pkg/proxy/iptables: add and fix existing unit tests based on changes to ProxyTermintingEndpoints
Signed-off-by: Andrew Sy Kim <andrewsy@google.com>
This commit is contained in:
Andrew Sy Kim
parent
e2e0b6fca8
commit
718a655e42
@ -4558,9 +4558,9 @@ COMMIT
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// Test_EndpointSliceWithTerminatingEndpoints tests that when there are local ready and ready + terminating
|
// Test_EndpointSliceWithTerminatingEndpointsTrafficPolicyLocal tests that when there are local ready and ready + terminating
|
||||||
// endpoints, only the ready endpoints are used.
|
// endpoints, only the ready endpoints are used.
|
||||||
func Test_EndpointSliceWithTerminatingEndpoints(t *testing.T) {
|
func Test_EndpointSliceWithTerminatingEndpointsTrafficPolicyLocal(t *testing.T) {
|
||||||
tcpProtocol := v1.ProtocolTCP
|
tcpProtocol := v1.ProtocolTCP
|
||||||
timeout := v1.DefaultClientIPServiceAffinitySeconds
|
timeout := v1.DefaultClientIPServiceAffinitySeconds
|
||||||
service := &v1.Service{
|
service := &v1.Service{
|
||||||
@ -5106,6 +5106,7 @@ COMMIT
|
|||||||
:KUBE-SERVICES - [0:0]
|
:KUBE-SERVICES - [0:0]
|
||||||
:KUBE-NODEPORTS - [0:0]
|
:KUBE-NODEPORTS - [0:0]
|
||||||
:KUBE-POSTROUTING - [0:0]
|
:KUBE-POSTROUTING - [0:0]
|
||||||
|
:KUBE-SEP-EQCHZ7S2PJ72OHAY - [0:0]
|
||||||
:KUBE-MARK-MASQ - [0:0]
|
:KUBE-MARK-MASQ - [0:0]
|
||||||
:KUBE-SVC-AQI2S6QIMU7PVVRP - [0:0]
|
:KUBE-SVC-AQI2S6QIMU7PVVRP - [0:0]
|
||||||
:KUBE-SVL-AQI2S6QIMU7PVVRP - [0:0]
|
:KUBE-SVL-AQI2S6QIMU7PVVRP - [0:0]
|
||||||
@ -5114,8 +5115,12 @@ COMMIT
|
|||||||
-A KUBE-POSTROUTING -m mark ! --mark 0x4000/0x4000 -j RETURN
|
-A KUBE-POSTROUTING -m mark ! --mark 0x4000/0x4000 -j RETURN
|
||||||
-A KUBE-POSTROUTING -j MARK --xor-mark 0x4000
|
-A KUBE-POSTROUTING -j MARK --xor-mark 0x4000
|
||||||
-A KUBE-POSTROUTING -m comment --comment "kubernetes service traffic requiring SNAT" -j MASQUERADE
|
-A KUBE-POSTROUTING -m comment --comment "kubernetes service traffic requiring SNAT" -j MASQUERADE
|
||||||
|
-A KUBE-SEP-EQCHZ7S2PJ72OHAY -m comment --comment ns1/svc1 -s 10.0.1.5 -j KUBE-MARK-MASQ
|
||||||
|
-A KUBE-SEP-EQCHZ7S2PJ72OHAY -m comment --comment ns1/svc1 -m recent --name KUBE-SEP-EQCHZ7S2PJ72OHAY --set -m tcp -p tcp -j DNAT --to-destination 10.0.1.5:80
|
||||||
-A KUBE-MARK-MASQ -j MARK --or-mark 0x4000
|
-A KUBE-MARK-MASQ -j MARK --or-mark 0x4000
|
||||||
-A KUBE-SVC-AQI2S6QIMU7PVVRP -m comment --comment "ns1/svc1 cluster IP" -m tcp -p tcp -d 172.30.1.1 --dport 80 ! -s 10.0.0.0/8 -j KUBE-MARK-MASQ
|
-A KUBE-SVC-AQI2S6QIMU7PVVRP -m comment --comment "ns1/svc1 cluster IP" -m tcp -p tcp -d 172.30.1.1 --dport 80 ! -s 10.0.0.0/8 -j KUBE-MARK-MASQ
|
||||||
|
-A KUBE-SVC-AQI2S6QIMU7PVVRP -m comment --comment ns1/svc1 -m recent --name KUBE-SEP-EQCHZ7S2PJ72OHAY --rcheck --seconds 10800 --reap -j KUBE-SEP-EQCHZ7S2PJ72OHAY
|
||||||
|
-A KUBE-SVC-AQI2S6QIMU7PVVRP -m comment --comment ns1/svc1 -j KUBE-SEP-EQCHZ7S2PJ72OHAY
|
||||||
-A KUBE-SERVICES -m comment --comment "ns1/svc1 cluster IP" -m tcp -p tcp -d 172.30.1.1 --dport 80 -j KUBE-SVC-AQI2S6QIMU7PVVRP
|
-A KUBE-SERVICES -m comment --comment "ns1/svc1 cluster IP" -m tcp -p tcp -d 172.30.1.1 --dport 80 -j KUBE-SVC-AQI2S6QIMU7PVVRP
|
||||||
-A KUBE-SERVICES -m comment --comment "ns1/svc1 loadbalancer IP" -m tcp -p tcp -d 1.2.3.4 --dport 80 -j KUBE-FW-AQI2S6QIMU7PVVRP
|
-A KUBE-SERVICES -m comment --comment "ns1/svc1 loadbalancer IP" -m tcp -p tcp -d 1.2.3.4 --dport 80 -j KUBE-FW-AQI2S6QIMU7PVVRP
|
||||||
-A KUBE-FW-AQI2S6QIMU7PVVRP -m comment --comment "ns1/svc1 loadbalancer IP" -j KUBE-XLB-AQI2S6QIMU7PVVRP
|
-A KUBE-FW-AQI2S6QIMU7PVVRP -m comment --comment "ns1/svc1 loadbalancer IP" -j KUBE-XLB-AQI2S6QIMU7PVVRP
|
||||||
@ -5224,6 +5229,622 @@ COMMIT
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// Test_EndpointSliceWithTerminatingEndpointsTrafficPolicyCluster tests that when there are cluster-wide ready and ready + terminating
|
||||||
|
// endpoints, only the ready endpoints are used.
