Skip to content

K
k3s
Unverified Commit 084076dc authored by Kubernetes Submit Queue's avatar Kubernetes Submit Queue Committed by GitHub
Browse files
Options

Merge pull request #55360 from ihmccreery/iptables

Automatic merge from submit-queue (batch tested with PRs 55360, 56444, 56687, 56791, 56802). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Configure metadata concealment iptables rules in node startup. **What this PR does / why we need it**: Configure iptables rule for metadata concealment at startup so the pod doesn't have to, to reduce memory consumption. **Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*: Fixes # **Special notes for your reviewer**: **Release note**: ```release-note NONE ```
parents 08ea3d2a 2ca9a318
Hide whitespace changes
Inline Side-by-side
Showing with 10 additions and 14 deletions
cluster/addons/metadata-proxy/gce/metadata-proxy.yaml
View file @ 084076dc
...@@ -38,7 +38,7 @@ spec: ...@@ -38,7 +38,7 @@ spec:
dnsPolicy: Default dnsPolicy: Default
containers: containers:
- name: metadata-proxy - name: metadata-proxy
image: gcr.io/google_containers/metadata-proxy:v0.1.4 image: gcr.io/google_containers/metadata-proxy:v0.1.5
securityContext: securityContext:
privileged: true privileged: true
resources: resources:
......
cluster/gce/configure-vm.sh
View file @ 084076dc
...@@ -86,11 +86,9 @@ ensure-local-disks() { ...@@ -86,11 +86,9 @@ ensure-local-disks() {
function config-ip-firewall { function config-ip-firewall {
echo "Configuring IP firewall rules" echo "Configuring IP firewall rules"
iptables -N KUBE-METADATA-SERVER
iptables -I FORWARD -p tcp -d 169.254.169.254 --dport 80 -j KUBE-METADATA-SERVER
if [[ "${ENABLE_METADATA_CONCEALMENT:-}" == "true" ]]; then if [[ "${ENABLE_METADATA_CONCEALMENT:-}" == "true" ]]; then
iptables -A KUBE-METADATA-SERVER -j DROP echo "Add rule for metadata concealment"
iptables -w -t nat -I PREROUTING -p tcp -d 169.254.169.254 --dport 80 -m comment --comment "metadata-concealment: bridge traffic to metadata server goes to metadata proxy" -j DNAT --to-destination 127.0.0.1:988
fi fi
} }
...@@ -856,7 +854,6 @@ fi ...@@ -856,7 +854,6 @@ fi
if [[ -z "${is_push}" ]]; then if [[ -z "${is_push}" ]]; then
echo "== kube-up node config starting ==" echo "== kube-up node config starting =="
set-broken-motd set-broken-motd
config-ip-firewall
ensure-basic-networking ensure-basic-networking
fix-apt-sources fix-apt-sources
ensure-install-dir ensure-install-dir
...@@ -873,6 +870,7 @@ if [[ -z "${is_push}" ]]; then ...@@ -873,6 +870,7 @@ if [[ -z "${is_push}" ]]; then
download-release download-release
configure-salt configure-salt
remove-docker-artifacts remove-docker-artifacts
config-ip-firewall
run-salt run-salt
reset-motd reset-motd
......
cluster/gce/gci/configure-helper.sh
View file @ 084076dc
...@@ -57,18 +57,11 @@ function config-ip-firewall { ...@@ -57,18 +57,11 @@ function config-ip-firewall {
iptables -A FORWARD -w -p ICMP -j ACCEPT iptables -A FORWARD -w -p ICMP -j ACCEPT
fi fi
iptables -w -N KUBE-METADATA-SERVER
iptables -w -I FORWARD -p tcp -d 169.254.169.254 --dport 80 -j KUBE-METADATA-SERVER
if [[ "${ENABLE_METADATA_CONCEALMENT:-}" == "true" ]]; then
iptables -w -A KUBE-METADATA-SERVER -j DROP
fi
# Flush iptables nat table # Flush iptables nat table
iptables -w -t nat -F || true iptables -w -t nat -F || true
echo "Add rules for ip masquerade"
if [[ "${NON_MASQUERADE_CIDR:-}" == "0.0.0.0/0" ]]; then if [[ "${NON_MASQUERADE_CIDR:-}" == "0.0.0.0/0" ]]; then
echo "Add rules for ip masquerade"
iptables -w -t nat -N IP-MASQ iptables -w -t nat -N IP-MASQ
iptables -w -t nat -A POSTROUTING -m comment --comment "ip-masq: ensure nat POSTROUTING directs all non-LOCAL destination traffic to our custom IP-MASQ chain" -m addrtype ! --dst-type LOCAL -j IP-MASQ iptables -w -t nat -A POSTROUTING -m comment --comment "ip-masq: ensure nat POSTROUTING directs all non-LOCAL destination traffic to our custom IP-MASQ chain" -m addrtype ! --dst-type LOCAL -j IP-MASQ
iptables -w -t nat -A IP-MASQ -d 169.254.0.0/16 -m comment --comment "ip-masq: local traffic is not subject to MASQUERADE" -j RETURN iptables -w -t nat -A IP-MASQ -d 169.254.0.0/16 -m comment --comment "ip-masq: local traffic is not subject to MASQUERADE" -j RETURN
...@@ -77,6 +70,11 @@ function config-ip-firewall { ...@@ -77,6 +70,11 @@ function config-ip-firewall {
iptables -w -t nat -A IP-MASQ -d 192.168.0.0/16 -m comment --comment "ip-masq: local traffic is not subject to MASQUERADE" -j RETURN iptables -w -t nat -A IP-MASQ -d 192.168.0.0/16 -m comment --comment "ip-masq: local traffic is not subject to MASQUERADE" -j RETURN
iptables -w -t nat -A IP-MASQ -m comment --comment "ip-masq: outbound traffic is subject to MASQUERADE (must be last in chain)" -j MASQUERADE iptables -w -t nat -A IP-MASQ -m comment --comment "ip-masq: outbound traffic is subject to MASQUERADE (must be last in chain)" -j MASQUERADE
fi fi
if [[ "${ENABLE_METADATA_CONCEALMENT:-}" == "true" ]]; then
echo "Add rule for metadata concealment"
iptables -w -t nat -I PREROUTING -p tcp -d 169.254.169.254 --dport 80 -m comment --comment "metadata-concealment: bridge traffic to metadata server goes to metadata proxy" -j DNAT --to-destination 127.0.0.1:988
fi
} }
function create-dirs { function create-dirs {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment