Partially Implement #3760

cmd/kube-proxy/app/server.go

@@ -31,12 +31,14 @@ import (
 	clientcmdapi "k8s.io/kubernetes/pkg/client/clientcmd/api"
 	"k8s.io/kubernetes/pkg/client/record"
 	"k8s.io/kubernetes/pkg/kubelet/qos"
+	"k8s.io/kubernetes/pkg/proxy"
 	"k8s.io/kubernetes/pkg/proxy/config"
+	"k8s.io/kubernetes/pkg/proxy/iptables"
 	"k8s.io/kubernetes/pkg/proxy/userspace"
 	"k8s.io/kubernetes/pkg/types"
 	"k8s.io/kubernetes/pkg/util"
 	"k8s.io/kubernetes/pkg/util/exec"
-	"k8s.io/kubernetes/pkg/util/iptables"
+	utiliptables "k8s.io/kubernetes/pkg/util/iptables"
 	nodeutil "k8s.io/kubernetes/pkg/util/node"
 	"k8s.io/kubernetes/pkg/util/oom"
 
@@ -46,16 +48,17 @@ import (
 
 // ProxyServer contains configures and runs a Kubernetes proxy server
 type ProxyServer struct {
-	BindAddress        net.IP
-	HealthzPort        int
-	HealthzBindAddress net.IP
-	OOMScoreAdj        int
-	ResourceContainer  string
-	Master             string
-	Kubeconfig         string
-	PortRange          util.PortRange
-	Recorder           record.EventRecorder
-	HostnameOverride   string
+	BindAddress         net.IP
+	HealthzPort         int
+	HealthzBindAddress  net.IP
+	OOMScoreAdj         int
+	ResourceContainer   string
+	Master              string
+	Kubeconfig          string
+	PortRange           util.PortRange
+	Recorder            record.EventRecorder
+	HostnameOverride    string
+	ForceUserspaceProxy bool
 	// Reference to this node.
 	nodeRef *api.ObjectReference
 }
@@ -82,6 +85,7 @@ func (s *ProxyServer) AddFlags(fs *pflag.FlagSet) {
 	fs.StringVar(&s.Kubeconfig, "kubeconfig", s.Kubeconfig, "Path to kubeconfig file with authorization information (the master location is set by the master flag).")
 	fs.Var(&s.PortRange, "proxy-port-range", "Range of host ports (beginPort-endPort, inclusive) that may be consumed in order to proxy service traffic. If unspecified (0-0) then ports will be randomly chosen.")
 	fs.StringVar(&s.HostnameOverride, "hostname-override", s.HostnameOverride, "If non-empty, will use this string as identification instead of the actual hostname.")
+	fs.BoolVar(&s.ForceUserspaceProxy, "legacy-userspace-proxy", true, "Use the legacy userspace proxy (instead of the pure iptables proxy).")
 }
 
 // Run runs the specified ProxyServer.  This should never exit.
@@ -137,20 +141,47 @@ func (s *ProxyServer) Run(_ []string) error {
 	serviceConfig := config.NewServiceConfig()
 	endpointsConfig := config.NewEndpointsConfig()
 