|
||||||
|
func Test_EndpointSliceWithTerminatingEndpointsTrafficPolicyCluster(t *testing.T) {
|
||||||
|
tcpProtocol := v1.ProtocolTCP
|
||||||
|
timeout := v1.DefaultClientIPServiceAffinitySeconds
|
||||||
|
service := &v1.Service{
|
||||||
|
ObjectMeta: metav1.ObjectMeta{Name: "svc1", Namespace: "ns1"},
|
||||||
|
Spec: v1.ServiceSpec{
|
||||||
|
ClusterIP: "172.30.1.1",
|
||||||
|
Type: v1.ServiceTypeLoadBalancer,
|
||||||
|
ExternalTrafficPolicy: v1.ServiceExternalTrafficPolicyTypeCluster,
|
||||||
|
Selector: map[string]string{"foo": "bar"},
|
||||||
|
Ports: []v1.ServicePort{
|
||||||
|
{
|
||||||
|
Name: "",
|
||||||
|
TargetPort: intstr.FromInt(80),
|
||||||
|
Port: 80,
|
||||||
|
Protocol: v1.ProtocolTCP,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
HealthCheckNodePort: 30000,
|
||||||
|
SessionAffinity: v1.ServiceAffinityClientIP,
|
||||||
|
SessionAffinityConfig: &v1.SessionAffinityConfig{
|
||||||
|
ClientIP: &v1.ClientIPConfig{
|
||||||
|
TimeoutSeconds: &timeout,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
Status: v1.ServiceStatus{
|
||||||
|
LoadBalancer: v1.LoadBalancerStatus{
|
||||||
|
Ingress: []v1.LoadBalancerIngress{
|
||||||
|
{IP: "1.2.3.4"},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
testcases := []struct {
|
||||||
|
name string
|
||||||
|
terminatingFeatureGate bool
|
||||||
|
endpointslice *discovery.EndpointSlice
|
||||||
|
expectedIPTables string
|
||||||
|
noUsableEndpoints bool
|
||||||
|
}{
|
||||||
|
{
|
||||||
|
name: "feature gate ProxyTerminatingEndpoints enabled, ready endpoints exist",
|
||||||
|
terminatingFeatureGate: true,
|
||||||
|
endpointslice: &discovery.EndpointSlice{
|
||||||
|
ObjectMeta: metav1.ObjectMeta{
|
||||||
|
Name: fmt.Sprintf("%s-1", "svc1"),
|
||||||
|
Namespace: "ns1",
|
||||||
|
Labels: map[string]string{discovery.LabelServiceName: "svc1"},
|
||||||
|
},
|
||||||
|
Ports: []discovery.EndpointPort{{
|
||||||
|
Name: utilpointer.StringPtr(""),
|
||||||
|
Port: utilpointer.Int32Ptr(80),
|
||||||
|
Protocol: &tcpProtocol,
|
||||||
|
}},
|
||||||
|
AddressType: discovery.AddressTypeIPv4,
|
||||||
|
Endpoints: []discovery.Endpoint{
|
||||||
|
{
|
||||||
|
Addresses: []string{"10.0.1.1"},
|
||||||
|
Conditions: discovery.EndpointConditions{
|
||||||
|
Ready: utilpointer.BoolPtr(true),
|
||||||
|
Serving: utilpointer.BoolPtr(true),
|
||||||
|
Terminating: utilpointer.BoolPtr(false),
|
||||||
|
},
|
||||||
|
NodeName: utilpointer.StringPtr(testHostname),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
Addresses: []string{"10.0.1.2"},
|
||||||
|
Conditions: discovery.EndpointConditions{
|
||||||
|
Ready: utilpointer.BoolPtr(true),
|
||||||
|
Serving: utilpointer.BoolPtr(true),
|
||||||
|
Terminating: utilpointer.BoolPtr(false),
|
||||||
|
},
|
||||||
|
NodeName: utilpointer.StringPtr(testHostname),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
// this endpoint should be ignored since there are ready non-terminating endpoints
|
||||||
|
Addresses: []string{"10.0.1.3"},
|
||||||
|
Conditions: discovery.EndpointConditions{
|
||||||
|
Ready: utilpointer.BoolPtr(false),
|
||||||
|
Serving: utilpointer.BoolPtr(true),
|
||||||
|
Terminating: utilpointer.BoolPtr(true),
|
||||||
|
},
|
||||||
|
NodeName: utilpointer.StringPtr("another-host"),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
// this endpoint should be ignored since it is not "serving"
|
||||||
|
Addresses: []string{"10.0.1.4"},
|
||||||
|
Conditions: discovery.EndpointConditions{
|
||||||
|
Ready: utilpointer.BoolPtr(false),
|
||||||
|
Serving: utilpointer.BoolPtr(false),
|
||||||
|
Terminating: utilpointer.BoolPtr(true),
|
||||||
|
},
|
||||||
|
NodeName: utilpointer.StringPtr("another-host"),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
Addresses: []string{"10.0.1.5"},
|
||||||
|
Conditions: discovery.EndpointConditions{
|
||||||
|
Ready: utilpointer.BoolPtr(true),
|
||||||
|
Serving: utilpointer.BoolPtr(true),
|
||||||
|
Terminating: utilpointer.BoolPtr(false),
|
||||||
|
},
|
||||||
|
NodeName: utilpointer.StringPtr("another-host"),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
expectedIPTables: `
|
||||||
|
*filter
|
||||||
|
:KUBE-SERVICES - [0:0]
|
||||||
|
:KUBE-EXTERNAL-SERVICES - [0:0]
|
||||||
|
:KUBE-FORWARD - [0:0]
|
||||||
|
:KUBE-NODEPORTS - [0:0]
|
||||||
|
-A KUBE-FORWARD -m conntrack --ctstate INVALID -j DROP
|
||||||
|
-A KUBE-FORWARD -m comment --comment "kubernetes forwarding rules" -m mark --mark 0x4000/0x4000 -j ACCEPT
|
||||||
|
-A KUBE-FORWARD -m comment --comment "kubernetes forwarding conntrack rule" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
||||||
|
COMMIT
|
||||||
|
*nat
|
||||||
|
:KUBE-SERVICES - [0:0]
|
||||||
|
:KUBE-NODEPORTS - [0:0]
