github/kubernetes
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Made IPVS and iptables modes of kube-proxy fully randomize masquerading if possible

Browse Source 
Work around Linux kernel bug that sometimes causes multiple flows to
get mapped to the same IP:PORT and consequently some suffer packet
drops.

Also made the same update in kubelet.

Also added cross-pointers between the two bodies of code, in comments.

Some day we should eliminate the duplicate code.  But today is not
that day.
This commit is contained in:
Mike Spreitzer
2019-08-26 22:47:21 -04:00
parent 7600f91b30
commit d86d1defa1
8 changed files with 123 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
pkg/kubelet/kubelet_network_linux.go
View File

@@ -96,9 +96,21 @@ func (kl *Kubelet) syncNetworkUtil() {
klog.Errorf("Failed to ensure that %s chain %s jumps to %s: %v", utiliptables.TableNAT, utiliptables.ChainPostrouting, KubePostroutingChain, err)
return
}
if _, err := kl.iptClient.EnsureRule(utiliptables.Append, utiliptables.TableNAT, KubePostroutingChain,
// Establish the masquerading rule.
// NB: THIS MUST MATCH the corresponding code in the iptables and ipvs
// modes of kube-proxy
masqRule := []string{
"-m", "comment", "--comment", "kubernetes service traffic requiring SNAT",
"-m", "mark", "--mark", masqueradeMark, "-j", "MASQUERADE"); err != nil {
"-m", "mark", "--mark", masqueradeMark,
"-j", "MASQUERADE",
}
if kl.iptClient.HasRandomFully() {
masqRule = append(masqRule, "--random-fully")
klog.V(3).Info("Using `--random-fully` in the MASQUERADE rule for iptables")
} else {
klog.V(2).Info("Not using `--random-fully` in the MASQUERADE rule for iptables because the local version of iptables does not support it")
}
if _, err := kl.iptClient.EnsureRule(utiliptables.Append, utiliptables.TableNAT, KubePostroutingChain, masqRule...); err != nil {
klog.Errorf("Failed to ensure SNAT rule for packets marked by %v in %v chain %v: %v", KubeMarkMasqChain, utiliptables.TableNAT, KubePostroutingChain, err)
return
}