github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-27 13:37:30 +00:00
Code Issues Projects Releases Wiki Activity

Update debian-iptables iptables-wrapper script

Browse Source 
The debian-iptables v12.0.0 build didn't work because of another
previously-undiscovered iptables 1.8.x bug. Work around it for now and
bump the version to v12.0.1; we can revert back to the original
version of the script once iptables 1.8.4 is available in
buster-backports.
This commit is contained in:
Dan Winship 2019-11-07 15:10:39 -05:00
parent 8a646d2634
commit ffe93b3979
4 changed files with 16 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
build/common.sh
View File

@ -95,7 +95,7 @@ readonly KUBE_CONTAINER_RSYNC_PORT=8730
kube::build::get_docker_wrapped_binaries() { kube::build::get_docker_wrapped_binaries() {
local arch=$1 local arch=$1
local debian_base_version=v2.0.0 local debian_base_version=v2.0.0
local debian_iptables_version=v12.0.0 local debian_iptables_version=v12.0.1
### If you change any of these lists, please also update DOCKERIZED_BINARIES ### If you change any of these lists, please also update DOCKERIZED_BINARIES
### in build/BUILD. And kube::golang::server_image_targets ### in build/BUILD. And kube::golang::server_image_targets
local targets=( local targets=(

2
build/debian-iptables/Makefile
View File

@ -16,7 +16,7 @@
REGISTRY?="staging-k8s.gcr.io" REGISTRY?="staging-k8s.gcr.io"
IMAGE=$(REGISTRY)/debian-iptables IMAGE=$(REGISTRY)/debian-iptables
TAG?=v12.0.0 TAG?=v12.0.1
ARCH?=amd64 ARCH?=amd64
ALL_ARCH = amd64 arm arm64 ppc64le s390x ALL_ARCH = amd64 arm arm64 ppc64le s390x
TEMP_DIR:=$(shell mktemp -d) TEMP_DIR:=$(shell mktemp -d)

12
build/debian-iptables/iptables-wrapper
View File

@ -19,13 +19,23 @@ set -e
# Detect whether the base system is using iptables-legacy or # Detect whether the base system is using iptables-legacy or
# iptables-nft. This assumes that some non-containerized process (eg # iptables-nft. This assumes that some non-containerized process (eg
# kubelet) has already created some iptables rules. # kubelet) has already created some iptables rules.
# Bugs in iptables-nft 1.8.3 may cause it to get stuck in a loop in
# some circumstances, so we have to run the nft check in a timeout. To
# avoid hitting that timeout, we only bother to even check nft if
# legacy iptables was empty / mostly empty.
num_legacy_lines=$( (iptables-legacy-save || true; ip6tables-legacy-save || true) 2>/dev/null | grep '^-' | wc -l) num_legacy_lines=$( (iptables-legacy-save || true; ip6tables-legacy-save || true) 2>/dev/null | grep '^-' | wc -l)
num_nft_lines=$( (iptables-nft-save || true; ip6tables-nft-save || true) 2>/dev/null | grep '^-' | wc -l) if [ "${num_legacy_lines}" -ge 10 ]; then
mode=legacy
else
num_nft_lines=$( (timeout 5 sh -c "iptables-nft-save; ip6tables-nft-save" || true) 2>/dev/null | grep '^-' | wc -l)
if [ "${num_legacy_lines}" -ge "${num_nft_lines}" ]; then if [ "${num_legacy_lines}" -ge "${num_nft_lines}" ]; then
mode=legacy mode=legacy
else else
mode=nft mode=nft
fi fi
fi
update-alternatives --set iptables "/usr/sbin/iptables-${mode}" > /dev/null update-alternatives --set iptables "/usr/sbin/iptables-${mode}" > /dev/null
update-alternatives --set ip6tables "/usr/sbin/ip6tables-${mode}" > /dev/null update-alternatives --set ip6tables "/usr/sbin/ip6tables-${mode}" > /dev/null

2
build/workspace.bzl
View File

@ -122,7 +122,7 @@ def debian_image_dependencies():
digest = _digest(_DEBIAN_IPTABLES_DIGEST, arch), digest = _digest(_DEBIAN_IPTABLES_DIGEST, arch),
registry = "k8s.gcr.io", registry = "k8s.gcr.io",
repository = "debian-iptables", repository = "debian-iptables",
tag = "v12.0.0", # ignored, but kept here for documentation tag = "v12.0.1", # ignored, but kept here for documentation
) )
container_pull( container_pull(