|
||||||
|
:KUBE-POSTROUTING - [0:0]
|
||||||
|
:KUBE-MARK-MASQ - [0:0]
|
||||||
|
:KUBE-SVC-AQI2S6QIMU7PVVRP - [0:0]
|
||||||
|
:KUBE-FW-AQI2S6QIMU7PVVRP - [0:0]
|
||||||
|
:KUBE-SEP-3JOIVZTXZZRGORX4 - [0:0]
|
||||||
|
:KUBE-SEP-IO5XOSKPAXIFQXAJ - [0:0]
|
||||||
|
:KUBE-SEP-EQCHZ7S2PJ72OHAY - [0:0]
|
||||||
|
-A KUBE-POSTROUTING -m mark ! --mark 0x4000/0x4000 -j RETURN
|
||||||
|
-A KUBE-POSTROUTING -j MARK --xor-mark 0x4000
|
||||||
|
-A KUBE-POSTROUTING -m comment --comment "kubernetes service traffic requiring SNAT" -j MASQUERADE
|
||||||
|
-A KUBE-MARK-MASQ -j MARK --or-mark 0x4000
|
||||||
|
-A KUBE-SVC-AQI2S6QIMU7PVVRP -m comment --comment "ns1/svc1 cluster IP" -m tcp -p tcp -d 172.30.1.1 --dport 80 ! -s 10.0.0.0/8 -j KUBE-MARK-MASQ
|
||||||
|
-A KUBE-SERVICES -m comment --comment "ns1/svc1 cluster IP" -m tcp -p tcp -d 172.30.1.1 --dport 80 -j KUBE-SVC-AQI2S6QIMU7PVVRP
|
||||||
|
-A KUBE-SERVICES -m comment --comment "ns1/svc1 loadbalancer IP" -m tcp -p tcp -d 1.2.3.4 --dport 80 -j KUBE-FW-AQI2S6QIMU7PVVRP
|
||||||
|
-A KUBE-FW-AQI2S6QIMU7PVVRP -m comment --comment "ns1/svc1 loadbalancer IP" -j KUBE-MARK-MASQ
|
||||||
|
-A KUBE-FW-AQI2S6QIMU7PVVRP -m comment --comment "ns1/svc1 loadbalancer IP" -j KUBE-SVC-AQI2S6QIMU7PVVRP
|
||||||
|
-A KUBE-FW-AQI2S6QIMU7PVVRP -m comment --comment "ns1/svc1 loadbalancer IP" -j KUBE-MARK-DROP
|
||||||
|
-A KUBE-SVC-AQI2S6QIMU7PVVRP -m comment --comment ns1/svc1 -m recent --name KUBE-SEP-3JOIVZTXZZRGORX4 --rcheck --seconds 10800 --reap -j KUBE-SEP-3JOIVZTXZZRGORX4
|
||||||
|
-A KUBE-SVC-AQI2S6QIMU7PVVRP -m comment --comment ns1/svc1 -m recent --name KUBE-SEP-IO5XOSKPAXIFQXAJ --rcheck --seconds 10800 --reap -j KUBE-SEP-IO5XOSKPAXIFQXAJ
|
||||||
|
-A KUBE-SVC-AQI2S6QIMU7PVVRP -m comment --comment ns1/svc1 -m recent --name KUBE-SEP-EQCHZ7S2PJ72OHAY --rcheck --seconds 10800 --reap -j KUBE-SEP-EQCHZ7S2PJ72OHAY
|
||||||
|
-A KUBE-SVC-AQI2S6QIMU7PVVRP -m comment --comment ns1/svc1 -m statistic --mode random --probability 0.3333333333 -j KUBE-SEP-3JOIVZTXZZRGORX4
|
||||||
|
-A KUBE-SVC-AQI2S6QIMU7PVVRP -m comment --comment ns1/svc1 -m statistic --mode random --probability 0.5000000000 -j KUBE-SEP-IO5XOSKPAXIFQXAJ
|
||||||
|
-A KUBE-SVC-AQI2S6QIMU7PVVRP -m comment --comment ns1/svc1 -j KUBE-SEP-EQCHZ7S2PJ72OHAY
|
||||||
|
-A KUBE-SEP-3JOIVZTXZZRGORX4 -m comment --comment ns1/svc1 -s 10.0.1.1 -j KUBE-MARK-MASQ
|
||||||
|
-A KUBE-SEP-3JOIVZTXZZRGORX4 -m comment --comment ns1/svc1 -m recent --name KUBE-SEP-3JOIVZTXZZRGORX4 --set -m tcp -p tcp -j DNAT --to-destination 10.0.1.1:80
|
||||||
|
-A KUBE-SEP-IO5XOSKPAXIFQXAJ -m comment --comment ns1/svc1 -s 10.0.1.2 -j KUBE-MARK-MASQ
|
||||||
|
-A KUBE-SEP-IO5XOSKPAXIFQXAJ -m comment --comment ns1/svc1 -m recent --name KUBE-SEP-IO5XOSKPAXIFQXAJ --set -m tcp -p tcp -j DNAT --to-destination 10.0.1.2:80
|
||||||
|
-A KUBE-SEP-EQCHZ7S2PJ72OHAY -m comment --comment ns1/svc1 -s 10.0.1.5 -j KUBE-MARK-MASQ
|
||||||
|
-A KUBE-SEP-EQCHZ7S2PJ72OHAY -m comment --comment ns1/svc1 -m recent --name KUBE-SEP-EQCHZ7S2PJ72OHAY --set -m tcp -p tcp -j DNAT --to-destination 10.0.1.5:80
|
||||||
|
-A KUBE-SERVICES -m comment --comment "kubernetes service nodeports; NOTE: this must be the last rule in this chain" -m addrtype --dst-type LOCAL -j KUBE-NODEPORTS
|
||||||
|
COMMIT
|
||||||
|
`,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "feature gate ProxyTerminatingEndpoints disabled, ready endpoints exist",
|
||||||
|
terminatingFeatureGate: false,
|
||||||
|
endpointslice: &discovery.EndpointSlice{
|
||||||
|
ObjectMeta: metav1.ObjectMeta{
|
||||||
|
Name: fmt.Sprintf("%s-1", "svc1"),
|
||||||
|
Namespace: "ns1",
|
||||||
|
Labels: map[string]string{discovery.LabelServiceName: "svc1"},
|
||||||
|
},
|
||||||
|
Ports: []discovery.EndpointPort{{
|
||||||
|
Name: utilpointer.StringPtr(""),
|
||||||
|
Port: utilpointer.Int32Ptr(80),
|
||||||
|
Protocol: &tcpProtocol,
|
||||||
|
}},
|
||||||
|
AddressType: discovery.AddressTypeIPv4,
|
||||||
|
Endpoints: []discovery.Endpoint{
|
||||||
|
{
|
||||||
|
Addresses: []string{"10.0.1.1"},
|
||||||
|
Conditions: discovery.EndpointConditions{
|
||||||
|
Ready: utilpointer.BoolPtr(true),
|
||||||
|
Serving: utilpointer.BoolPtr(true),
|
||||||
|
Terminating: utilpointer.BoolPtr(false),
|
||||||
|
},
|
||||||
|
NodeName: utilpointer.StringPtr(testHostname),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
Addresses: []string{"10.0.1.2"},
|
||||||
|
Conditions: discovery.EndpointConditions{
|
||||||
|
Ready: utilpointer.BoolPtr(true),
|
||||||
|
Serving: utilpointer.BoolPtr(true),
|
||||||
|
Terminating: utilpointer.BoolPtr(false),
|
||||||
|
},
|
||||||
|
NodeName: utilpointer.StringPtr(testHostname),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
