Skip to content

K
k3s
Commit d7e5a8b6 authored by Kubernetes Submit Queue's avatar Kubernetes Submit Queue Committed by GitHub
Browse files
Options

Merge pull request #47626 from Q-Lee/metadata-fix

Automatic merge from submit-queue (batch tested with PRs 47626, 47674, 47683, 47290, 47688) The KUBE-METADATA-SERVER firewall must be applied before the universa… …l tcp ACCEPT **What this PR does / why we need it**: the metadata firewall rule was broken by being appended after the universal tcp accept. **Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes # **Special notes for your reviewer**: **Release note**: ```release-note ```
parents d8da42da b886897f
Hide whitespace changes
Inline Side-by-side
Showing with 2 additions and 2 deletions
cluster/gce/configure-vm.sh
View file @ d7e5a8b6
...@@ -91,7 +91,7 @@ function config-ip-firewall { ...@@ -91,7 +91,7 @@ function config-ip-firewall {
echo "Configuring IP firewall rules" echo "Configuring IP firewall rules"
iptables -N KUBE-METADATA-SERVER iptables -N KUBE-METADATA-SERVER
iptables -A FORWARD -p tcp -d 169.254.169.254 --dport 80 -j KUBE-METADATA-SERVER iptables -I FORWARD -p tcp -d 169.254.169.254 --dport 80 -j KUBE-METADATA-SERVER
if [[ -n "${KUBE_FIREWALL_METADATA_SERVER:-}" ]]; then if [[ -n "${KUBE_FIREWALL_METADATA_SERVER:-}" ]]; then
iptables -A KUBE-METADATA-SERVER -j DROP iptables -A KUBE-METADATA-SERVER -j DROP
......
cluster/gce/gci/configure-helper.sh
View file @ d7e5a8b6
...@@ -103,7 +103,7 @@ function config-ip-firewall { ...@@ -103,7 +103,7 @@ function config-ip-firewall {
fi fi
iptables -N KUBE-METADATA-SERVER iptables -N KUBE-METADATA-SERVER
iptables -A FORWARD -p tcp -d 169.254.169.254 --dport 80 -j KUBE-METADATA-SERVER iptables -I FORWARD -p tcp -d 169.254.169.254 --dport 80 -j KUBE-METADATA-SERVER
if [[ -n "${KUBE_FIREWALL_METADATA_SERVER:-}" ]]; then if [[ -n "${KUBE_FIREWALL_METADATA_SERVER:-}" ]]; then
iptables -A KUBE-METADATA-SERVER -j DROP iptables -A KUBE-METADATA-SERVER -j DROP
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment