github/kubernetes
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
96,543 Commits 1 Branch 31 Tags 1,019 MiB
ffe74b2cf1
Commit Graph

1403 Commits

Author SHA1 Message Date
Matthew Cary
74dbf274d9 update storageos vendor for FilteredDial change 2020-09-18 00:07:32 +00:00
Amim Knabben
a18e5de51a LockToDefault the ExternalPolicyForExternalIP feature gate 2020-09-16 13:16:33 -04:00
tangwz
a143803066 remove feature gate SupportIPVSProxyMode. 2020-09-10 09:03:00 +08:00
elweb9858
b29379687f Updating winkernel kube-proxy OWNERS file 2020-09-03 14:55:09 -07:00
Kubernetes Prow Robot
b2cba08217
Merge pull request #93979 from dcbw/userspace-proxy-test-waitgroups 
proxy/userspace: use waitgroups instead of sketchy atomic ops in testcases
 2020-09-02 17:05:40 -07:00
Dan Williams
0cb5e55409 proxy/userspace: clean up and consolidate testcase setup 2020-09-02 16:20:13 -05:00
Dan Williams
1372bd94fe proxy/userspace: use waitgroups instead of sketchy atomic ops in testcases 
Instead of relying on atomic ops to increment/decrement at the right time
just use waitgroups to provide hard synchronization points.
 2020-09-02 16:20:13 -05:00
Daniel Smith
a86afc12df update scripts 2020-09-02 10:49:40 -07:00
Daniel Smith
75f835aa08 move port definitions to a common location 2020-09-02 10:48:25 -07:00
Kubernetes Prow Robot
163504e9ae
Merge pull request #94107 from robscott/kube-proxy-source-ranges-fix 
Updating kube-proxy to trim space from loadBalancerSourceRanges
 2020-09-01 18:43:51 -07:00
Kubernetes Prow Robot
6e7086d7ca
Merge pull request #93638 from sbangari/refcountfix3 
Avoid dereferencing same endpoint twice on the deletion or update of a service
 2020-09-01 16:35:06 -07:00
Kubernetes Prow Robot
1364a6028d
Merge pull request #92759 from kumarvin123/master 
Updating the Reviewers / Approvers for WinKernel Proxier
 2020-08-27 00:07:16 -07:00
Rob Scott
c382c79f60
Updating kube-proxy to trim space from loadBalancerSourceRanges 
Before this fix, a Service with a loadBalancerSourceRange value that
included a space would cause kube-proxy to crashloop. This updates
kube-proxy to trim any space from that field.
 2020-08-20 18:19:52 -07:00
Vinod K L Swamy
e9719ebc46
Updating the Reviewers / Approvers for WinKernel Proxier 2020-08-03 17:16:22 -07:00
Sravanth Bangari
b96cebf222 fix the remote endpoint cleanup logic 2020-08-03 14:57:44 -07:00
Jordan Liggitt
f33dc28094 generated: hack/update-hack-tools.sh && hack/update-vendor.sh 2020-07-25 16:45:02 -04:00
Christopher M. Luciano
65ff4e8227
ipvs: log error if scheduler does not exist and fallback to rr 
Signed-off-by: Christopher M. Luciano <cmluciano@us.ibm.com>
 2020-07-23 13:58:02 -04:00
Christopher M. Luciano
e2a0eddaf0
ipvs: ensure selected scheduler kernel modules are loaded 
Signed-off-by: Christopher M. Luciano <cmluciano@us.ibm.com>
 2020-07-16 13:21:54 -04:00
Kubernetes Prow Robot
11348a38d7
Merge pull request #92871 from liggitt/kube-features 
Move proxy features to kube_features
 2020-07-11 20:57:22 -07:00
Kubernetes Prow Robot
76e3b255e1
Merge pull request #92836 from aojea/minsyncperiod 
kube-proxy iptables min-sync-period default 1sec
 2020-07-11 20:56:03 -07:00
Rob Scott
8039cf9bb1
Graduating EndpointSliceProxying to beta for Linux 2020-07-07 14:18:03 -07:00
Jordan Liggitt
8d03ace92b Move proxy features to kube_features 2020-07-07 12:34:18 -04:00
Antonio Ojea
f8e64d31f9 kube-proxy iptables min-sync-period default 1sec 
Currently kube-proxy defaults the min-sync-period for
iptables to 0. However, as explained by Dan Winship,