// always ignored since feature gate is disabled
|
||||||
|
Addresses: []string{"10.0.1.3"},
|
||||||
|
Conditions: discovery.EndpointConditions{
|
||||||
|
Ready: utilpointer.BoolPtr(false),
|
||||||
|
Serving: utilpointer.BoolPtr(true),
|
||||||
|
Terminating: utilpointer.BoolPtr(true),
|
||||||
|
},
|
||||||
|
NodeName: utilpointer.StringPtr("another-host"),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
// always ignored since serving=false
|
||||||
|
Addresses: []string{"10.0.1.4"},
|
||||||
|
Conditions: discovery.EndpointConditions{
|
||||||
|
Ready: utilpointer.BoolPtr(false),
|
||||||
|
Serving: utilpointer.BoolPtr(false),
|
||||||
|
Terminating: utilpointer.BoolPtr(true),
|
||||||
|
},
|
||||||
|
NodeName: utilpointer.StringPtr("another-host"),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
Addresses: []string{"10.0.1.5"},
|
||||||
|
Conditions: discovery.EndpointConditions{
|
||||||
|
Ready: utilpointer.BoolPtr(true),
|
||||||
|
Serving: utilpointer.BoolPtr(true),
|
||||||
|
Terminating: utilpointer.BoolPtr(false),
|
||||||
|
},
|
||||||
|
NodeName: utilpointer.StringPtr("another-host"),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
expectedIPTables: `
|
||||||
|
*filter
|
||||||
|
:KUBE-SERVICES - [0:0]
|
||||||
|
:KUBE-EXTERNAL-SERVICES - [0:0]
|
||||||
|
:KUBE-FORWARD - [0:0]
|
||||||
|
:KUBE-NODEPORTS - [0:0]
|
||||||
|
-A KUBE-FORWARD -m conntrack --ctstate INVALID -j DROP
|
||||||
|
-A KUBE-FORWARD -m comment --comment "kubernetes forwarding rules" -m mark --mark 0x4000/0x4000 -j ACCEPT
|
||||||
|
-A KUBE-FORWARD -m comment --comment "kubernetes forwarding conntrack rule" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
||||||
|
COMMIT
|
||||||
|
*nat
|
||||||
|
:KUBE-SERVICES - [0:0]
|
||||||
|
:KUBE-NODEPORTS - [0:0]
|
||||||
|
:KUBE-POSTROUTING - [0:0]
|
||||||
|
:KUBE-MARK-MASQ - [0:0]
|
||||||
|
:KUBE-SVC-AQI2S6QIMU7PVVRP - [0:0]
|
||||||
|
:KUBE-FW-AQI2S6QIMU7PVVRP - [0:0]
|
||||||
|
:KUBE-SEP-3JOIVZTXZZRGORX4 - [0:0]
|
||||||
|
:KUBE-SEP-IO5XOSKPAXIFQXAJ - [0:0]
|
||||||
|
:KUBE-SEP-EQCHZ7S2PJ72OHAY - [0:0]
|
||||||
|
-A KUBE-POSTROUTING -m mark ! --mark 0x4000/0x4000 -j RETURN
|
||||||
|
-A KUBE-POSTROUTING -j MARK --xor-mark 0x4000
|
||||||
|
-A KUBE-POSTROUTING -m comment --comment "kubernetes service traffic requiring SNAT" -j MASQUERADE
|
||||||
|
-A KUBE-MARK-MASQ -j MARK --or-mark 0x4000
|
||||||
|
-A KUBE-SVC-AQI2S6QIMU7PVVRP -m comment --comment "ns1/svc1 cluster IP" -m tcp -p tcp -d 172.30.1.1 --dport 80 ! -s 10.0.0.0/8 -j KUBE-MARK-MASQ
|
||||||
|
-A KUBE-SERVICES -m comment --comment "ns1/svc1 cluster IP" -m tcp -p tcp -d 172.30.1.1 --dport 80 -j KUBE-SVC-AQI2S6QIMU7PVVRP
|
||||||
|
-A KUBE-SERVICES -m comment --comment "ns1/svc1 loadbalancer IP" -m tcp -p tcp -d 1.2.3.4 --dport 80 -j KUBE-FW-AQI2S6QIMU7PVVRP
|
||||||
|
-A KUBE-FW-AQI2S6QIMU7PVVRP -m comment --comment "ns1/svc1 loadbalancer IP" -j KUBE-MARK-MASQ
|
||||||
|
-A KUBE-FW-AQI2S6QIMU7PVVRP -m comment --comment "ns1/svc1 loadbalancer IP" -j KUBE-SVC-AQI2S6QIMU7PVVRP
|
||||||
|
-A KUBE-FW-AQI2S6QIMU7PVVRP -m comment --comment "ns1/svc1 loadbalancer IP" -j KUBE-MARK-DROP
|
||||||
|
-A KUBE-SVC-AQI2S6QIMU7PVVRP -m comment --comment ns1/svc1 -m recent --name KUBE-SEP-3JOIVZTXZZRGORX4 --rcheck --seconds 10800 --reap -j KUBE-SEP-3JOIVZTXZZRGORX4
|
||||||
|
-A KUBE-SVC-AQI2S6QIMU7PVVRP -m comment --comment ns1/svc1 -m recent --name KUBE-SEP-IO5XOSKPAXIFQXAJ --rcheck --seconds 10800 --reap -j KUBE-SEP-IO5XOSKPAXIFQXAJ
|
||||||
|
-A KUBE-SVC-AQI2S6QIMU7PVVRP -m comment --comment ns1/svc1 -m recent --name KUBE-SEP-EQCHZ7S2PJ72OHAY --rcheck --seconds 10800 --reap -j KUBE-SEP-EQCHZ7S2PJ72OHAY
|
||||||
|
-A KUBE-SVC-AQI2S6QIMU7PVVRP -m comment --comment ns1/svc1 -m statistic --mode random --probability 0.3333333333 -j KUBE-SEP-3JOIVZTXZZRGORX4
|
||||||
|
-A KUBE-SVC-AQI2S6QIMU7PVVRP -m comment --comment ns1/svc1 -m statistic --mode random --probability 0.5000000000 -j KUBE-SEP-IO5XOSKPAXIFQXAJ
|
||||||
|
-A KUBE-SVC-AQI2S6QIMU7PVVRP -m comment --comment ns1/svc1 -j KUBE-SEP-EQCHZ7S2PJ72OHAY
|
||||||
|
-A KUBE-SEP-3JOIVZTXZZRGORX4 -m comment --comment ns1/svc1 -s 10.0.1.1 -j KUBE-MARK-MASQ
|
||||||
|
-A KUBE-SEP-3JOIVZTXZZRGORX4 -m comment --comment ns1/svc1 -m recent --name KUBE-SEP-3JOIVZTXZZRGORX4 --set -m tcp -p tcp -j DNAT --to-destination 10.0.1.1:80
|
||||||
|
-A KUBE-SEP-IO5XOSKPAXIFQXAJ -m comment --comment ns1/svc1 -s 10.0.1.2 -j KUBE-MARK-MASQ
|
||||||
|
-A KUBE-SEP-IO5XOSKPAXIFQXAJ -m comment --comment ns1/svc1 -m recent --name KUBE-SEP-IO5XOSKPAXIFQXAJ --set -m tcp -p tcp -j DNAT --to-destination 10.0.1.2:80
|
||||||
|
-A KUBE-SEP-EQCHZ7S2PJ72OHAY -m comment --comment ns1/svc1 -s 10.0.1.5 -j KUBE-MARK-MASQ
