From fdee7b2faade14cebb5156033f7d0e00ff6f1277 Mon Sep 17 00:00:00 2001 From: Yan Grunenberger Date: Thu, 5 Nov 2020 09:45:17 +0100 Subject: [PATCH] Correctly fix clearing conntrack entry on endpoint changes (nodeport) A previous PR (#71573) intended to clear conntrack entry on endpoint changes when using nodeport by introducing a dedicated function to remove the stale conntrack entry on the node port and allow traffic to resume. By doing so, it has introduced a nodeport specific bug where the conntrack entries related to the ClusterIP does not get clean if endpoint is changed (issue #96174). We fix by doing ClusterIP cleanup in all cases. --- pkg/proxy/iptables/proxier.go | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/pkg/proxy/iptables/proxier.go b/pkg/proxy/iptables/proxier.go index a3946d83c4c..8d9d10ef765 100644 --- a/pkg/proxy/iptables/proxier.go +++ b/pkg/proxy/iptables/proxier.go @@ -768,9 +768,11 @@ func (proxier *Proxier) deleteEndpointConnections(connectionMap []proxy.ServiceE var err error if nodePort != 0 { err = conntrack.ClearEntriesForPortNAT(proxier.exec, endpointIP, nodePort, svcProto) - } else { - err = conntrack.ClearEntriesForNAT(proxier.exec, svcInfo.ClusterIP().String(), endpointIP, svcProto) + if err != nil { + klog.Errorf("Failed to delete nodeport-related %s endpoint connections, error: %v", epSvcPair.ServicePortName.String(), err) + } } + err = conntrack.ClearEntriesForNAT(proxier.exec, svcInfo.ClusterIP().String(), endpointIP, svcProto) if err != nil { klog.Errorf("Failed to delete %s endpoint connections, error: %v", epSvcPair.ServicePortName.String(), err) }