Commit Graph

235 Commits

Author SHA1 Message Date
Jeff Grafton
efee0704c6 Autogenerate BUILD files 2017-12-23 13:12:11 -08:00
Kubernetes Submit Queue
02ca5cac01
Merge pull request #53555 from leblancd/v6_del_endpoint_proxier
Automatic merge from submit-queue (batch tested with PRs 55988, 53555, 55858). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add IPv6 and negative UT test cases for proxier's deleteEndpointConnections

This change adds IPv6 and negative UT test cases for the proxier's deleteEndpointConnections.

Changes include:
- Add IPv6 UT test cases to TestDeleteEndpointConnections.
- Add negative UT test case to TestDeleteEndpointConnections for
  handling case where no connections need clearing (benign error).
- Add negative UT test case to test unexpected error.
- Reorganize UT in TestDeleteEndpointConnections so that the fake
  command executor's command and scripted responses are generated on
  the fly based on the test case table (rather than using a fixed
  set of commands/responses that will need to be updated every time
  test cases are added/deleted).
- Create the proxier service map in real time, based on the test case
  table (rather than using a fixed service map that will need to be updated
  every time test cases are added/deleted).

fixes #53554



**What this PR does / why we need it**:
This change adds IPv6 and negative UT test cases for the proxier's
deleteEndpointConnections.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #53554

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2017-11-18 20:31:23 -08:00
Kubernetes Submit Queue
5e178936a1
Merge pull request #53780 from m1093782566/validate-ipvs
Automatic merge from submit-queue (batch tested with PRs 53780, 55663, 55321, 52421, 55659). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Validate kube-proxy options

**What this PR does / why we need it**:

Validate ipvs proxy options

**Which issue this PR fixes** : fixes #53852

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2017-11-15 09:30:24 -08:00
Kubernetes Submit Queue
2f622b2a28
Merge pull request #52569 from tmjd/add-proxy-forward-rules
Automatic merge from submit-queue (batch tested with PRs 55009, 55532, 55601, 52569, 55533). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Kube-proxy adds forward rules to ensure NodePorts work

**What this PR does / why we need it**:
Updates kube-proxy to set up proper forwarding so that NodePorts work with docker 1.13 without depending on iptables FORWARD being changed manually/externally.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #39823

**Special notes for your reviewer**:
@thockin I used option number 2 that I mentioned in the #39823 issue, please let me know what you think about this change.  If you are happy with the change then I can try to add tests but may need a little direction about what and where to add them.

**Release note**:

```release-note
Add iptables rules to allow Pod traffic even when default iptables policy is to reject.
```
2017-11-14 00:09:57 -08:00
Kubernetes Submit Queue
cae7240cf9
Merge pull request #55601 from m1093782566/getlocalips
Automatic merge from submit-queue (batch tested with PRs 55009, 55532, 55601, 52569, 55533). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix ipvs/proxy getLocalIPs inconsistency with iptables/proxy

**What this PR does / why we need it**:

* Fix ipvs/proxy `getLocalIPs()` inconsistency with iptables/proxy

* validate the ip address before pkg/proxy/util IPPart() return ip string.

**Which issue(s) this PR fixes** :
Fixes #55612

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2017-11-14 00:09:52 -08:00
m1093782566
42832e7666 fix ipvs proxier getLocalIPs() error 2017-11-13 17:55:53 +08:00
Kubernetes Submit Queue
d6cabaf706
Merge pull request #55568 from m1093782566/unsortlist
Automatic merge from submit-queue (batch tested with PRs 53580, 55568). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Replace sets.List() with sets.UnsortedList() in pkg/proxy

**What this PR does / why we need it**:

Replace sets.List() with sets.UnsortedList() in pkg/proxy - sets.List() will sort the result array, we don't need sorted array in pkg/proxy. Using sets.UnsortedList() can reduce the unnecessary overhead spending.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

@wojtek-t wdyt ^_^

**Release note**:

```release-note
NONE
```

/sig network
2017-11-12 21:07:37 -08:00
m1093782566
83ada5c7bf replace sets.List() with sets.UnsortedList() 2017-11-13 10:20:54 +08:00
Zihong Zheng
f7ed9cf09a [kube-proxy] Fix session affinity with local endpoints traffic 2017-11-10 18:42:07 -08:00
Dr. Stefan Schimanski
bec617f3cc Update generated files 2017-11-09 12:14:08 +01:00
Dr. Stefan Schimanski
012b085ac8 pkg/apis/core: mechanical import fixes in dependencies 2017-11-09 12:14:08 +01:00
m1093782566
c7071ed09a try ipset in ipvs proxy mode 2017-11-07 17:34:27 +08:00
m1093782566
28000f925f fix IPV6 judgement bug and add UTs 2017-10-31 10:02:07 +08:00
Erik Stidham
535634f547 Review updates 2017-10-30 13:44:43 -05:00
Phil Cameron
965cf128b6 Remove iptables log on restore failure
Don't log the set of rules at v2 in kube-proxy on error.
The rules are displayed at v5 before the restore is attempted.

In a large cluster the report can generate up to 100000 lines.
A partial report is only helpful if the problem is displayed
in the partial report.
2017-10-27 09:14:35 -04:00
m1093782566
dab9b84b67 add proxy metrics in app level 2017-10-16 21:10:51 +08:00
Jeff Grafton
aee5f457db update BUILD files 2017-10-15 18:18:13 -07:00
Dane LeBlanc
799341f2dc Add IPv6 and negative UT test cases for proxier's deleteEndpointConnections
This change adds IPv6 and negative UT test cases for the proxier's
deleteEndpointConnections.

Changes include:
- Add IPv6 UT test cases to TestDeleteEndpointConnections.
- Add negative UT test case to TestDeleteEndpointConnections for
  handling case where no connections need clearing (benign error).
- Add negative UT test case to test unexpected error.
- Reorganize UT in TestDeleteEndpointConnections so that the fake
  command executor's command and scripted responses are generated on
  the fly based on the test case table (rather than using a fixed
  set of commands/responses that will need to be updated every time
  test cases are added/deleted).
- Create the proxier service map in real time, based on the test case
  table (rather than using a fixed service map that will need to be updated
  every time test cases are added/deleted).

fixes #53554
2017-10-12 20:07:19 -04:00
m1093782566
d96409178b consume endpoints IPPart function in util 2017-10-11 09:51:58 +08:00
Kubernetes Submit Queue
a0c93de03d Merge pull request #52028 from leblancd/v6_conntrack
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add required family flag for conntrack IPv6 operation

This change causes kube-proxy to supply the required "-f ipv6"
family flag whenever the conntrack utility is executed and the
associated service is using IPv6.

This change is required for IPv6-only operation.

Note that unit test coverage for the 2-line changes in
pkg/proxy/iptables/proxier.go and /pkg/proxy/ipvs/proxier.go will need
to be added after support for IPv6 service addresses is added to these
files. For pkg/proxy/iptables/proxier.go, this coverage will be added
either with PR #48551.

fixes #52027



**What this PR does / why we need it**:
Kube-proxy is currently not supplying the required "-f ipv6" family flag whenever it
calls the conntrack utility and the associated service is using an IPv6 service IP address.
This means that for IPv6-only operation, conntrack is not properly cleaning up
stale UDP connections, and this may be effecting ip6tables operation.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes # 52027

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2017-10-04 17:11:36 -07:00
Dane LeBlanc
5fbc9e45cc Add IPv6 support to iptables proxier
The following changes are proposed for the iptables proxier:

* There are three places where a string specifying IP:port is parsed
  using something like this:

      if index := strings.Index(e.endpoint, ":"); index != -1 {

  This will fail for IPv6 since V6 addresses contain colons. Also,
  the V6 address is expected to be surrounded by square brackets
  (i.e. []:). Fix this by replacing call to Index with
  call to LastIndex() and stripping out square brackets.
* The String() method for the localPort struct should put square brackets
  around IPv6 addresses.
* The logging in the merge() method for proxyServiceMap should put brackets
  around IPv6 addresses.
* There are several places where filterRules destination is hardcoded to
  /32. This should be a /128 for IPv6 case.
* Add IPv6 unit test cases

fixes #48550
2017-09-16 09:16:12 -04:00
Erik Stidham
7c108f595d Initial changes for adding forward rules 2017-09-15 13:34:20 -05:00
Dane LeBlanc
502d14afd4 Add required family flag for conntrack IPv6 operation
This change causes kube-proxy to supply the required "-f ipv6"
family flag whenever the conntrack utility is executed and the
associated service is using IPv6.

This change is required for IPv6-only operation.

Note that unit test coverage for the 2-line changes in
pkg/proxy/iptables/proxier.go and /pkg/proxy/ipvs/proxier.go will need
to be added after support for IPv6 service addresses is added to these
files. For pkg/proxy/iptables/proxier.go, this coverage will be added
either with PR #48551.

fixes #52027
2017-09-06 18:05:06 -04:00
m1093782566
1faa6f56b9 fix kube-proxy panic 2017-09-01 16:18:03 +08:00
Kubernetes Submit Queue
b65f3cc8dd Merge pull request #49850 from m1093782566/service-session-timeout
Automatic merge from submit-queue (batch tested with PRs 49850, 47782, 50595, 50730, 51341)

Paramaterize `stickyMaxAgeMinutes` for service in API

**What this PR does / why we need it**:

Currently I find `stickyMaxAgeMinutes` for a session affinity type service is hard code to 180min. There is a TODO comment, see

https://github.com/kubernetes/kubernetes/blob/master/pkg/proxy/iptables/proxier.go#L205

I think the seesion sticky max time varies from service to service and users may not aware of it since it's hard coded in all proxier.go - iptables, userspace and winuserspace.