-	protocol := iptables.ProtocolIpv4
+	protocol := utiliptables.ProtocolIpv4
 	if s.BindAddress.To4() == nil {
-		protocol = iptables.ProtocolIpv6
+		protocol = utiliptables.ProtocolIpv6
 	}
-	loadBalancer := userspace.NewLoadBalancerRR()
-	proxier, err := userspace.NewProxier(loadBalancer, s.BindAddress, iptables.New(exec.New(), protocol), s.PortRange)
+
+	var proxier proxy.ProxyProvider
+	var endpointsHandler config.EndpointsConfigHandler
+
+	// guaranteed false on error, error only necessary for debugging
+	shouldUseIptables, err := iptables.ShouldUseIptablesProxier()
 	if err != nil {
-		glog.Fatalf("Unable to create proxer: %v", err)
+		glog.Errorf("Can't determine whether to use iptables or userspace, using userspace proxier: %v", err)
+	}
+	if !s.ForceUserspaceProxy && shouldUseIptables {
+		glog.V(2).Info("Using iptables Proxier.")
+
+		proxierIptables, err := iptables.NewProxier(utiliptables.New(exec.New(), protocol))
+		if err != nil {
+			glog.Fatalf("Unable to create proxier: %v", err)
+		}
+		proxier = proxierIptables
+		endpointsHandler = proxierIptables
+	} else {
+		glog.V(2).Info("Using userspace Proxier.")
+		// This is a proxy.LoadBalancer which NewProxier needs but has methods we don't need for
+		// our config.EndpointsConfigHandler.
+		loadBalancer := userspace.NewLoadBalancerRR()
+		// set EndpointsConfigHandler to our loadBalancer
+		endpointsHandler = loadBalancer
+
+		proxierUserspace, err := userspace.NewProxier(loadBalancer, s.BindAddress, utiliptables.New(exec.New(), protocol), s.PortRange)
+		if err != nil {
+			glog.Fatalf("Unable to create proxer: %v", err)
+		}
+		proxier = proxierUserspace
 	}
 
 	// Wire proxier to handle changes to services
 	serviceConfig.RegisterHandler(proxier)
-	// And wire loadBalancer to handle changes to endpoints to services
-	endpointsConfig.RegisterHandler(loadBalancer)
+	// And wire endpointsHandler to handle changes to endpoints to services
+	endpointsConfig.RegisterHandler(endpointsHandler)
 
 	// Note: RegisterHandler() calls need to happen before creation of Sources because sources
 	// only notify on changes, and the initial update (on process start) may be lost if no handlers

