Make kube-proxy resync its rules on firewalld restart

cmd/kube-proxy/app/server.go

@@ -240,6 +240,8 @@ func (s *ProxyServer) Run(_ []string) error {
 		}, 5*time.Second, util.NeverStop)
 	}
 
+	ipt.AddReloadFunc(proxier.Sync)
+
 	// Just loop forever for now...
 	proxier.SyncLoop()
 	return nil

pkg/proxy/iptables/proxier.go

@@ -248,6 +248,13 @@ func ipsEqual(lhs, rhs []string) bool {
 	return true
 }
 
+// Sync is called to immediately synchronize the proxier state to iptables
+func (proxier *Proxier) Sync() {
+	proxier.mu.Lock()
+	defer proxier.mu.Unlock()
+	proxier.syncProxyRules()
+}
+
 // SyncLoop runs periodic work.  This is expected to run as a goroutine or as the main loop of the app.  It does not return.
 func (proxier *Proxier) SyncLoop() {
 	t := time.NewTicker(proxier.syncPeriod)
@@ -255,11 +262,7 @@ func (proxier *Proxier) SyncLoop() {
 	for {
 		<-t.C
 		glog.V(6).Infof("Periodic sync")
-		func() {
-			proxier.mu.Lock()
-			defer proxier.mu.Unlock()
-			proxier.syncProxyRules()
-		}()
+		proxier.Sync()
 	}
 }
 

pkg/proxy/types.go

@@ -29,6 +29,8 @@ type ProxyProvider interface {
 	// Active service proxies are reinitialized if found in the update set or
 	// removed if missing from the update set.
 	OnServiceUpdate(services []api.Service)
+	// Sync immediately synchronizes the ProxyProvider's current state to iptables.
+	Sync()
 	// SyncLoop runs periodic work.
 	// This is expected to run as a goroutine or as the main loop of the app.
 	// It does not return.

pkg/proxy/userspace/proxier.go

@@ -222,6 +222,15 @@ func CleanupLeftovers(ipt iptables.Interface) (encounteredError bool) {
 	return encounteredError
 }
 
+// Sync is called to immediately synchronize the proxier state to iptables
+func (proxier *Proxier) Sync() {
+	if err := iptablesInit(proxier.iptables); err != nil {
+		glog.Errorf("Failed to ensure iptables: %v", err)
+	}
+	proxier.ensurePortals()
+	proxier.cleanupStaleStickySessions()
+}
+
 // SyncLoop runs periodic work.  This is expected to run as a goroutine or as the main loop of the app.  It does not return.
 func (proxier *Proxier) SyncLoop() {
 	t := time.NewTicker(proxier.syncPeriod)
@@ -229,11 +238,7 @@ func (proxier *Proxier) SyncLoop() {
 	for {
 		<-t.C
 		glog.V(6).Infof("Periodic sync")
-		if err := iptablesInit(proxier.iptables); err != nil {
-			glog.Errorf("Failed to ensure iptables: %v", err)
-		}
-		proxier.ensurePortals()
-		proxier.cleanupStaleStickySessions()
+		proxier.Sync()
 	}
 }