|
||||||
|
-A KUBE-SEP-EQCHZ7S2PJ72OHAY -m comment --comment ns1/svc1 -m recent --name KUBE-SEP-EQCHZ7S2PJ72OHAY --set -m tcp -p tcp -j DNAT --to-destination 10.0.1.5:80
|
||||||
|
-A KUBE-SERVICES -m comment --comment "kubernetes service nodeports; NOTE: this must be the last rule in this chain" -m addrtype --dst-type LOCAL -j KUBE-NODEPORTS
|
||||||
|
COMMIT
|
||||||
|
`,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "feature gate ProxyTerminatingEndpoints enabled, only terminating endpoints exist",
|
||||||
|
terminatingFeatureGate: true,
|
||||||
|
endpointslice: &discovery.EndpointSlice{
|
||||||
|
ObjectMeta: metav1.ObjectMeta{
|
||||||
|
Name: fmt.Sprintf("%s-1", "svc1"),
|
||||||
|
Namespace: "ns1",
|
||||||
|
Labels: map[string]string{discovery.LabelServiceName: "svc1"},
|
||||||
|
},
|
||||||
|
Ports: []discovery.EndpointPort{{
|
||||||
|
Name: utilpointer.StringPtr(""),
|
||||||
|
Port: utilpointer.Int32Ptr(80),
|
||||||
|
Protocol: &tcpProtocol,
|
||||||
|
}},
|
||||||
|
AddressType: discovery.AddressTypeIPv4,
|
||||||
|
Endpoints: []discovery.Endpoint{
|
||||||
|
{
|
||||||
|
// this endpoint should be used since there are only ready terminating endpoints
|
||||||
|
Addresses: []string{"10.0.1.2"},
|
||||||
|
Conditions: discovery.EndpointConditions{
|
||||||
|
Ready: utilpointer.BoolPtr(false),
|
||||||
|
Serving: utilpointer.BoolPtr(true),
|
||||||
|
Terminating: utilpointer.BoolPtr(true),
|
||||||
|
},
|
||||||
|
NodeName: utilpointer.StringPtr(testHostname),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
// this endpoint should be used since there are only ready terminating endpoints
|
||||||
|
Addresses: []string{"10.0.1.3"},
|
||||||
|
Conditions: discovery.EndpointConditions{
|
||||||
|
Ready: utilpointer.BoolPtr(false),
|
||||||
|
Serving: utilpointer.BoolPtr(true),
|
||||||
|
Terminating: utilpointer.BoolPtr(true),
|
||||||
|
},
|
||||||
|
NodeName: utilpointer.StringPtr(testHostname),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
// this endpoint should not be used since it is both terminating and not ready.
|
||||||
|
Addresses: []string{"10.0.1.4"},
|
||||||
|
Conditions: discovery.EndpointConditions{
|
||||||
|
Ready: utilpointer.BoolPtr(false),
|
||||||
|
Serving: utilpointer.BoolPtr(false),
|
||||||
|
Terminating: utilpointer.BoolPtr(true),
|
||||||
|
},
|
||||||
|
NodeName: utilpointer.StringPtr("another-host"),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
// this endpoint should be used since there are only ready terminating endpoints
|
||||||
|
Addresses: []string{"10.0.1.5"},
|
||||||
|
Conditions: discovery.EndpointConditions{
|
||||||
|
Ready: utilpointer.BoolPtr(false),
|
||||||
|
Serving: utilpointer.BoolPtr(true),
|
||||||
|
Terminating: utilpointer.BoolPtr(true),
|
||||||
|
},
|
||||||
|
NodeName: utilpointer.StringPtr("another-host"),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
expectedIPTables: `
|
||||||
|
*filter
|
||||||
|
:KUBE-SERVICES - [0:0]
|
||||||
|
:KUBE-EXTERNAL-SERVICES - [0:0]
|
||||||
|
:KUBE-FORWARD - [0:0]
|
||||||
|
:KUBE-NODEPORTS - [0:0]
|
||||||
|
-A KUBE-FORWARD -m conntrack --ctstate INVALID -j DROP
|
||||||
|
-A KUBE-FORWARD -m comment --comment "kubernetes forwarding rules" -m mark --mark 0x4000/0x4000 -j ACCEPT
|
||||||
|
-A KUBE-FORWARD -m comment --comment "kubernetes forwarding conntrack rule" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
||||||
|
COMMIT
|
||||||
|
*nat
|
||||||
|
:KUBE-SERVICES - [0:0]
|
||||||
|
:KUBE-NODEPORTS - [0:0]
|
||||||
|
:KUBE-POSTROUTING - [0:0]
|
||||||
|
:KUBE-MARK-MASQ - [0:0]
|
||||||
|
:KUBE-SVC-AQI2S6QIMU7PVVRP - [0:0]
|
||||||
|
:KUBE-FW-AQI2S6QIMU7PVVRP - [0:0]
|
||||||
|
:KUBE-SEP-EQCHZ7S2PJ72OHAY - [0:0]
|
||||||
|
:KUBE-SEP-IO5XOSKPAXIFQXAJ - [0:0]
|
||||||
|
:KUBE-SEP-XGJFVO3L2O5SRFNT - [0:0]
|
||||||
|
-A KUBE-POSTROUTING -m mark ! --mark 0x4000/0x4000 -j RETURN
|
||||||
|
-A KUBE-POSTROUTING -j MARK --xor-mark 0x4000
|
||||||
|
-A KUBE-POSTROUTING -m comment --comment "kubernetes service traffic requiring SNAT" -j MASQUERADE
|
||||||
|
-A KUBE-MARK-MASQ -j MARK --or-mark 0x4000
|
||||||
|
-A KUBE-SVC-AQI2S6QIMU7PVVRP -m comment --comment "ns1/svc1 cluster IP" -m tcp -p tcp -d 172.30.1.1 --dport 80 ! -s 10.0.0.0/8 -j KUBE-MARK-MASQ
|
||||||
|
-A KUBE-SERVICES -m comment --comment "ns1/svc1 cluster IP" -m tcp -p tcp -d 172.30.1.1 --dport 80 -j KUBE-SVC-AQI2S6QIMU7PVVRP
|
||||||
|
-A KUBE-SERVICES -m comment --comment "ns1/svc1 loadbalancer IP" -m tcp -p tcp -d 1.2.3.4 --dport 80 -j KUBE-FW-AQI2S6QIMU7PVVRP
|
||||||
|
-A KUBE-FW-AQI2S6QIMU7PVVRP -m comment --comment "ns1/svc1 loadbalancer IP" -j KUBE-MARK-MASQ
|
||||||
|
-A KUBE-FW-AQI2S6QIMU7PVVRP -m comment --comment "ns1/svc1 loadbalancer IP" -j KUBE-SVC-AQI2S6QIMU7PVVRP