pkg/proxy/iptables/proxier_test.go

+/*
+Copyright 2015 The Kubernetes Authors All rights reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package iptables
+
+import (
+	utiliptables "k8s.io/kubernetes/pkg/util/iptables"
+	"testing"
+)
+
+func checkAllLines(t *testing.T, table utiliptables.Table, save []byte, expectedLines map[utiliptables.Chain]string) {
+	chainLines := getChainLines(table, save)
+	for chain, line := range chainLines {
+		if expected, exists := expectedLines[chain]; exists {
+			if expected != line {
+				t.Errorf("getChainLines expected chain line not present. For chain: %s Expected: %s Got: %s", chain, expected, line)
+			}
+		} else {
+			t.Errorf("getChainLines expected chain not present: %s", chain)
+		}
+	}
+}
+
+func TestgetChainLines(t *testing.T) {
+	iptables_save := `# Generated by iptables-save v1.4.7 on Wed Oct 29 14:56:01 2014
+	*nat
+	:PREROUTING ACCEPT [2136997:197881818]
+	:POSTROUTING ACCEPT [4284525:258542680]
+	:OUTPUT ACCEPT [5901660:357267963]
+	-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
+	COMMIT
+	# Completed on Wed Oct 29 14:56:01 2014`
+	expected := map[utiliptables.Chain]string{
+		utiliptables.ChainPrerouting:  ":PREROUTING ACCEPT [2136997:197881818]",
+		utiliptables.ChainPostrouting: ":POSTROUTING ACCEPT [4284525:258542680]",
+		utiliptables.ChainOutput:      ":OUTPUT ACCEPT [5901660:357267963]",
+	}
+	checkAllLines(t, utiliptables.TableNAT, []byte(iptables_save), expected)
+}
+
+func TestgetChainLinesMultipleTables(t *testing.T) {
+	iptables_save := `# Generated by iptables-save v1.4.21 on Fri Aug  7 14:47:37 2015
+	*nat
+	:PREROUTING ACCEPT [2:138]
+	:INPUT ACCEPT [0:0]
+	:OUTPUT ACCEPT [0:0]
+	:POSTROUTING ACCEPT [0:0]
+	:DOCKER - [0:0]
+	:KUBE-NODEPORT-CONTAINER - [0:0]
+	:KUBE-NODEPORT-HOST - [0:0]
+	:KUBE-PORTALS-CONTAINER - [0:0]
+	:KUBE-PORTALS-HOST - [0:0]
+	:KUBE-SVC-Dgkr8H9s4LQ2mn-Py5U - [0:0]
+	:KUBE-SVC-PknUqKuv-LNZiCKRqGm - [0:0]
+	:KUBE-SVC-RWEx6uDf8yWGww1OQ8E - [0:0]
+	:KUBE-SVC-UvIpe7oTYVlacW1-G4C - [0:0]
+	:KUBE-SVC-g_TrwxBdTXDbEtecmNo - [0:0]
+	:KUBE-SVC-gvTMDzeC8lcXUan15iP - [0:0]
+	-A PREROUTING -m comment --comment "handle ClusterIPs; NOTE: this must be before the NodePort rules" -j KUBE-PORTALS-CONTAINER
+	-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
+	-A PREROUTING -m addrtype --dst-type LOCAL -m comment --comment "handle service NodePorts; NOTE: this must be the last rule in the chain" -j KUBE-NODEPORT-CONTAINER
+	-A OUTPUT -m comment --comment "handle ClusterIPs; NOTE: this must be before the NodePort rules" -j KUBE-PORTALS-HOST
+	-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
+	-A OUTPUT -m addrtype --dst-type LOCAL -m comment --comment "handle service NodePorts; NOTE: this must be the last rule in the chain" -j KUBE-NODEPORT-HOST
+	-A POSTROUTING -s 10.246.1.0/24 ! -o cbr0 -j MASQUERADE
+	-A POSTROUTING -s 10.0.2.15/32 -d 10.0.2.15/32 -m comment --comment "handle pod connecting to self" -j MASQUERADE
+	-A KUBE-PORTALS-CONTAINER -d 10.247.0.1/32 -p tcp -m comment --comment "portal for default/kubernetes:" -m state --state NEW -m tcp --dport 443 -j KUBE-SVC-g_TrwxBdTXDbEtecmNo
+	-A KUBE-PORTALS-CONTAINER -d 10.247.0.10/32 -p udp -m comment --comment "portal for kube-system/kube-dns:dns" -m state --state NEW -m udp --dport 53 -j KUBE-SVC-gvTMDzeC8lcXUan15iP
+	-A KUBE-PORTALS-CONTAINER -d 10.247.0.10/32 -p tcp -m comment --comment "portal for kube-system/kube-dns:dns-tcp" -m state --state NEW -m tcp --dport 53 -j KUBE-SVC-PknUqKuv-LNZiCKRqGm
