mirrors/kube-router
1
0
Fork 0
mirror of https://github.com/cloudnativelabs/kube-router.git synced 2025-10-04 06:21:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

Clean original iptables rule if --random-fully is supported

Browse Source
This commit is contained in:
jakub.coufal 2020-07-29 09:43:42 +02:00
parent 8d424ea09b
commit 68dba40d58
2 changed files with 20 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
pkg/controllers/proxy/network_services_controller.go
View File

@ -1276,6 +1276,16 @@ func (nsc *NetworkServicesController) deleteBadMasqueradeIptablesRules() error {
{"-m", "ipvs", "--ipvs", "--vdir", "ORIGINAL", "--vmethod", "MASQ", "-m", "comment", "--comment", "", "!", "-s", nsc.podCidr, "!", "-d", nsc.podCidr, "-j", "MASQUERADE"}, {"-m", "ipvs", "--ipvs", "--vdir", "ORIGINAL", "--vmethod", "MASQ", "-m", "comment", "--comment", "", "!", "-s", nsc.podCidr, "!", "-d", nsc.podCidr, "-j", "MASQUERADE"},
} }
// If random fully is supported remove the original rules as well
if iptablesCmdHandler.HasRandomFully() {
argsBad = append(argsBad, []string{"-m", "ipvs", "--ipvs", "--vdir", "ORIGINAL", "--vmethod", "MASQ", "-m", "comment", "--comment", "", "-j", "SNAT", "--to-source", nsc.nodeIP.String()})
if len(nsc.podCidr) > 0 {
argsBad = append(argsBad, []string{"-m", "ipvs", "--ipvs", "--vdir", "ORIGINAL", "--vmethod", "MASQ", "-m", "comment", "--comment", "",
"!", "-s", nsc.podCidr, "!", "-d", nsc.podCidr, "-j", "SNAT", "--to-source", nsc.nodeIP.String()})
}
}
for _, args := range argsBad { for _, args := range argsBad {
exists, err := iptablesCmdHandler.Exists("nat", "POSTROUTING", args...) exists, err := iptablesCmdHandler.Exists("nat", "POSTROUTING", args...)
if err != nil { if err != nil {

10
pkg/controllers/routing/pod_egress.go
View File

@ -91,6 +91,16 @@ func (nrc *NetworkRoutingController) deleteBadPodEgressRules() error {
if nrc.isIpv6 { if nrc.isIpv6 {
podEgressArgsBad = podEgressArgsBad6 podEgressArgsBad = podEgressArgsBad6
} }
// If random fully is supported remove the original rule as well
if iptablesCmdHandler.HasRandomFully() {
if !nrc.isIpv6 {
podEgressArgsBad = append(podEgressArgsBad, podEgressArgs4)
} else {
podEgressArgsBad = append(podEgressArgsBad, podEgressArgs6)
}
}
for _, args := range podEgressArgsBad { for _, args := range podEgressArgsBad {
exists, err := iptablesCmdHandler.Exists("nat", "POSTROUTING", args...) exists, err := iptablesCmdHandler.Exists("nat", "POSTROUTING", args...)
if err != nil { if err != nil {