github/kubernetes
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

bug fixes and nits

Browse Source
This commit is contained in:
Minhan Xia 2016-08-16 10:56:26 -07:00
parent 1acaa1db09
commit b31874fe82
2 changed files with 20 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
pkg/kubelet/kubelet_network.go
View File

@ -43,7 +43,7 @@ const (
// kubernetes postrouting rules // kubernetes postrouting rules
KubePostroutingChain utiliptables.Chain = "KUBE-POSTROUTING" KubePostroutingChain utiliptables.Chain = "KUBE-POSTROUTING"
// kubernetes postrouting rules // kubernetes firewall rules
KubeFirewallChain utiliptables.Chain = "KUBE-FIREWALL" KubeFirewallChain utiliptables.Chain = "KUBE-FIREWALL"
) )

39
pkg/proxy/iptables/proxier.go
View File

@ -581,11 +581,11 @@ func servicePortChainName(s proxy.ServicePortName, protocol string) utiliptables
return utiliptables.Chain("KUBE-SVC-" + portProtoHash(s, protocol)) return utiliptables.Chain("KUBE-SVC-" + portProtoHash(s, protocol))
} }
// servicePortChainName takes the ServicePortName for a service and // externalLoadBalancerChainName takes the ServicePortName for a service and
// returns the associated iptables chain. This is computed by hashing (sha256) // returns the associated iptables chain. This is computed by hashing (sha256)
// then encoding to base32 and truncating with the prefix "KUBE-FW-". // then encoding to base32 and truncating with the prefix "KUBE-XLB-".
func serviceFirewallChainName(s proxy.ServicePortName, protocol string) utiliptables.Chain { func externalLoadBalancerChainName(s proxy.ServicePortName, protocol string) utiliptables.Chain {
return utiliptables.Chain("KUBE-FW-" + portProtoHash(s, protocol)) return utiliptables.Chain("KUBE-XLB-" + portProtoHash(s, protocol))
} }
// This is the same as servicePortChainName but with the endpoint included. // This is the same as servicePortChainName but with the endpoint included.
@ -872,6 +872,18 @@ func (proxier *Proxier) syncProxyRules() {
// Capture load-balancer ingress. // Capture load-balancer ingress.
for _, ingress := range svcInfo.loadBalancerStatus.Ingress { for _, ingress := range svcInfo.loadBalancerStatus.Ingress {
if ingress.IP != "" { if ingress.IP != "" {
// create service external loadbalancer chain
xlbChain := externalLoadBalancerChainName(svcName, protocol)
if chain, ok := existingNATChains[xlbChain]; ok {
writeLine(natChains, chain)
} else {
writeLine(natChains, utiliptables.MakeChainLine(xlbChain))
}
activeNATChains[xlbChain] = true
// The service firewall rules are created based on ServiceSpec.loadBalancerSourceRanges field.
// This currently works for loadbalancers that preserves source ips.
// For loadbalancers which direct traffic to service NodePort, the firewall rules will not apply.
args := []string{ args := []string{
"-A", string(kubeServicesChain), "-A", string(kubeServicesChain),
"-m", "comment", "--comment", fmt.Sprintf(`"%s loadbalancer IP"`, svcName.String()), "-m", "comment", "--comment", fmt.Sprintf(`"%s loadbalancer IP"`, svcName.String()),
@ -879,25 +891,12 @@ func (proxier *Proxier) syncProxyRules() {
"-d", fmt.Sprintf("%s/32", ingress.IP), "-d", fmt.Sprintf("%s/32", ingress.IP),
"--dport", fmt.Sprintf("%d", svcInfo.port), "--dport", fmt.Sprintf("%d", svcInfo.port),
} }
// create service firewall chain
fwChain := serviceFirewallChainName(svcName, protocol)
if chain, ok := existingNATChains[fwChain]; ok {
writeLine(natChains, chain)
} else {
writeLine(natChains, utiliptables.MakeChainLine(fwChain))
}
// jump to service firewall chain // jump to service firewall chain
// The service firewall rules are created based on ServiceSpec.loadBalancerSourceRanges field. writeLine(natRules, append(args, "-j", string(xlbChain))...)
// This currently works for loadbalancers that preserves source ips.
// For loadbalancers which direct traffic to service NodePort, the firewall rules will not apply.
writeLine(natRules, append(args, "-j", string(fwChain))...)
args = []string{ args = []string{
"-A", string(fwChain), "-A", string(xlbChain),
"-m", "comment", "--comment", fmt.Sprintf(`"%s loadbalancer IP"`, svcName.String()), "-m", "comment", "--comment", fmt.Sprintf(`"%s loadbalancer IP"`, svcName.String()),
"-m", protocol, "-p", protocol,
"-d", fmt.Sprintf("%s/32", ingress.IP),
"--dport", fmt.Sprintf("%d", svcInfo.port),
} }
// We have to SNAT packets from external IPs. // We have to SNAT packets from external IPs.
writeLine(natRules, append(args, "-j", string(KubeMarkMasqChain))...) writeLine(natRules, append(args, "-j", string(KubeMarkMasqChain))...)
@ -1056,7 +1055,7 @@ func (proxier *Proxier) syncProxyRules() {
for chain := range existingNATChains { for chain := range existingNATChains {
if !activeNATChains[chain] { if !activeNATChains[chain] {
chainString := string(chain) chainString := string(chain)
if !strings.HasPrefix(chainString, "KUBE-SVC-") && !strings.HasPrefix(chainString, "KUBE-SEP-") { if !strings.HasPrefix(chainString, "KUBE-SVC-") && !strings.HasPrefix(chainString, "KUBE-SEP-") && !strings.HasPrefix(chainString, "KUBE-XLB-") {
// Ignore chains that aren't ours. // Ignore chains that aren't ours.
continue continue
} }