+	-A KUBE-PORTALS-HOST -d 10.247.0.1/32 -p tcp -m comment --comment "portal for default/kubernetes:" -m state --state NEW -m tcp --dport 443 -j KUBE-SVC-g_TrwxBdTXDbEtecmNo
+	-A KUBE-PORTALS-HOST -d 10.247.0.10/32 -p udp -m comment --comment "portal for kube-system/kube-dns:dns" -m state --state NEW -m udp --dport 53 -j KUBE-SVC-gvTMDzeC8lcXUan15iP
+	-A KUBE-PORTALS-HOST -d 10.247.0.10/32 -p tcp -m comment --comment "portal for kube-system/kube-dns:dns-tcp" -m state --state NEW -m tcp --dport 53 -j KUBE-SVC-PknUqKuv-LNZiCKRqGm
+	-A KUBE-SVC-Dgkr8H9s4LQ2mn-Py5U -p udp -m comment --comment "kube-system/kube-dns:dns" -m recent --set --name KUBE-SVC-Dgkr8H9s4LQ2mn-Py5U --mask 255.255.255.255 --rsource -j DNAT --to-destination 10.246.1.2:53
+	-A KUBE-SVC-PknUqKuv-LNZiCKRqGm -m comment --comment "kube-system/kube-dns:dns-tcp" -j KUBE-SVC-RWEx6uDf8yWGww1OQ8E
+	-A KUBE-SVC-RWEx6uDf8yWGww1OQ8E -p tcp -m comment --comment "kube-system/kube-dns:dns-tcp" -m recent --set --name KUBE-SVC-RWEx6uDf8yWGww1OQ8E --mask 255.255.255.255 --rsource -j DNAT --to-destination 10.246.1.2:53
+	-A KUBE-SVC-UvIpe7oTYVlacW1-G4C -p tcp -m comment --comment "default/kubernetes:" -m recent --set --name KUBE-SVC-UvIpe7oTYVlacW1-G4C --mask 255.255.255.255 --rsource -j DNAT --to-destination 10.245.1.2:443
+	-A KUBE-SVC-g_TrwxBdTXDbEtecmNo -m comment --comment "default/kubernetes:" -j KUBE-SVC-UvIpe7oTYVlacW1-G4C
+	-A KUBE-SVC-gvTMDzeC8lcXUan15iP -m comment --comment "kube-system/kube-dns:dns" -j KUBE-SVC-Dgkr8H9s4LQ2mn-Py5U
+	COMMIT
+	# Completed on Fri Aug  7 14:47:37 2015
+	# Generated by iptables-save v1.4.21 on Fri Aug  7 14:47:37 2015
+	*filter
+	:INPUT ACCEPT [17514:83115836]
+	:FORWARD ACCEPT [0:0]
+	:OUTPUT ACCEPT [8909:688225]
+	:DOCKER - [0:0]
+	-A FORWARD -o cbr0 -j DOCKER
+	-A FORWARD -o cbr0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+	-A FORWARD -i cbr0 ! -o cbr0 -j ACCEPT
+	-A FORWARD -i cbr0 -o cbr0 -j ACCEPT
+	COMMIT
+	`
+	expected := map[utiliptables.Chain]string{
+		utiliptables.ChainPrerouting:                       ":PREROUTING ACCEPT [2:138]",
+		utiliptables.Chain("INPUT"):                        ":INPUT ACCEPT [0:0]",
+		utiliptables.Chain("OUTPUT"):                       ":OUTPUT ACCEPT [0:0]",
+		utiliptables.ChainPostrouting:                      ":POSTROUTING ACCEPT [0:0]",
+		utiliptables.Chain("DOCKER"):                       ":DOCKER - [0:0]",
+		utiliptables.Chain("KUBE-NODEPORT-CONTAINER"):      ":KUBE-NODEPORT-CONTAINER - [0:0]",
+		utiliptables.Chain("KUBE-NODEPORT-HOST"):           ":KUBE-NODEPORT-HOST - [0:0]",
+		utiliptables.Chain("KUBE-PORTALS-CONTAINER"):       ":KUBE-PORTALS-CONTAINER - [0:0]",
+		utiliptables.Chain("KUBE-PORTALS-HOST"):            ":KUBE-PORTALS-HOST - [0:0]",
+		utiliptables.Chain("KUBE-SVC-Dgkr8H9s4LQ2mn-Py5U"): ":KUBE-SVC-Dgkr8H9s4LQ2mn-Py5U - [0:0]",
+		utiliptables.Chain("KUBE-SVC-PknUqKuv-LNZiCKRqGm"): ":KUBE-SVC-PknUqKuv-LNZiCKRqGm - [0:0]",
+		utiliptables.Chain("KUBE-SVC-RWEx6uDf8yWGww1OQ8E"): ":KUBE-SVC-RWEx6uDf8yWGww1OQ8E - [0:0]",
+		utiliptables.Chain("KUBE-SVC-UvIpe7oTYVlacW1-G4C"): ":KUBE-SVC-UvIpe7oTYVlacW1-G4C - [0:0]",
+		utiliptables.Chain("KUBE-SVC-g_TrwxBdTXDbEtecmNo"): ":KUBE-SVC-g_TrwxBdTXDbEtecmNo - [0:0]",
+		utiliptables.Chain("KUBE-SVC-gvTMDzeC8lcXUan15iP"): ":KUBE-SVC-gvTMDzeC8lcXUan15iP - [0:0]",
+	}
+	checkAllLines(t, utiliptables.TableNAT, []byte(iptables_save), expected)
+}

pkg/util/iptables/iptables.go

@@ -399,7 +399,7 @@ func makeFullArgs(table Table, chain Chain, args ...string) []string {
 
 // Checks if iptables has the "-C" flag
 func getIptablesHasCheckCommand(exec utilexec.Interface) (bool, error) {
-	vstring, err := getIptablesVersionString(exec)
+	vstring, err := GetIptablesVersionString(exec)
 	if err != nil {
 		return false, err
 	}
@@ -412,7 +412,7 @@ func getIptablesHasCheckCommand(exec utilexec.Interface) (bool, error) {
 	return iptablesHasCheckCommand(v1, v2, v3), nil
 }
 
-// getIptablesVersion returns the first three components of the iptables version.
+// extractIptablesVersion returns the first three components of the iptables version.
 // e.g. "iptables v1.3.66" would return (1, 3, 66, nil)
 func extractIptablesVersion(str string) (int, int, int, error) {
 	versionMatcher := regexp.MustCompile("v([0-9]+)\\.([0-9]+)\\.([0-9]+)")
@@ -439,24 +439,21 @@ func extractIptablesVersion(str string) (int, int, int, error) {
 	return v1, v2, v3, nil
 }
 
-// Runs "iptables --version" to get the version string
-func getIptablesVersionString(exec utilexec.Interface) (string, error) {
+// GetIptablesVersionString runs "iptables --version" to get the version string,
+// then matches for vX.X.X e.g. if "iptables --version" outputs: "iptables v1.3.66"
+// then it would would return "v1.3.66", nil
+func GetIptablesVersionString(exec utilexec.Interface) (string, error) {
 	// this doesn't access mutable state so we don't need to use the interface / runner
 	bytes, err := exec.Command(cmdIptables, "--version").CombinedOutput()
 	if err != nil {
 		return "", err
 	}
-	return string(bytes), nil
-}
-
-// GetIptablesVersion returns the major minor and patch version of iptables
-// which will all be zero in case of error, and any error encountered.
-func GetIptablesVersion(exec utilexec.Interface) (int, int, int, error) {
-	s, err := getIptablesVersionString(exec)
-	if err != nil {
-		return 0, 0, 0, err
+	versionMatcher := regexp.MustCompile("v[0-9]+\\.[0-9]+\\.[0-9]+")
+	match := versionMatcher.FindStringSubmatch(string(bytes))
+	if match == nil {
+		return "", fmt.Errorf("no iptables version found in string: %s", bytes)
 	}
-	return extractIptablesVersion(s)
+	return match[0], nil
 }
 
 // Checks if an iptables version is after 1.4.11, when --check was added

test/e2e/service.go

@@ -309,10 +309,10 @@ var _ = Describe("Services", func() {
 		}
 		expectNoError(verifyServeHostnameServiceUp(c, host, podNames1, svc1IP, servicePort))
 		expectNoError(verifyServeHostnameServiceUp(c, host, podNames2, svc2IP, servicePort))
-
 		// Remove iptable rules and make sure they come back.
 		By("Remove iptable rules and make sure they come back")
 		_, _, code, err := SSH(`
+			sudo iptables -t nat -F KUBE-SERVICES || true;
 			sudo iptables -t nat -F KUBE-PORTALS-HOST || true;
 			sudo iptables -t nat -F KUBE-PORTALS-CONTAINER || true`, host, testContext.Provider)
 		if err != nil || code != 0 {