|
||||||
|
-A KUBE-FW-AQI2S6QIMU7PVVRP -m comment --comment "ns1/svc1 loadbalancer IP" -j KUBE-MARK-DROP
|
||||||
|
-A KUBE-SVC-AQI2S6QIMU7PVVRP -m comment --comment ns1/svc1 -m recent --name KUBE-SEP-IO5XOSKPAXIFQXAJ --rcheck --seconds 10800 --reap -j KUBE-SEP-IO5XOSKPAXIFQXAJ
|
||||||
|
-A KUBE-SVC-AQI2S6QIMU7PVVRP -m comment --comment ns1/svc1 -m recent --name KUBE-SEP-XGJFVO3L2O5SRFNT --rcheck --seconds 10800 --reap -j KUBE-SEP-XGJFVO3L2O5SRFNT
|
||||||
|
-A KUBE-SVC-AQI2S6QIMU7PVVRP -m comment --comment ns1/svc1 -m recent --name KUBE-SEP-EQCHZ7S2PJ72OHAY --rcheck --seconds 10800 --reap -j KUBE-SEP-EQCHZ7S2PJ72OHAY
|
||||||
|
-A KUBE-SVC-AQI2S6QIMU7PVVRP -m comment --comment ns1/svc1 -m statistic --mode random --probability 0.3333333333 -j KUBE-SEP-IO5XOSKPAXIFQXAJ
|
||||||
|
-A KUBE-SVC-AQI2S6QIMU7PVVRP -m comment --comment ns1/svc1 -m statistic --mode random --probability 0.5000000000 -j KUBE-SEP-XGJFVO3L2O5SRFNT
|
||||||
|
-A KUBE-SVC-AQI2S6QIMU7PVVRP -m comment --comment ns1/svc1 -j KUBE-SEP-EQCHZ7S2PJ72OHAY
|
||||||
|
-A KUBE-SEP-EQCHZ7S2PJ72OHAY -m comment --comment ns1/svc1 -s 10.0.1.5 -j KUBE-MARK-MASQ
|
||||||
|
-A KUBE-SEP-EQCHZ7S2PJ72OHAY -m comment --comment ns1/svc1 -m recent --name KUBE-SEP-EQCHZ7S2PJ72OHAY --set -m tcp -p tcp -j DNAT --to-destination 10.0.1.5:80
|
||||||
|
-A KUBE-SEP-IO5XOSKPAXIFQXAJ -m comment --comment ns1/svc1 -s 10.0.1.2 -j KUBE-MARK-MASQ
|
||||||
|
-A KUBE-SEP-IO5XOSKPAXIFQXAJ -m comment --comment ns1/svc1 -m recent --name KUBE-SEP-IO5XOSKPAXIFQXAJ --set -m tcp -p tcp -j DNAT --to-destination 10.0.1.2:80
|
||||||
|
-A KUBE-SEP-XGJFVO3L2O5SRFNT -m comment --comment ns1/svc1 -s 10.0.1.3 -j KUBE-MARK-MASQ
|
||||||
|
-A KUBE-SEP-XGJFVO3L2O5SRFNT -m comment --comment ns1/svc1 -m recent --name KUBE-SEP-XGJFVO3L2O5SRFNT --set -m tcp -p tcp -j DNAT --to-destination 10.0.1.3:80
|
||||||
|
-A KUBE-SERVICES -m comment --comment "kubernetes service nodeports; NOTE: this must be the last rule in this chain" -m addrtype --dst-type LOCAL -j KUBE-NODEPORTS
|
||||||
|
COMMIT
|
||||||
|
`,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "with ProxyTerminatingEndpoints disabled, only terminating endpoints exist",
|
||||||
|
terminatingFeatureGate: false,
|
||||||
|
endpointslice: &discovery.EndpointSlice{
|
||||||
|
ObjectMeta: metav1.ObjectMeta{
|
||||||
|
Name: fmt.Sprintf("%s-1", "svc1"),
|
||||||
|
Namespace: "ns1",
|
||||||
|
Labels: map[string]string{discovery.LabelServiceName: "svc1"},
|
||||||
|
},
|
||||||
|
Ports: []discovery.EndpointPort{{
|
||||||
|
Name: utilpointer.StringPtr(""),
|
||||||
|
Port: utilpointer.Int32Ptr(80),
|
||||||
|
Protocol: &tcpProtocol,
|
||||||
|
}},
|
||||||
|
AddressType: discovery.AddressTypeIPv4,
|
||||||
|
Endpoints: []discovery.Endpoint{
|
||||||
|
{
|
||||||
|
Addresses: []string{"10.0.1.1"},
|
||||||
|
Conditions: discovery.EndpointConditions{
|
||||||
|
Ready: utilpointer.BoolPtr(false),
|
||||||
|
Serving: utilpointer.BoolPtr(true),
|
||||||
|
Terminating: utilpointer.BoolPtr(true),
|
||||||
|
},
|
||||||
|
NodeName: utilpointer.StringPtr(testHostname),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
Addresses: []string{"10.0.1.2"},
|
||||||
|
Conditions: discovery.EndpointConditions{
|
||||||
|
Ready: utilpointer.BoolPtr(false),
|
||||||
|
Serving: utilpointer.BoolPtr(true),
|
||||||
|
Terminating: utilpointer.BoolPtr(true),
|
||||||
|
},
|
||||||
|
NodeName: utilpointer.StringPtr(testHostname),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
Addresses: []string{"10.0.1.3"},
|
||||||
|
Conditions: discovery.EndpointConditions{
|
||||||
|
Ready: utilpointer.BoolPtr(false),
|
||||||
|
Serving: utilpointer.BoolPtr(false),
|
||||||
|
Terminating: utilpointer.BoolPtr(true),
|
||||||
|
},
|
||||||
|
NodeName: utilpointer.StringPtr("another-host"),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
Addresses: []string{"10.0.1.4"},
|
||||||
|
Conditions: discovery.EndpointConditions{
|
||||||
|
Ready: utilpointer.BoolPtr(false),
|
||||||
|
Serving: utilpointer.BoolPtr(false),
|
||||||
|
Terminating: utilpointer.BoolPtr(true),
|
||||||
|
},
|
||||||
|
NodeName: utilpointer.StringPtr("another-host"),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
Addresses: []string{"10.0.1.5"},
|
||||||
|
Conditions: discovery.EndpointConditions{
|
||||||
|
Ready: utilpointer.BoolPtr(false),
|
||||||
|
Serving: utilpointer.BoolPtr(true),
|
||||||
|
Terminating: utilpointer.BoolPtr(true),
|
||||||
|
},
|
||||||
|
NodeName: utilpointer.StringPtr("another-host"),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
noUsableEndpoints: true,
|
||||||
|
expectedIPTables: `
|
||||||
|
*filter
|
||||||
|
:KUBE-SERVICES - [0:0]
|
||||||
|
