Skip to content

K
k3s
Commit e045c6ce authored by Tim Hockin's avatar Tim Hockin
Browse files
Options

Split portals into host and container

After this DNS is resolvable from the host, if the DNS server is targetted explicitly. This does NOT add the cluster DNS to the host's resolv.conf. That is a larger problem, with distro-specific tie-ins and circular deps.
parent 59164ca8
Expand all Hide whitespace changes
Inline Side-by-side
Showing with 69 additions and 12 deletions
hack/e2e-suite/services.sh
View file @ e045c6ce
......@@ -378,7 +378,8 @@ verify_from_container "${svc3_name}" "${svc3_ip}" "${svc3_port}" \
#
echo "Test 5: Remove the iptables rules, make sure they come back."
echo "Manually removing iptables rules"
ssh-to-node "${test_node}" "sudo iptables -t nat -F KUBE-PROXY"
ssh-to-node "${test_node}" "sudo iptables -t nat -F KUBE-PORTALS-HOST"
ssh-to-node "${test_node}" "sudo iptables -t nat -F KUBE-PORTALS-CONTAINER"
echo "Verifying the portals from the host"
wait_for_service_up "${svc3_name}" "${svc3_ip}" "${svc3_port}" \
"${svc3_count}" "${svc3_pods}"
......
pkg/proxy/proxier_test.go
View file @ e045c6ce
......@@ -82,6 +82,10 @@ func (fake *fakeIptables) EnsureChain(table iptables.Table, chain iptables.Chain
return false, nil
}
func (fake *fakeIptables) DeleteChain(table iptables.Table, chain iptables.Chain) error {
return nil
}
func (fake *fakeIptables) FlushChain(table iptables.Table, chain iptables.Chain) error {
return nil
}
......@@ -176,7 +180,7 @@ func TestTCPProxy(t *testing.T) {
},
})
p := NewProxier(lb, net.ParseIP("127.0.0.1"), &fakeIptables{})
p := NewProxier(lb, net.ParseIP("0.0.0.0"), &fakeIptables{})
svcInfo, err := p.addServiceOnPort("echo", "TCP", 0, time.Second)
if err != nil {
......@@ -194,7 +198,7 @@ func TestUDPProxy(t *testing.T) {
},
})
p := NewProxier(lb, net.ParseIP("127.0.0.1"), &fakeIptables{})
p := NewProxier(lb, net.ParseIP("0.0.0.0"), &fakeIptables{})
svcInfo, err := p.addServiceOnPort("echo", "UDP", 0, time.Second)
if err != nil {
......@@ -221,7 +225,7 @@ func TestTCPProxyStop(t *testing.T) {
},
})
p := NewProxier(lb, net.ParseIP("127.0.0.1"), &fakeIptables{})
p := NewProxier(lb, net.ParseIP("0.0.0.0"), &fakeIptables{})
svcInfo, err := p.addServiceOnPort("echo", "TCP", 0, time.Second)
if err != nil {
......@@ -249,7 +253,7 @@ func TestUDPProxyStop(t *testing.T) {
},
})
p := NewProxier(lb, net.ParseIP("127.0.0.1"), &fakeIptables{})
p := NewProxier(lb, net.ParseIP("0.0.0.0"), &fakeIptables{})
svcInfo, err := p.addServiceOnPort("echo", "UDP", 0, time.Second)
if err != nil {
......@@ -277,7 +281,7 @@ func TestTCPProxyUpdateDelete(t *testing.T) {
},
})
p := NewProxier(lb, net.ParseIP("127.0.0.1"), &fakeIptables{})
p := NewProxier(lb, net.ParseIP("0.0.0.0"), &fakeIptables{})
svcInfo, err := p.addServiceOnPort("echo", "TCP", 0, time.Second)
if err != nil {
......@@ -304,7 +308,7 @@ func TestUDPProxyUpdateDelete(t *testing.T) {
},
})
p := NewProxier(lb, net.ParseIP("127.0.0.1"), &fakeIptables{})
p := NewProxier(lb, net.ParseIP("0.0.0.0"), &fakeIptables{})
svcInfo, err := p.addServiceOnPort("echo", "UDP", 0, time.Second)
if err != nil {
......@@ -331,7 +335,7 @@ func TestTCPProxyUpdateDeleteUpdate(t *testing.T) {
},
})
p := NewProxier(lb, net.ParseIP("127.0.0.1"), &fakeIptables{})
p := NewProxier(lb, net.ParseIP("0.0.0.0"), &fakeIptables{})
svcInfo, err := p.addServiceOnPort("echo", "TCP", 0, time.Second)
if err != nil {
......@@ -362,7 +366,7 @@ func TestUDPProxyUpdateDeleteUpdate(t *testing.T) {
},
})
p := NewProxier(lb, net.ParseIP("127.0.0.1"), &fakeIptables{})
p := NewProxier(lb, net.ParseIP("0.0.0.0"), &fakeIptables{})
svcInfo, err := p.addServiceOnPort("echo", "UDP", 0, time.Second)
if err != nil {