"With minSyncPeriod: 0, you run iptables-restore 100 times.
 With minSyncPeriod: 1s , you run iptables-restore once.
 With minSyncPeriod: 10s , you also run iptables-restore once,
 but you might have to wait 10 seconds first"
 2020-07-07 11:23:00 +02:00
Andrew Sy Kim
de2ecd7e2f proxier/ipvs: check already binded addresses in the IPVS dummy interface 
Signed-off-by: Andrew Sy Kim <kim.andrewsy@gmail.com>
Co-authored-by: Laurent Bernaille <laurent.bernaille@gmail.com>
 2020-07-02 15:32:21 -04:00
Kubernetes Prow Robot
4d0ce2e708
Merge pull request #92584 from aojea/ipvsfix 
IPVS: kubelet, kube-proxy: unmark packets before masquerading …
 2020-07-01 23:13:57 -07:00
Kubernetes Prow Robot
8623c26150
Merge pull request #90909 from kumarvin123/feature/WindowsEpSlices 
EndPointSlices implementation for Windows
 2020-07-01 23:12:01 -07:00
Antonio Ojea
c40081b550 kube-proxy ipvs masquerade hairpin traffic 
Masquerade de traffic that loops back to the originator
before they hit the kubernetes-specific postrouting rules

Signed-off-by: Antonio Ojea <antonio.ojea.garcia@gmail.com>
 2020-07-01 09:16:19 +02:00
Antonio Ojea
c7a29774c9 kube-proxy dual-stack infers IP family from ClusterIP 
when dual-stack kube-proxy infers the service IP family from
the ClusterIP because ipFamily field is going to be deprecated.

Since kube-proxy skip headless and externalname services we
can safely obtain the IPFamily from the ClusterIP field

Signed-off-by: Antonio Ojea <antonio.ojea.garcia@gmail.com>
 2020-06-30 18:42:19 +02:00
Antonio Ojea
a46e1f0613 kube-proxy ShouldSkipService takes only one argument 
instead of receiving the service name and namespace we
can obtain it from the service object directly.

