Skip to content

K
k3s
Unverified Commit 90e8ea9d authored by Kubernetes Submit Queue's avatar Kubernetes Submit Queue Committed by GitHub
Browse files
Options

Merge pull request #62712 from Lion-Wei/ipvs-fw

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. fix ipvs firewall rules for loadbalancer type service **What this PR does / why we need it**: fix ipvs firewall rules for loadbalancer type service. **Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*: Fixes #62638 **Special notes for your reviewer**: The original firewall rules for loadblancer type service with sourceRange may looks like: ``` Chain KUBE-FIRE-WALL (1 references) target prot opt source destination ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 match-set KUBE-LB-INGRESS-LOCAL dst,dst KUBE-MARK-MASQ all -- 0.0.0.0/0 0.0.0.0/0 /* mark MASQ for external traffic policy not local */ ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 match-set KUBE-LOAD-BALANCER-SOURCE-CIDR dst,dst,src KUBE-MARK-DROP all -- 0.0.0.0/0 0.0.0.0/0 Chain KUBE-SERVICES (2 references) target prot opt source destination KUBE-MARK-MASQ all -- !10.64.0.0/14 0.0.0.0/0 match-set KUBE-CLUSTER-IP dst,dst KUBE-FIRE-WALL all -- 0.0.0.0/0 0.0.0.0/0 match-set KUBE-LOAD-BALANCER dst,dst KUBE-NODE-PORT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp match-set KUBE-NODE-PORT-TCP dst ``` Which may result in other loadbalancer type service can't be access. In this pr, rules of loadbalancer type service with sourceRange specified will be: ``` Chain KUBE-FIRE-WALL (1 references) target prot opt source destination RETURN all -- 0.0.0.0/0 0.0.0.0/0 match-set KUBE-LOAD-BALANCER-SOURCE-CIDR dst,dst,src KUBE-MARK-DROP all -- 0.0.0.0/0 0.0.0.0/0 Chain KUBE-LOAD-BALANCER (1 references) target prot opt source destination KUBE-FIRE-WALL all -- 0.0.0.0/0 0.0.0.0/0 match-set KUBE-LB-INGRESS dst,dst KUBE-MARK-MASQ all -- 0.0.0.0/0 0.0.0.0/0 /* mark MASQ for external traffic policy not local */ Chain KUBE-SERVICES (2 references) target prot opt source destination KUBE-MARK-MASQ all -- !10.64.0.0/14 0.0.0.0/0 match-set KUBE-CLUSTER-IP dst,dst KUBE-LOAD-BALANCER all -- 0.0.0.0/0 0.0.0.0/0 match-set KUBE-LOAD-BALANCER dst,dst ``` **Release note**: ```release-note NONE ```
parents 28a19562 e90de22a
Expand all Hide whitespace changes
Inline Side-by-side
Showing with 26 additions and 11 deletions
pkg/proxy/ipvs/ipset.go
View file @ 90e8ea9d
...@@ -40,8 +40,11 @@ const ( ...@@ -40,8 +40,11 @@ const (
// KubeLoadBalancerSet is used to store service load balancer ingress ip + port, it is the service lb portal. // KubeLoadBalancerSet is used to store service load balancer ingress ip + port, it is the service lb portal.
KubeLoadBalancerSet = "KUBE-LOAD-BALANCER" KubeLoadBalancerSet = "KUBE-LOAD-BALANCER"
// KubeLoadBalancerIngressLocalSet is used to store service load balancer ingress ip + port with externalTrafficPolicy=local. // KubeLoadBalancerLocalSet is used to store service load balancer ingress ip + port with externalTrafficPolicy=local.
KubeLoadBalancerIngressLocalSet = "KUBE-LB-INGRESS-LOCAL" KubeLoadBalancerLocalSet = "KUBE-LOAD-BALANCER-LOCAL"
// KubeLoadbalancerFWSet is used to store service load balancer ingress ip + port for load balancer with sourceRange.
KubeLoadbalancerFWSet = "KUBE-LOAD-BALANCER-FW"
// KubeLoadBalancerSourceIPSet is used to store service load balancer ingress ip + port + source IP for packet filter purpose. // KubeLoadBalancerSourceIPSet is used to store service load balancer ingress ip + port + source IP for packet filter purpose.
KubeLoadBalancerSourceIPSet = "KUBE-LOAD-BALANCER-SOURCE-IP" KubeLoadBalancerSourceIPSet = "KUBE-LOAD-BALANCER-SOURCE-IP"
......
pkg/proxy/ipvs/proxier_test.go
View file @ 90e8ea9d
...@@ -145,8 +145,9 @@ func NewFakeProxier(ipt utiliptables.Interface, ipvs utilipvs.Interface, ipset u ...@@ -145,8 +145,9 @@ func NewFakeProxier(ipt utiliptables.Interface, ipvs utilipvs.Interface, ipset u
loopbackSet: NewIPSet(ipset, KubeLoopBackIPSet, utilipset.HashIPPortIP, false), loopbackSet: NewIPSet(ipset, KubeLoopBackIPSet, utilipset.HashIPPortIP, false),
clusterIPSet: NewIPSet(ipset, KubeClusterIPSet, utilipset.HashIPPort, false), clusterIPSet: NewIPSet(ipset, KubeClusterIPSet, utilipset.HashIPPort, false),
externalIPSet: NewIPSet(ipset, KubeExternalIPSet, utilipset.HashIPPort, false), externalIPSet: NewIPSet(ipset, KubeExternalIPSet, utilipset.HashIPPort, false),
lbIngressSet: NewIPSet(ipset, KubeLoadBalancerSet, utilipset.HashIPPort, false), lbSet: NewIPSet(ipset, KubeLoadBalancerSet, utilipset.HashIPPort, false),
lbIngressLocalSet: NewIPSet(ipset, KubeLoadBalancerIngressLocalSet, utilipset.HashIPPort, false), lbFWSet: NewIPSet(ipset, KubeLoadbalancerFWSet, utilipset.HashIPPort, false),
lbLocalSet: NewIPSet(ipset, KubeLoadBalancerLocalSet, utilipset.HashIPPort, false),
lbWhiteListIPSet: NewIPSet(ipset, KubeLoadBalancerSourceIPSet, utilipset.HashIPPortIP, false), lbWhiteListIPSet: NewIPSet(ipset, KubeLoadBalancerSourceIPSet, utilipset.HashIPPortIP, false),
lbWhiteListCIDRSet: NewIPSet(ipset, KubeLoadBalancerSourceCIDRSet, utilipset.HashIPPortNet, false), lbWhiteListCIDRSet: NewIPSet(ipset, KubeLoadBalancerSourceCIDRSet, utilipset.HashIPPortNet, false),
nodePortSetTCP: NewIPSet(ipset, KubeNodePortSetTCP, utilipset.BitmapPort, false), nodePortSetTCP: NewIPSet(ipset, KubeNodePortSetTCP, utilipset.BitmapPort, false),
...@@ -957,6 +958,12 @@ func TestLoadBalanceSourceRanges(t *testing.T) { ...@@ -957,6 +958,12 @@ func TestLoadBalanceSourceRanges(t *testing.T) {
Protocol: strings.ToLower(string(api.ProtocolTCP)), Protocol: strings.ToLower(string(api.ProtocolTCP)),
SetType: utilipset.HashIPPort, SetType: utilipset.HashIPPort,
}}, }},
KubeLoadbalancerFWSet: {{
IP: svcLBIP,
Port: svcPort,
Protocol: strings.ToLower(string(api.ProtocolTCP)),
SetType: utilipset.HashIPPort,
}},
KubeLoadBalancerSourceCIDRSet: {{ KubeLoadBalancerSourceCIDRSet: {{
IP: svcLBIP, IP: svcLBIP,
Port: svcPort, Port: svcPort,
...@@ -970,10 +977,15 @@ func TestLoadBalanceSourceRanges(t *testing.T) { ...@@ -970,10 +977,15 @@ func TestLoadBalanceSourceRanges(t *testing.T) {
