Skip to content

K
k3s
Unverified Commit e92ea04e authored by Kubernetes Submit Queue's avatar Kubernetes Submit Queue Committed by GitHub
Browse files
Options

Merge pull request #65630 from honkiko/fix-missing-protocol-match

Automatic merge from submit-queue (batch tested with PRs 65412, 65630). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. fix missing protocol match in ipvs mode **What this PR does / why we need it**: fix missing protocol match in ipvs mode. See issue #65574 **Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*: Fixes #65574 **Special notes for your reviewer**: Tested cases: - ClusterIP distributed to pod on same node - ClusterIP distributed to pod on other node - NodePort distributed to pod on same node - NodePort distributed to pod on other node **Release note**: ```release-note ```
parents 36815869 56a717ef
Hide whitespace changes
Inline Side-by-side
Showing with 20 additions and 35 deletions
pkg/proxy/ipvs/proxier.go
View file @ e92ea04e
...@@ -136,19 +136,22 @@ var ipsetInfo = []struct { ...@@ -136,19 +136,22 @@ var ipsetInfo = []struct {
// example: iptables -t nat -A KUBE-SERVICES -m set --match-set KUBE-NODE-PORT-TCP dst -j KUBE-NODE-PORT // example: iptables -t nat -A KUBE-SERVICES -m set --match-set KUBE-NODE-PORT-TCP dst -j KUBE-NODE-PORT
// ipsets with other match rules will be created Individually. // ipsets with other match rules will be created Individually.
var ipsetWithIptablesChain = []struct { var ipsetWithIptablesChain = []struct {
name string name string
from string from string
to string to string
matchType string matchType string
protocolMatch string
}{ }{
{kubeLoopBackIPSet, string(kubePostroutingChain), "MASQUERADE", "dst,dst,src"}, {kubeLoopBackIPSet, string(kubePostroutingChain), "MASQUERADE", "dst,dst,src", ""},
{kubeLoadBalancerSet, string(kubeServicesChain), string(KubeLoadBalancerChain), "dst,dst"}, {kubeLoadBalancerSet, string(kubeServicesChain), string(KubeLoadBalancerChain), "dst,dst", ""},
{kubeLoadbalancerFWSet, string(KubeLoadBalancerChain), string(KubeFireWallChain), "dst,dst"}, {kubeLoadbalancerFWSet, string(KubeLoadBalancerChain), string(KubeFireWallChain), "dst,dst", ""},
{kubeLoadBalancerSourceCIDRSet, string(KubeFireWallChain), "RETURN", "dst,dst,src"}, {kubeLoadBalancerSourceCIDRSet, string(KubeFireWallChain), "RETURN", "dst,dst,src", ""},
{kubeLoadBalancerSourceIPSet, string(KubeFireWallChain), "RETURN", "dst,dst,src"}, {kubeLoadBalancerSourceIPSet, string(KubeFireWallChain), "RETURN", "dst,dst,src", ""},
{kubeLoadBalancerLocalSet, string(KubeLoadBalancerChain), "RETURN", "dst,dst"}, {kubeLoadBalancerLocalSet, string(KubeLoadBalancerChain), "RETURN", "dst,dst", ""},
{kubeNodePortSetTCP, string(kubeServicesChain), string(KubeNodePortChain), "dst"}, {kubeNodePortSetTCP, string(kubeServicesChain), string(KubeNodePortChain), "dst", "tcp"},
{kubeNodePortLocalSetTCP, string(KubeNodePortChain), "RETURN", "dst"}, {kubeNodePortLocalSetTCP, string(KubeNodePortChain), "RETURN", "dst", "tcp"},
{kubeNodePortSetUDP, string(kubeServicesChain), string(KubeNodePortChain), "dst", "udp"},
{kubeNodePortLocalSetUDP, string(KubeNodePortChain), "RETURN", "dst", "udp"},
} }
var ipvsModules = []string{ var ipvsModules = []string{
...@@ -1204,8 +1207,11 @@ func (proxier *Proxier) writeIptablesRules() { ...@@ -1204,8 +1207,11 @@ func (proxier *Proxier) writeIptablesRules() {
for _, set := range ipsetWithIptablesChain { for _, set := range ipsetWithIptablesChain {
if _, find := proxier.ipsetList[set.name]; find && !proxier.ipsetList[set.name].isEmpty() { if _, find := proxier.ipsetList[set.name]; find && !proxier.ipsetList[set.name].isEmpty() {
args = append(args[:0], args = append(args[:0], "-A", set.from)
"-A", set.from, if set.protocolMatch != "" {
args = append(args, "-p", set.protocolMatch)
}
args = append(args,
"-m", "comment", "--comment", proxier.ipsetList[set.name].getComment(), "-m", "comment", "--comment", proxier.ipsetList[set.name].getComment(),
"-m", "set", "--match-set", set.name, "-m", "set", "--match-set", set.name,
set.matchType, set.matchType,
...@@ -1264,27 +1270,6 @@ func (proxier *Proxier) writeIptablesRules() { ...@@ -1264,27 +1270,6 @@ func (proxier *Proxier) writeIptablesRules() {
writeLine(proxier.natRules, append(dstLocalOnlyArgs, "-j", "ACCEPT")...) writeLine(proxier.natRules, append(dstLocalOnlyArgs, "-j", "ACCEPT")...)
} }
if !proxier.ipsetList[kubeNodePortSetUDP].isEmpty() {
// accept for nodeports w/ externaltrafficpolicy=local
args = append(args[:0],
"-A", string(kubeServicesChain),
"-m", "udp", "-p", "udp",
"-m", "comment", "--comment", proxier.ipsetList[kubeNodePortSetUDP].getComment(),
"-m", "set", "--match-set", kubeNodePortSetUDP,
"dst",
)
writeLine(proxier.natRules, append(args, "-j", string(KubeNodePortChain))...)
if !proxier.ipsetList[kubeNodePortLocalSetUDP].isEmpty() {
args = append(args[:0],
"-A", string(KubeNodePortChain),
"-m", "comment", "--comment", proxier.ipsetList[kubeNodePortLocalSetUDP].getComment(),
"-m", "set", "--match-set", kubeNodePortLocalSetUDP,
"dst",
)
writeLine(proxier.natRules, append(args, "-j", "ACCEPT")...)
}
}
// mark masq for KUBE-NODE-PORT // mark masq for KUBE-NODE-PORT
writeLine(proxier.natRules, []string{ writeLine(proxier.natRules, []string{
"-A", string(KubeNodePortChain), "-A", string(KubeNodePortChain),
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment