7d3ba837f5
"iptables-save" takes several seconds to run on machines with lots of iptables rules, and we only use its result to figure out which chains are no longer referenced by any rules. While it makes things less confusing if we delete unused chains immediately, it's not actually _necessary_ since they never get called during packet processing. So in large clusters, make it so we only clean up chains periodically rather than on every sync. |
||
|---|---|---|
| .. | ||
| OWNERS | ||
| proxier_test.go | ||
| proxier.go | ||