// Check iptables chain and rules // Check iptables chain and rules
epIpt := netlinktest.ExpectedIptablesChain{ epIpt := netlinktest.ExpectedIptablesChain{
string(kubeServicesChain): {{ string(kubeServicesChain): {{
JumpChain: string(KubeFireWallChain), MatchSet: KubeLoadBalancerSet, JumpChain: string(KubeLoadBalancerChain), MatchSet: KubeLoadBalancerSet,
}},
string(KubeLoadBalancerChain): {{
JumpChain: string(KubeFireWallChain), MatchSet: KubeLoadbalancerFWSet,
}, {
JumpChain: string(KubeMarkMasqChain), MatchSet: "",
}}, }},
string(KubeFireWallChain): {{ string(KubeFireWallChain): {{
JumpChain: "ACCEPT", MatchSet: KubeLoadBalancerSourceCIDRSet, JumpChain: "RETURN", MatchSet: KubeLoadBalancerSourceCIDRSet,
}, { }, {
JumpChain: string(KubeMarkDropChain), MatchSet: "", JumpChain: string(KubeMarkDropChain), MatchSet: "",
}}, }},
...@@ -1109,7 +1121,7 @@ func TestOnlyLocalLoadBalancing(t *testing.T) { ...@@ -1109,7 +1121,7 @@ func TestOnlyLocalLoadBalancing(t *testing.T) {
Protocol: strings.ToLower(string(api.ProtocolTCP)), Protocol: strings.ToLower(string(api.ProtocolTCP)),
SetType: utilipset.HashIPPort, SetType: utilipset.HashIPPort,
}}, }},
KubeLoadBalancerIngressLocalSet: {{ KubeLoadBalancerLocalSet: {{
IP: svcLBIP, IP: svcLBIP,
Port: svcPort, Port: svcPort,
Protocol: strings.ToLower(string(api.ProtocolTCP)), Protocol: strings.ToLower(string(api.ProtocolTCP)),
...@@ -1121,10 +1133,10 @@ func TestOnlyLocalLoadBalancing(t *testing.T) { ...@@ -1121,10 +1133,10 @@ func TestOnlyLocalLoadBalancing(t *testing.T) {
// Check iptables chain and rules // Check iptables chain and rules
epIpt := netlinktest.ExpectedIptablesChain{ epIpt := netlinktest.ExpectedIptablesChain{
string(kubeServicesChain): {{ string(kubeServicesChain): {{
JumpChain: string(KubeFireWallChain), MatchSet: KubeLoadBalancerSet, JumpChain: string(KubeLoadBalancerChain), MatchSet: KubeLoadBalancerSet,
}}, }},
string(KubeFireWallChain): {{ string(KubeLoadBalancerChain): {{
JumpChain: "ACCEPT", MatchSet: KubeLoadBalancerIngressLocalSet, JumpChain: "RETURN", MatchSet: KubeLoadBalancerLocalSet,
}, { }, {
JumpChain: string(KubeMarkMasqChain), MatchSet: "", JumpChain: string(KubeMarkMasqChain), MatchSet: "",
}}, }},
...@@ -2580,7 +2592,7 @@ func checkIPSet(t *testing.T, fp *Proxier, ipSet netlinktest.ExpectedIPSet) { ...@@ -2580,7 +2592,7 @@ func checkIPSet(t *testing.T, fp *Proxier, ipSet netlinktest.ExpectedIPSet) {
for set, entries := range ipSet { for set, entries := range ipSet {
ents, err := fp.ipset.ListEntries(set) ents, err := fp.ipset.ListEntries(set)
if err != nil || len(ents) != len(entries) { if err != nil || len(ents) != len(entries) {
t.Errorf("Check ipset entries failed for ipset: %q", set) t.Errorf("Check ipset entries failed for ipset: %q, expect %d, got %d", set, len(entries), len(ents))
continue continue
} }
if len(entries) == 1 { if len(entries) == 1 {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment