubelet ensures a set of iptables rules - // are present on host. - // These rules will serve as utility rules for various components, e.g. kube-proxy. - // The rules will be created based on iptablesMasqueradeBit and iptablesDropBit. + // makeIPTablesUtilChains, if true, causes the Kubelet to create the + // KUBE-IPTABLES-HINT chain in iptables as a hint to other components about the + // configuration of iptables on the system. // Default: true // +optional MakeIPTablesUtilChains *bool `json:"makeIPTablesUtilChains,omitempty"` - // iptablesMasqueradeBit is the bit of the iptables fwmark space to mark for SNAT. - // Values must be within the range [0, 31]. Must be different from other mark bits. - // Warning: Please match the value of the corresponding parameter in kube-proxy. - // TODO: clean up IPTablesMasqueradeBit in kube-proxy. + // iptablesMasqueradeBit formerly controlled the creation of the KUBE-MARK-MASQ + // chain. + // Deprecated: no longer has any effect. // Default: 14 // +optional IPTablesMasqueradeBit *int32 `json:"iptablesMasqueradeBit,omitempty"` - // iptablesDropBit is the bit of the iptables fwmark space to mark for dropping packets. - // Values must be within the range [0, 31]. Must be different from other mark bits. + // iptablesDropBit formerly controlled the creation of the KUBE-MARK-DROP chain. + // Deprecated: no longer has any effect. // Default: 15 // +optional IPTablesDropBit *int32 `json:"iptablesDropBit,omitempty"`