Once we parameterize it in API, users can set/get the values for their different services.

Perhaps, we can introduce a new field `api.ClientIPAffinityConfig` in `api.ServiceSpec`.

There is an initial discussion about it in sig-network group. See,

https://groups.google.com/forum/#!topic/kubernetes-sig-network/i-LkeHrjs80

**Which issue this PR fixes**: 

fixes #49831

**Special notes for your reviewer**:

**Release note**:

```release-note
Paramaterize session affinity timeout seconds in service API for Client IP based session affinity.
```
2017-08-25 20:43:30 -07:00
m1093782566
c355a2ac96 Paramaterize stickyMaxAgeMinutes for service in API 2017-08-25 17:44:47 +08:00
m1093782566
a7fd545d49 clean up LocalPort in proxier.go 2017-08-24 11:16:38 +08:00
m1093782566
992f618343 move IsLocalIP() and ShouldSkipService() to pkg/proxy/util 2017-08-17 14:32:05 +08:00
m1093782566
7b8372db99 move UDP conntrack operations together to pkg/proxy/util/conntrack.go 2017-08-12 11:10:04 +08:00
Jeff Grafton
a7f49c906d Use buildozer to delete licenses() rules except under third_party/ 2017-08-11 09:32:39 -07:00
Jeff Grafton
33276f06be Use buildozer to remove deprecated automanaged tags 2017-08-11 09:31:50 -07:00
xiangpengzhao
ea1a577358 Remove some helpers associated with ESIPP. 2017-08-09 14:25:08 +08:00
xiangpengzhao
ebe21ee4c1 Remove deprecated ESIPP beta annotations 2017-08-05 15:00:58 +08:00
Kubernetes Submit Queue
7b55a2d385 Merge pull request #48624 from derekwaynecarr/log-abridged
Automatic merge from submit-queue

Log abridged set of rules at v2 in kube-proxy on error

**What this PR does / why we need it**:
this is a follow-on to https://github.com/kubernetes/kubernetes/pull/48085

**Special notes for your reviewer**:
we hit this in operations where we typically run in v2, and would like to log abridged set of output rather than full output.

**Release note**:
```release-note
NONE
```
2017-08-02 15:26:37 -07:00
Derek Carr
3bddef790b Log abridged set of rules at v2 in kube-proxy on error 2017-07-25 10:32:16 -04:00
supereagle
adc0eef43e remove duplicated import and wrong alias name of api package 2017-07-25 10:04:25 +08:00
ymqytw
9b393a83d4 update godep 2017-07-20 11:03:49 -07:00
ymqytw
3dfc8bf7f3 update import 2017-07-20 11:03:49 -07:00
Mike Danese
c201553f27 remove some people from OWNERS so they don't get reviews anymore
These are googlers who don't work on the project anymore but are still
getting reviews assigned to them:
- bprashanth
- rjnagal
- vmarmol
2017-07-13 10:02:21 -07:00
Minhan Xia
68a2749b28 fix unit tests 2017-07-06 16:01:03 -07:00
Minhan Xia
46d3e83caf refactor updateEndpointMap and updateServiceMap results 2017-07-06 16:00:57 -07:00
Minhan Xia
25ac521f88 flush conntrack entry for udp service when # of backend changes from 0 to non-0 2017-07-06 15:12:44 -07:00
xiangpengzhao
9e31eb280a Populate endpoints and allow ports with headless service 2017-06-28 11:15:51 +08:00
Shyam Jeedigunta
d354e0bf4f Move iptables logging in kubeproxy from Errorf to V(2).Infof 2017-06-26 19:59:23 +02:00
Chao Xu
60604f8818 run hack/update-all 2017-06-22 11:31:03 -07:00
Chao Xu
f2d3220a11 run root-rewrite-import-client-go-api-types 2017-06-22 11:30:59 -07:00
Kubernetes Submit Queue
9054e70ca3 Merge pull request #38751 from chenchun/warn
Automatic merge from submit-queue

Raise a warning instead of info if br-netfilter is missing or unset

Took quite a while to figure out why service VIP is unreachable on my cluster. It turns out br-nf-call-iptables is unset. I wish this message could be a warning to attract considerable attention.
2017-06-16 17:25:32 -07:00
Tim Hockin
ce8309780f Proxy: comments around ClusterCIDR use 2017-06-01 12:36:31 -07:00
Wojciech Tyczynski
03c255d7c5 Store chain names to avoid recomputing them multiple times 2017-05-30 10:50:10 +02:00
Wojciech Tyczynski
c4d51f12a2 Store port endpoint chain names to avoid recomputing it multiple times 2017-05-30 10:49:36 +02:00