:KUBE-EXTERNAL-SERVICES - [0:0]
|
||||||
|
:KUBE-FORWARD - [0:0]
|
||||||
|
:KUBE-NODEPORTS - [0:0]
|
||||||
|
-A KUBE-SERVICES -m comment --comment "ns1/svc1 has no endpoints" -m tcp -p tcp -d 172.30.1.1 --dport 80 -j REJECT
|
||||||
|
-A KUBE-EXTERNAL-SERVICES -m comment --comment "ns1/svc1 has no endpoints" -m tcp -p tcp -d 1.2.3.4 --dport 80 -j REJECT
|
||||||
|
-A KUBE-FORWARD -m conntrack --ctstate INVALID -j DROP
|
||||||
|
-A KUBE-FORWARD -m comment --comment "kubernetes forwarding rules" -m mark --mark 0x4000/0x4000 -j ACCEPT
|
||||||
|
-A KUBE-FORWARD -m comment --comment "kubernetes forwarding conntrack rule" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
||||||
|
COMMIT
|
||||||
|
*nat
|
||||||
|
:KUBE-SERVICES - [0:0]
|
||||||
|
:KUBE-NODEPORTS - [0:0]
|
||||||
|
:KUBE-POSTROUTING - [0:0]
|
||||||
|
:KUBE-MARK-MASQ - [0:0]
|
||||||
|
-A KUBE-POSTROUTING -m mark ! --mark 0x4000/0x4000 -j RETURN
|
||||||
|
-A KUBE-POSTROUTING -j MARK --xor-mark 0x4000
|
||||||
|
-A KUBE-POSTROUTING -m comment --comment "kubernetes service traffic requiring SNAT" -j MASQUERADE
|
||||||
|
-A KUBE-MARK-MASQ -j MARK --or-mark 0x4000
|
||||||
|
-A KUBE-SERVICES -m comment --comment "kubernetes service nodeports; NOTE: this must be the last rule in this chain" -m addrtype --dst-type LOCAL -j KUBE-NODEPORTS
|
||||||
|
COMMIT
|
||||||
|
`,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "ProxyTerminatingEndpoints enabled, terminating endpoints on remote node",
|
||||||
|
terminatingFeatureGate: true,
|
||||||
|
endpointslice: &discovery.EndpointSlice{
|
||||||
|
ObjectMeta: metav1.ObjectMeta{
|
||||||
|
Name: fmt.Sprintf("%s-1", "svc1"),
|
||||||
|
Namespace: "ns1",
|
||||||
|
Labels: map[string]string{discovery.LabelServiceName: "svc1"},
|
||||||
|
},
|
||||||
|
Ports: []discovery.EndpointPort{{
|
||||||
|
Name: utilpointer.StringPtr(""),
|
||||||
|
Port: utilpointer.Int32Ptr(80),
|
||||||
|
Protocol: &tcpProtocol,
|
||||||
|
}},
|
||||||
|
AddressType: discovery.AddressTypeIPv4,
|
||||||
|
Endpoints: []discovery.Endpoint{
|
||||||
|
{
|
||||||
|
Addresses: []string{"10.0.1.5"},
|
||||||
|
Conditions: discovery.EndpointConditions{
|
||||||
|
Ready: utilpointer.BoolPtr(false),
|
||||||
|
Serving: utilpointer.BoolPtr(true),
|
||||||
|
Terminating: utilpointer.BoolPtr(true),
|
||||||
|
},
|
||||||
|
NodeName: utilpointer.StringPtr("host-1"),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
expectedIPTables: `
|
||||||
|
*filter
|
||||||
|
:KUBE-SERVICES - [0:0]
|
||||||
|
:KUBE-EXTERNAL-SERVICES - [0:0]
|
||||||
|
:KUBE-FORWARD - [0:0]
|
||||||
|
:KUBE-NODEPORTS - [0:0]
|
||||||
|
-A KUBE-FORWARD -m conntrack --ctstate INVALID -j DROP
|
||||||
|
-A KUBE-FORWARD -m comment --comment "kubernetes forwarding rules" -m mark --mark 0x4000/0x4000 -j ACCEPT
|
||||||
|
-A KUBE-FORWARD -m comment --comment "kubernetes forwarding conntrack rule" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
||||||
|
COMMIT
|
||||||
|
*nat
|
||||||
|
:KUBE-SERVICES - [0:0]
|
||||||
|
:KUBE-NODEPORTS - [0:0]
|
||||||
|
:KUBE-POSTROUTING - [0:0]
|
||||||
|
:KUBE-MARK-MASQ - [0:0]
|
||||||
|
:KUBE-SEP-EQCHZ7S2PJ72OHAY - [0:0]
|
||||||
|
:KUBE-SVC-AQI2S6QIMU7PVVRP - [0:0]
|
||||||
|
:KUBE-FW-AQI2S6QIMU7PVVRP - [0:0]
|
||||||
|
-A KUBE-POSTROUTING -m mark ! --mark 0x4000/0x4000 -j RETURN
|
||||||
|
-A KUBE-POSTROUTING -j MARK --xor-mark 0x4000
|
||||||
|
-A KUBE-POSTROUTING -m comment --comment "kubernetes service traffic requiring SNAT" -j MASQUERADE
|
||||||
|
-A KUBE-MARK-MASQ -j MARK --or-mark 0x4000
|
||||||
|
-A KUBE-SVC-AQI2S6QIMU7PVVRP -m comment --comment "ns1/svc1 cluster IP" -m tcp -p tcp -d 172.30.1.1 --dport 80 ! -s 10.0.0.0/8 -j KUBE-MARK-MASQ
|
||||||
|
-A KUBE-SVC-AQI2S6QIMU7PVVRP -m comment --comment ns1/svc1 -m recent --name KUBE-SEP-EQCHZ7S2PJ72OHAY --rcheck --seconds 10800 --reap -j KUBE-SEP-EQCHZ7S2PJ72OHAY
|
||||||
|
-A KUBE-SVC-AQI2S6QIMU7PVVRP -m comment --comment ns1/svc1 -j KUBE-SEP-EQCHZ7S2PJ72OHAY
|
||||||
|
-A KUBE-SERVICES -m comment --comment "ns1/svc1 cluster IP" -m tcp -p tcp -d 172.30.1.1 --dport 80 -j KUBE-SVC-AQI2S6QIMU7PVVRP
|
||||||
|
-A KUBE-SERVICES -m comment --comment "ns1/svc1 loadbalancer IP" -m tcp -p tcp -d 1.2.3.4 --dport 80 -j KUBE-FW-AQI2S6QIMU7PVVRP
|
||||||
|
-A KUBE-SEP-EQCHZ7S2PJ72OHAY -m comment --comment ns1/svc1 -s 10.0.1.5 -j KUBE-MARK-MASQ
|
||||||
|
-A KUBE-SEP-EQCHZ7S2PJ72OHAY -m comment --comment ns1/svc1 -m recent --name KUBE-SEP-EQCHZ7S2PJ72OHAY --set -m tcp -p tcp -j DNAT --to-destination 10.0.1.5:80
|
||||||
|
-A KUBE-FW-AQI2S6QIMU7PVVRP -m comment --comment "ns1/svc1 loadbalancer IP" -j KUBE-MARK-MASQ
|
||||||
|
-A KUBE-FW-AQI2S6QIMU7PVVRP -m comment --comment "ns1/svc1 loadbalancer IP" -j KUBE-SVC-AQI2S6QIMU7PVVRP