......@@ -393,7 +397,7 @@ func TestTCPProxyUpdatePort(t *testing.T) {
},
})
p := NewProxier(lb, net.ParseIP("127.0.0.1"), &fakeIptables{})
p := NewProxier(lb, net.ParseIP("0.0.0.0"), &fakeIptables{})
svcInfo, err := p.addServiceOnPort("echo", "TCP", 0, time.Second)
if err != nil {
......@@ -438,7 +442,7 @@ func TestUDPProxyUpdatePort(t *testing.T) {
},
})
p := NewProxier(lb, net.ParseIP("127.0.0.1"), &fakeIptables{})
p := NewProxier(lb, net.ParseIP("0.0.0.0"), &fakeIptables{})
svcInfo, err := p.addServiceOnPort("echo", "UDP", 0, time.Second)
if err != nil {
......
pkg/util/iptables/iptables.go
View file @ e045c6ce
......@@ -32,8 +32,10 @@ import (
type Interface interface {
// EnsureChain checks if the specified chain exists and, if not, creates it. If the chain existed, return true.
EnsureChain(table Table, chain Chain) (bool, error)
// FlushChain clears the specified chain.
// FlushChain clears the specified chain. If the chain did not exist, return error.
FlushChain(table Table, chain Chain) error
// DeleteChain deletes the specified chain. If the chain did not exist, return error.
DeleteChain(table Table, chain Chain) error
// EnsureRule checks if the specified rule is present and, if not, creates it. If the rule existed, return true.
EnsureRule(table Table, chain Chain, args ...string) (bool, error)
// DeleteRule checks if the specified rule is present and, if so, deletes it.
......@@ -108,6 +110,21 @@ func (runner *runner) FlushChain(table Table, chain Chain) error {
return nil
}
// DeleteChain is part of Interface.
func (runner *runner) DeleteChain(table Table, chain Chain) error {
fullArgs := makeFullArgs(table, chain)
runner.mu.Lock()
defer runner.mu.Unlock()
// TODO: we could call iptable -S first, ignore the output and check for non-zero return (more like DeleteRule)
out, err := runner.run(opDeleteChain, fullArgs)
if err != nil {
return fmt.Errorf("error deleting chain %q: %v: %s", chain, err, out)
}
return nil
}
// EnsureRule is part of Interface.
func (runner *runner) EnsureRule(table Table, chain Chain, args ...string) (bool, error) {
fullArgs := makeFullArgs(table, chain, args...)
......@@ -257,6 +274,7 @@ type operation string
const (
opCreateChain operation = "-N"
opFlushChain operation = "-F"
opDeleteChain operation = "-X"
opAppendRule operation = "-A"
opCheckRule operation = "-C"
opDeleteRule operation = "-D"
......
pkg/util/iptables/iptables_test.go
View file @ e045c6ce
......@@ -124,6 +124,40 @@ func TestFlushChain(t *testing.T) {
}
}
func TestDeleteChain(t *testing.T) {
fcmd := exec.FakeCmd{
CombinedOutputScript: []exec.FakeCombinedOutputAction{
// Success.
func() ([]byte, error) { return []byte{}, nil },
// Failure.
func() ([]byte, error) { return nil, &exec.FakeExitError{1} },
},
}
fexec := exec.FakeExec{
CommandScript: []exec.FakeCommandAction{
func(cmd string, args ...string) exec.Cmd { return exec.InitFakeCmd(&fcmd, cmd, args...) },
func(cmd string, args ...string) exec.Cmd { return exec.InitFakeCmd(&fcmd, cmd, args...) },
},
}
runner := New(&fexec, ProtocolIpv4)
// Success.
err := runner.DeleteChain(TableNAT, Chain("FOOBAR"))
if err != nil {
t.Errorf("expected success, got %v", err)
}
if fcmd.CombinedOutputCalls != 1 {
t.Errorf("expected 1 CombinedOutput() call, got %d", fcmd.CombinedOutputCalls)
}
if !util.NewStringSet(fcmd.CombinedOutputLog[0]...).HasAll("iptables", "-t", "nat", "-X", "FOOBAR") {
t.Errorf("wrong CombinedOutput() log, got %s", fcmd.CombinedOutputLog[0])
}
// Failure.
err = runner.DeleteChain(TableNAT, Chain("FOOBAR"))
if err == nil {
t.Errorf("expected failure")
}
}
func TestEnsureRuleAlreadyExists(t *testing.T) {
fcmd := exec.FakeCmd{
CombinedOutputScript: []exec.FakeCombinedOutputAction{
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment