Merge pull request #43972 from thockin/fix-43969-proxy-filter-input

Automatic merge from submit-queue kube-proxy: filter INPUT as well as OUTPUT We need to apply filter rules on the way in (nodeports) and out (cluster IPs). Testing here is insufficient to have caught this - will come back for that. Fixes #43969 @justinsb since you have the best repro, can you test? It passes what I think is repro. @ethernetdan we will want this in 1.6.x ```release-note Fix bug with service nodeports that have no backends not being rejected, when they should be. This is not a regression vs v1.5 - it's a fix that didn't quite fix hard enough. ```

Merge pull request #43972 from thockin/fix-43969-proxy-filter-input
bc8a7556 · Kubernetes Submit Queue · GitHub · 422497b4 · 9a423b6c · bc8a7556
Commit bc8a7556 authored Apr 05, 2017 by Kubernetes Submit Queue Committed by GitHub Apr 05, 2017
Hide whitespace changes
Inline Side-by-side

Showing with 2 additions and 0 deletions

proxier.go pkg/proxy/iptables/proxier.go +2 -0

No files found.
--- a/pkg/proxy/iptables/proxier.go
+++ b/pkg/proxy/iptables/proxier.go
@@ -358,6 +358,7 @@ func CleanupLeftovers(ipt utiliptables.Interface) (encounteredError bool) {
 		table utiliptables.Table
 		chain utiliptables.Chain
 	}{
+		{utiliptables.TableFilter, utiliptables.ChainInput},
 		{utiliptables.TableFilter, utiliptables.ChainOutput},
 		{utiliptables.TableNAT, utiliptables.ChainOutput},
 		{utiliptables.TableNAT, utiliptables.ChainPrerouting},
@@ -795,6 +796,7 @@ func (proxier *Proxier) syncProxyRules(reason syncReason) {
 			table utiliptables.Table
 			chain utiliptables.Chain
 		}{
+			{utiliptables.TableFilter, utiliptables.ChainInput},
 			{utiliptables.TableFilter, utiliptables.ChainOutput},
 			{utiliptables.TableNAT, utiliptables.ChainOutput},
 			{utiliptables.TableNAT, utiliptables.ChainPrerouting},