|
||||||
|
-A KUBE-FW-AQI2S6QIMU7PVVRP -m comment --comment "ns1/svc1 loadbalancer IP" -j KUBE-MARK-DROP
|
||||||
|
-A KUBE-SERVICES -m comment --comment "kubernetes service nodeports; NOTE: this must be the last rule in this chain" -m addrtype --dst-type LOCAL -j KUBE-NODEPORTS
|
||||||
|
COMMIT
|
||||||
|
`,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "no usable endpoints on any node",
|
||||||
|
terminatingFeatureGate: true,
|
||||||
|
endpointslice: &discovery.EndpointSlice{
|
||||||
|
ObjectMeta: metav1.ObjectMeta{
|
||||||
|
Name: fmt.Sprintf("%s-1", "svc1"),
|
||||||
|
Namespace: "ns1",
|
||||||
|
Labels: map[string]string{discovery.LabelServiceName: "svc1"},
|
||||||
|
},
|
||||||
|
Ports: []discovery.EndpointPort{{
|
||||||
|
Name: utilpointer.StringPtr(""),
|
||||||
|
Port: utilpointer.Int32Ptr(80),
|
||||||
|
Protocol: &tcpProtocol,
|
||||||
|
}},
|
||||||
|
AddressType: discovery.AddressTypeIPv4,
|
||||||
|
Endpoints: []discovery.Endpoint{
|
||||||
|
{
|
||||||
|
// Local, not ready or serving
|
||||||
|
Addresses: []string{"10.0.1.5"},
|
||||||
|
Conditions: discovery.EndpointConditions{
|
||||||
|
Ready: utilpointer.BoolPtr(false),
|
||||||
|
Serving: utilpointer.BoolPtr(false),
|
||||||
|
Terminating: utilpointer.BoolPtr(true),
|
||||||
|
},
|
||||||
|
NodeName: utilpointer.StringPtr(testHostname),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
// Remote, not ready or serving
|
||||||
|
Addresses: []string{"10.0.1.5"},
|
||||||
|
Conditions: discovery.EndpointConditions{
|
||||||
|
Ready: utilpointer.BoolPtr(false),
|
||||||
|
Serving: utilpointer.BoolPtr(false),
|
||||||
|
Terminating: utilpointer.BoolPtr(true),
|
||||||
|
},
|
||||||
|
NodeName: utilpointer.StringPtr("host-1"),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
noUsableEndpoints: true,
|
||||||
|
expectedIPTables: `
|
||||||
|
*filter
|
||||||
|
:KUBE-SERVICES - [0:0]
|
||||||
|
:KUBE-EXTERNAL-SERVICES - [0:0]
|
||||||
|
:KUBE-FORWARD - [0:0]
|
||||||
|
:KUBE-NODEPORTS - [0:0]
|
||||||
|
-A KUBE-FORWARD -m conntrack --ctstate INVALID -j DROP
|
||||||
|
-A KUBE-FORWARD -m comment --comment "kubernetes forwarding rules" -m mark --mark 0x4000/0x4000 -j ACCEPT
|
||||||
|
-A KUBE-FORWARD -m comment --comment "kubernetes forwarding conntrack rule" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
||||||
|
-A KUBE-SERVICES -m comment --comment "ns1/svc1 has no endpoints" -m tcp -p tcp -d 172.30.1.1 --dport 80 -j REJECT
|
||||||
|
-A KUBE-EXTERNAL-SERVICES -m comment --comment "ns1/svc1 has no endpoints" -m tcp -p tcp -d 1.2.3.4 --dport 80 -j REJECT
|
||||||
|
COMMIT
|
||||||
|
*nat
|
||||||
|
:KUBE-SERVICES - [0:0]
|
||||||
|
:KUBE-NODEPORTS - [0:0]
|
||||||
|
:KUBE-POSTROUTING - [0:0]
|
||||||
|
:KUBE-MARK-MASQ - [0:0]
|
||||||
|
-A KUBE-POSTROUTING -m mark ! --mark 0x4000/0x4000 -j RETURN
|
||||||
|
-A KUBE-POSTROUTING -j MARK --xor-mark 0x4000
|
||||||
|
-A KUBE-POSTROUTING -m comment --comment "kubernetes service traffic requiring SNAT" -j MASQUERADE
|
||||||
|
-A KUBE-MARK-MASQ -j MARK --or-mark 0x4000
|
||||||
|
-A KUBE-SERVICES -m comment --comment "kubernetes service nodeports; NOTE: this must be the last rule in this chain" -m addrtype --dst-type LOCAL -j KUBE-NODEPORTS
|
||||||
|
COMMIT
|
||||||
|
`,
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, testcase := range testcases {
|
||||||
|
t.Run(testcase.name, func(t *testing.T) {
|
||||||
|
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.ProxyTerminatingEndpoints, testcase.terminatingFeatureGate)()
|
||||||
|
|
||||||
|
ipt := iptablestest.NewFake()
|
||||||
|
fp := NewFakeProxier(ipt)
|
||||||
|
fp.OnServiceSynced()
|
||||||
|
fp.OnEndpointSlicesSynced()
|
||||||
|
|
||||||
|
fp.OnServiceAdd(service)
|
||||||
|
|
||||||
|
fp.OnEndpointSliceAdd(testcase.endpointslice)
|
||||||
|
fp.syncProxyRules()
|
||||||
|
t.Log(fp.iptablesData.String())
|
||||||
|
assertIPTablesRulesEqual(t, testcase.expectedIPTables, fp.iptablesData.String())
|
||||||
|
|
||||||
|
fp.OnEndpointSliceDelete(testcase.endpointslice)
|
||||||
|
fp.syncProxyRules()
|
||||||
|
if testcase.noUsableEndpoints {
|
||||||
|
// Deleting the EndpointSlice should have had no effect
|
||||||
|
assertIPTablesRulesEqual(t, testcase.expectedIPTables, fp.iptablesData.String())
|
||||||
|
} else {
|
||||||
|
assertIPTablesRulesNotEqual(t, testcase.expectedIPTables, fp.iptablesData.String())
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
func TestMasqueradeAll(t *testing.T) {
|
func TestMasqueradeAll(t *testing.T) {
|
||||||
ipt := iptablestest.NewFake()
|
ipt := iptablestest.NewFake()
|
||||||
fp := NewFakeProxier(ipt)
|
fp := NewFakeProxier(ipt)
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user