Signed-off-by: Antonio Ojea <antonio.ojea.garcia@gmail.com>
 2020-06-30 18:42:15 +02:00
Kubernetes Prow Robot
8a76c27b8d
Merge pull request #88573 from davidstack/master 
the result value of functrion NodeIPS will contain the docker0 ip , update the comment
 2020-06-30 00:01:59 -07:00
Vinod K L Swamy
bbd4a07dec
Changes to WinKernel to support EndpointSlices 2020-06-29 14:31:15 -07:00
Vinod K L Swamy
4505d5b182
Changes to Proxy common code 2020-06-29 14:29:46 -07:00
Damon Wang
b199dd8ee1 update the comment of NodeIPs function 2020-06-29 15:29:16 +08:00
Kubernetes Prow Robot
73fa63a86d
Merge pull request #92035 from danwinship/unmark-before-masq 
kubelet, kube-proxy: unmark packets before masquerading them
 2020-06-16 00:50:03 -07:00
Dan Winship
c12534d8b4 kubelet, kube-proxy: unmark packets before masquerading them 
It seems that if you set the packet mark on a packet and then route
that packet through a kernel VXLAN interface, the VXLAN-encapsulated
packet will still have the mark from the original packet. Since our
NAT rules are based on the packet mark, this was causing us to
double-NAT some packets, which then triggered a kernel checksumming
bug. But even without the checksum bug, there are reasons to avoid
double-NATting, so fix the rules to unmark the packets before
masquerading them.
 2020-06-15 18:45:38 -04:00
Kubernetes Prow Robot
35fc65dc2c
Merge pull request #89998 from Nordix/issue-89923 
Filter nodePortAddresses to proxiers
 2020-06-13 09:39:55 -07:00
Vinod K L Swamy
ac3f87346f
KubeProxy and DockerShim changes for Ipv6 dual stack support on Windows 
Signed-off-by: Vinod K L Swamy <vinodko@microsoft.com>
 2020-06-10 15:36:48 -07:00
Kubernetes Prow Robot
6ac3ca4b17
Merge pull request #91886 from sbangari/fixsourcevip 
Fix access to Kubernetes Service from inside Windows Pod when two ser…
 2020-06-09 14:49:50 -07:00
Kubernetes Prow Robot
b731b2ebbc
Merge pull request #91905 from lo24/master 
fix minor typos in ipvs readme.md
 2020-06-09 03:13:18 -07:00
Kubernetes Prow Robot
86e14157d0
Merge pull request #91706 from sbangari/remoteendpointrefcount 
Fixing refcounting of remote endpoints used across services
 2020-06-08 21:43:34 -07:00
Sravanth Bangari
c3eb69c1f1 Fix access to Kubernetes Service from inside Windows Pod when two services have same NodeIp as backend (Overlay) 2020-06-08 11:20:56 -07:00
lo24
491961e03c fix minor typos in ipvs readme.md 2020-06-08 14:31:39 +00:00
Sravanth Bangari
cd43fc94f7 Fixing refcounting of remote endpoints used across services 2020-06-04 21:59:14 -07:00
Kubernetes Prow Robot
98de6bd142
Merge pull request #91701 from elweb9858/sessionaffinity 
Adding windows implementation for sessionaffinity
 2020-06-03 17:44:43 -07:00
elweb9858
44096b8f71 Adding windows implementation for sessionaffinity 2020-06-03 13:41:59 -07:00
Kubernetes Prow Robot
8f5e8514b3
Merge pull request #90103 from SataQiu/refactor-proxy-20200413 
kube-proxy: move GetNodeAddresses call out of internal loop to avoid repeated computation
 2020-06-02 19:44:17 -07:00
Andrew Sy Kim
18741157ef proxier/ipvs: remove redundant length check for node addresses 
Signed-off-by: Andrew Sy Kim <kim.andrewsy@gmail.com>
 2020-05-28 11:48:48 -04:00
Andrew Sy Kim
f96d35fc11 proxy utils: GetNodeAddresses should check if matching addresses were found 
Signed-off-by: Andrew Sy Kim <kim.andrewsy@gmail.com>
 2020-05-26 12:45:32 -04:00
Andrew Sy Kim
a99321c87c proxy utils: check network interfaces only once 
Signed-off-by: Andrew Sy Kim <kim.andrewsy@gmail.com>
 2020-05-26 12:12:15 -04:00
SataQiu
b68312e688 kube-proxy: move GetNodeAddresses call out of internal loop to avoid repeated computation 
Signed-off-by: SataQiu <1527062125@qq.com>
 2020-05-26 15:32:05 +08:00
Davanum Srinivas
07d88617e5
Run hack/update-vendor.sh 
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
 2020-05-16 07:54:33 -04:00
Davanum Srinivas
442a69c3bd
switch over k/k to use klog v2 
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
 2020-05-16 07:54:27 -04:00
Lars Ekman
f54b8f98b9 Filter nodePortAddresses to the proxiers. 
Log a warning for addresses of wrong family.
 2020-05-15 09:54:33 +02:00
Casey Callendrello
042daa24ac proxy: followup to last-queued-change metric 
Fixes two small issues with the metric added in #90175:

1. Bump the timestamp on initial informer sync. Otherwise it remains 0 if
   restarting kube-proxy in a quiescent cluster, which isn't quite right.
2. Bump the timestamp even if no healthz server is specified.
 2020-05-11 18:48:47 +02:00
Casey Callendrello
2e1a884bf3 pkg/proxy: add last-queued-timestamp metric 
This adds a metric, kubeproxy_sync_proxy_rules_last_queued_timestamp,
that captures the last time a change was queued to be applied to the
proxy. This matches the healthz logic, which fails if a pending change
is stale.

This allows us to write alerts that mirror healthz.

