github/kubernetes
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ipvs: add addrtype match for nodeport

Browse Source
This commit is contained in:
Hong Zhiguo 2018-07-04 17:33:31 +08:00
parent fc081b5941
commit b2bf173aaf
2 changed files with 15 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
pkg/proxy/ipvs/proxier.go
View File

@ -135,6 +135,7 @@ var ipsetInfo = []struct {
// `iptables -t nat -A <from> -m set --match-set <name> <matchType> -j <to>` // `iptables -t nat -A <from> -m set --match-set <name> <matchType> -j <to>`
// example: iptables -t nat -A KUBE-SERVICES -m set --match-set KUBE-NODE-PORT-TCP dst -j KUBE-NODE-PORT // example: iptables -t nat -A KUBE-SERVICES -m set --match-set KUBE-NODE-PORT-TCP dst -j KUBE-NODE-PORT
// ipsets with other match rules will be created Individually. // ipsets with other match rules will be created Individually.
// Note: kubeNodePortLocalSetTCP must be prior to kubeNodePortSetTCP, the same for UDP.
var ipsetWithIptablesChain = []struct { var ipsetWithIptablesChain = []struct {
name string name string
from string from string
@ -148,10 +149,10 @@ var ipsetWithIptablesChain = []struct {
{kubeLoadBalancerSourceCIDRSet, string(KubeFireWallChain), "RETURN", "dst,dst,src", ""}, {kubeLoadBalancerSourceCIDRSet, string(KubeFireWallChain), "RETURN", "dst,dst,src", ""},
{kubeLoadBalancerSourceIPSet, string(KubeFireWallChain), "RETURN", "dst,dst,src", ""}, {kubeLoadBalancerSourceIPSet, string(KubeFireWallChain), "RETURN", "dst,dst,src", ""},
{kubeLoadBalancerLocalSet, string(KubeLoadBalancerChain), "RETURN", "dst,dst", ""}, {kubeLoadBalancerLocalSet, string(KubeLoadBalancerChain), "RETURN", "dst,dst", ""},
{kubeNodePortSetTCP, string(kubeServicesChain), string(KubeNodePortChain), "dst", "tcp"},
{kubeNodePortLocalSetTCP, string(KubeNodePortChain), "RETURN", "dst", "tcp"}, {kubeNodePortLocalSetTCP, string(KubeNodePortChain), "RETURN", "dst", "tcp"},
{kubeNodePortSetUDP, string(kubeServicesChain), string(KubeNodePortChain), "dst", "udp"}, {kubeNodePortSetTCP, string(KubeNodePortChain), string(KubeMarkMasqChain), "dst", "tcp"},
{kubeNodePortLocalSetUDP, string(KubeNodePortChain), "RETURN", "dst", "udp"}, {kubeNodePortLocalSetUDP, string(KubeNodePortChain), "RETURN", "dst", "udp"},
{kubeNodePortSetUDP, string(KubeNodePortChain), string(KubeMarkMasqChain), "dst", "udp"},
} }
var ipvsModules = []string{ var ipvsModules = []string{
@ -1270,11 +1271,12 @@ func (proxier *Proxier) writeIptablesRules() {
writeLine(proxier.natRules, append(dstLocalOnlyArgs, "-j", "ACCEPT")...) writeLine(proxier.natRules, append(dstLocalOnlyArgs, "-j", "ACCEPT")...)
} }
// mark masq for KUBE-NODE-PORT // -A KUBE-SERVICES -m addrtype --dst-type LOCAL -j KUBE-NODE-PORT
writeLine(proxier.natRules, []string{ args = append(args[:0],
"-A", string(KubeNodePortChain), "-A", string(kubeServicesChain),
"-j", string(KubeMarkMasqChain), "-m", "addrtype", "--dst-type", "LOCAL",
}...) )
writeLine(proxier.natRules, append(args, "-j", string(KubeNodePortChain))...)
// mark drop for KUBE-LOAD-BALANCER // mark drop for KUBE-LOAD-BALANCER
writeLine(proxier.natRules, []string{ writeLine(proxier.natRules, []string{

12
pkg/proxy/ipvs/proxier_test.go
View File

@ -477,11 +477,11 @@ func TestNodePortUDP(t *testing.T) {
// Check iptables chain and rules // Check iptables chain and rules
epIpt := netlinktest.ExpectedIptablesChain{ epIpt := netlinktest.ExpectedIptablesChain{
string(kubeServicesChain): {{
JumpChain: string(KubeNodePortChain), MatchSet: kubeNodePortSetUDP,
}},
string(KubeNodePortChain): {{ string(KubeNodePortChain): {{
JumpChain: string(KubeMarkMasqChain), MatchSet: "", JumpChain: string(KubeMarkMasqChain), MatchSet: kubeNodePortSetUDP,
}},
string(kubeServicesChain): {{
JumpChain: string(KubeNodePortChain), MatchSet: "",
}}, }},
} }
checkIptables(t, ipt, epIpt) checkIptables(t, ipt, epIpt)
@ -1049,12 +1049,12 @@ func TestOnlyLocalNodePorts(t *testing.T) {
// Check iptables chain and rules // Check iptables chain and rules
epIpt := netlinktest.ExpectedIptablesChain{ epIpt := netlinktest.ExpectedIptablesChain{
string(kubeServicesChain): {{ string(kubeServicesChain): {{
JumpChain: string(KubeNodePortChain), MatchSet: kubeNodePortSetTCP, JumpChain: string(KubeNodePortChain), MatchSet: "",
}}, }},
string(KubeNodePortChain): {{ string(KubeNodePortChain): {{
JumpChain: "RETURN", MatchSet: kubeNodePortLocalSetTCP, JumpChain: "RETURN", MatchSet: kubeNodePortLocalSetTCP,
}, { }, {
JumpChain: string(KubeMarkMasqChain), MatchSet: "", JumpChain: string(KubeMarkMasqChain), MatchSet: kubeNodePortSetTCP,
}}, }},
} }
checkIptables(t, ipt, epIpt) checkIptables(t, ipt, epIpt)