Signed-off-by: Casey Callendrello <cdc@redhat.com>
 2020-04-21 15:19:32 +02:00
Tim Hockin
9551ecb7c3 Cleanup: Change "Ip" to "IP" in func and var names 2020-04-10 15:29:50 -07:00
Tim Hockin
efb24d44c6 Rename iptables IsIpv6 to IsIPv6 2020-04-10 15:29:50 -07:00
Tim Hockin
ef934a2c5e Add Protocol() method to iptables 
Enables simpler printing of which IP family the iptables interface is
managing.
 2020-04-10 15:29:49 -07:00
Tim Hockin
b874f7c626 Encapsulate sysctl test and log 2020-04-10 15:29:49 -07:00
Tim Hockin
341022f8d1 kube-proxy: log service and endpoint updates 2020-04-10 15:29:44 -07:00
Tim Hockin
37da906db2 kube-proxy: more logging at startup 2020-04-10 15:17:46 -07:00
Kubernetes Prow Robot
4a63d95916
Merge pull request #89792 from andrewsykim/remove-redundant-len-check 
proxy: remove redundant length check on local address sets
 2020-04-10 00:31:47 -07:00
Kubernetes Prow Robot
cabf5d1cdc
Merge pull request #89350 from SataQiu/fix-kube-proxy-20200323 
kube-proxy: treat failure to bind to a port as fatal
 2020-04-06 17:47:20 -07:00
louisgong
619f657b15 add loaded module 2020-04-04 08:49:19 +08:00
Andrew Sy Kim
5169ef5fb5 proxy: remove redundant length check on local address set 
Signed-off-by: Andrew Sy Kim <kim.andrewsy@gmail.com>
 2020-04-02 16:06:51 -04:00
Kubernetes Prow Robot
bbe5594409
Merge pull request #89296 from danwinship/random-emptily 
Don't log whether we're using iptables --random-fully
 2020-04-02 12:42:24 -07:00
Kubernetes Prow Robot
c2ae0bd763
Merge pull request #74073 from Nordix/issue-70020 
Issue #70020; Flush Conntrack entities for SCTP
 2020-04-01 22:14:24 -07:00
SataQiu
871b90ba23 kube-proxy: add '--bind-address-hard-fail' flag to treat failure to bind to a port as fatal 
Signed-off-by: SataQiu <1527062125@qq.com>
 2020-04-02 13:13:10 +08:00
Tim Hockin
15632b10cb Clean up kube-proxy metrics startup 2020-03-30 10:29:14 -07:00
Tim Hockin
8747ba9370 Clean up kube-proxy healthz startup 
Make the healthz package simpler, move retries back to caller.
 2020-03-30 10:29:14 -07:00
Dan Winship
945d5f8d7d Make userspace proxy logging quieter 2020-03-20 08:24:02 -04:00
Dan Winship
8edd656238 Don't log whether we're using iptables --random-fully 2020-03-20 08:06:27 -04:00
Kubernetes Prow Robot
1b3c94b034
Merge pull request #89146 from SataQiu/fix-kube-proxy-20200316 
comment cleanup for kube-proxy
 2020-03-18 22:25:05 -07:00
Kubernetes Prow Robot
42c94f35a7
Merge pull request #88541 from cmluciano/cml/41ipvsfix 
ipvs: only attempt setting of sysctlconnreuse on supported kernels
 2020-03-17 16:21:28 -07:00
SataQiu
64a496e645 kube-proxy: some code cleanup 2020-03-17 21:46:54 +08:00
Minhan Xia
068963fc06 add testing 2020-03-13 14:59:40 -07:00
Minhan Xia
d527a09192 add ExternalTrafficPolicy support for External IPs in ipvs kubeproxy 2020-03-13 14:59:39 -07:00
Minhan Xia
efc4b12186 add ExternalTrafficPolicy support for External IPs in iptables kubeproxy 2020-03-13 14:59:39 -07:00
Christopher M. Luciano
d22e18ad4f
ipvs: only attempt setting of sysctlconnreuse on supported kernels 
This builds on previous work but only sets the sysctlConnReuse value
if the kernel is known to be above 4.19. To avoid calling GetKernelVersion
twice, I store the value from the CanUseIPVS method and then check the version
constraint at time of expected sysctl call.

Signed-off-by: Christopher M. Luciano <cmluciano@us.ibm.com>
 2020-03-12 13:16:00 -04:00
Lars Ekman
aa8521df66 Issue #70020; Flush Conntrack entities for SCTP 
Signed-off-by: Lars Ekman <lars.g.ekman@est.tech>
 2020-03-11 09:56:54 +01:00
Kubernetes Prow Robot
0ec85a1467
Merge pull request #88934 from aojea/endpointnolog 
Stop flooding the kube-proxy logs on dual-stack because of IPFamily
 2020-03-10 12:43:37 -07:00
Satyadeep Musuvathy
e053fdd08a Add NodeCIDR for detect-local-mode 2020-03-09 13:44:34 -07:00
Antonio Ojea
df58c042a8 metaproxier logging for endpoints ipfamily 
The kube-proxy metaproxier implementations tries to get the IPFamily
from the endpoints, but if the endpoints doesn't contains an IP
address it logs a Warning.

This causes that services without endpoints keep flooding the logs
with warnings.

We log this errors with a level of Verbosity of 4 instead of a Warning
 2020-03-07 11:42:02 +01:00
Antonio Ojea
23d9ffd4c8 Add metaproxier unit tests 2020-03-07 00:33:55 +01:00
Kubernetes Prow Robot
0773f108c7
Merge pull request #88710 from SataQiu/ipvs-readme-20200302 
kube-proxy: small cleanup for ipvs readme
 2020-03-03 12:18:22 -08:00
SataQiu
b60c0b5c24 small cleanup for ipvs readme 2020-03-02 10:56:29 +08:00
chendotjs
e79f49ebba validate configuration of kube-proxy IPVS tcp,tcpfin,udp timeout 2020-03-02 10:28:52 +08:00
Satyadeep Musuvathy
8c6956e5bb Refactor handling of local traffic detection. 2020-02-21 17:57:34 -08:00
Kubernetes Prow Robot
09d78529db
Merge pull request #87792 from ksubrmnn/nodeip 
Allow access to default Kubernetes Service from inside Windows Pod (Overlay)
 2020-02-20 03:07:04 -08:00
Kubernetes Prow Robot
ea5cef1c65
Merge pull request #87870 from tedyu/restore-proxier-updater 
Use ProxierHealthUpdater directly to avoid panic
 2020-02-17 10:13:29 -08:00
Kubernetes Prow Robot
ad68c4a8b5
Merge pull request #87699 from michaelbeaumont/fix_66766 
kube-proxy: Only open ipv4 sockets for ipv4 clusters
 2020-02-13 23:54:18 -08:00
Kubernetes Prow Robot
48434c3677
Merge pull request #87117 from aojea/proxyv6LB 
kube-proxy crash when load balancers use a different IP family
 2020-02-13 22:44:17 -08:00
Kubernetes Prow Robot
b9c57a1aa2
Merge pull request #87353 from aojea/kproxy_dual 
kube-proxy: validate dual-stack cidrs
 2020-02-12 17:54:35 -08:00
Andrew Sy Kim
1653476e3f proxier: use IPSet from k8s.io/utils/net to store local addresses 
This allows the proxier to cache local addresses instead of fetching all
local addresses every time in IsLocalIP.

Signed-off-by: Andrew Sy Kim <kiman@vmware.com>
 2020-02-11 16:44:34 -05:00
Andrew Sy Kim
77feb1126e userspace proxy: get local addresses only once per sync loop 
This avoids fetching all local network interfaces everytime we sync an
external IP. For clusters with many external IPs this gets really
expensive. This change caches all local addresses once per sync.

Signed-off-by: Andrew Sy Kim <kiman@vmware.com>
 2020-02-11 16:35:49 -05:00
Andrew Sy Kim
126bf5a231 ipvs proxier: use util proxy methods for getting local addresses 
Signed-off-by: Andrew Sy Kim <kiman@vmware.com>
 2020-02-11 16:35:49 -05:00
Andrew Sy Kim
313c3b81e3 iptables proxier: get local addresses only once per sync loop 
This avoids fetching all local network interfaces everytime we sync an
external IP. For clusters with many external IPs this gets really
expensive. This change caches all local addresses once per sync.

Signed-off-by: Andrew Sy Kim <kiman@vmware.com>
 2020-02-11 16:35:49 -05:00
Antonio Ojea
11263bb57f
kube-proxy filter Load Balancer Status ingress 
kube-proxy, if is configured with an IP family, filters out the
incorrect IP version of the services.

This commit fix a bug caused by not filtering out the IPs in the
LoadBalancer Status Ingress field.
 2020-02-11 10:25:59 +01:00
Ted Yu
7a0690cd59 Use ProxierHealthUpdater directly to avoid panic 2020-02-10 09:41:09 -08:00
ksubrmnn
378fcc809a Check for node IP 2020-02-05 11:44:26 -08:00