Skip to content

K
k3s
Commit e045c6ce authored by Tim Hockin's avatar Tim Hockin
Browse files
Options

Split portals into host and container

After this DNS is resolvable from the host, if the DNS server is targetted explicitly. This does NOT add the cluster DNS to the host's resolv.conf. That is a larger problem, with distro-specific tie-ins and circular deps.
parent 59164ca8
Expand all Hide whitespace changes
Inline Side-by-side
Showing with 69 additions and 12 deletions
hack/e2e-suite/services.sh
View file @ e045c6ce
...@@ -378,7 +378,8 @@ verify_from_container "${svc3_name}" "${svc3_ip}" "${svc3_port}" \ ...@@ -378,7 +378,8 @@ verify_from_container "${svc3_name}" "${svc3_ip}" "${svc3_port}" \
# #
echo "Test 5: Remove the iptables rules, make sure they come back." echo "Test 5: Remove the iptables rules, make sure they come back."
echo "Manually removing iptables rules" echo "Manually removing iptables rules"
ssh-to-node "${test_node}" "sudo iptables -t nat -F KUBE-PROXY" ssh-to-node "${test_node}" "sudo iptables -t nat -F KUBE-PORTALS-HOST"
ssh-to-node "${test_node}" "sudo iptables -t nat -F KUBE-PORTALS-CONTAINER"
echo "Verifying the portals from the host" echo "Verifying the portals from the host"
wait_for_service_up "${svc3_name}" "${svc3_ip}" "${svc3_port}" \ wait_for_service_up "${svc3_name}" "${svc3_ip}" "${svc3_port}" \
"${svc3_count}" "${svc3_pods}" "${svc3_count}" "${svc3_pods}"
......
pkg/proxy/proxier_test.go
View file @ e045c6ce
...@@ -82,6 +82,10 @@ func (fake *fakeIptables) EnsureChain(table iptables.Table, chain iptables.Chain ...@@ -82,6 +82,10 @@ func (fake *fakeIptables) EnsureChain(table iptables.Table, chain iptables.Chain
return false, nil return false, nil
} }
func (fake *fakeIptables) DeleteChain(table iptables.Table, chain iptables.Chain) error {
return nil
}
func (fake *fakeIptables) FlushChain(table iptables.Table, chain iptables.Chain) error { func (fake *fakeIptables) FlushChain(table iptables.Table, chain iptables.Chain) error {
return nil return nil
} }
...@@ -176,7 +180,7 @@ func TestTCPProxy(t *testing.T) { ...@@ -176,7 +180,7 @@ func TestTCPProxy(t *testing.T) {
}, },
}) })
p := NewProxier(lb, net.ParseIP("127.0.0.1"), &fakeIptables{}) p := NewProxier(lb, net.ParseIP("0.0.0.0"), &fakeIptables{})
svcInfo, err := p.addServiceOnPort("echo", "TCP", 0, time.Second) svcInfo, err := p.addServiceOnPort("echo", "TCP", 0, time.Second)
if err != nil { if err != nil {
...@@ -194,7 +198,7 @@ func TestUDPProxy(t *testing.T) { ...@@ -194,7 +198,7 @@ func TestUDPProxy(t *testing.T) {
}, },
}) })
p := NewProxier(lb, net.ParseIP("127.0.0.1"), &fakeIptables{}) p := NewProxier(lb, net.ParseIP("0.0.0.0"), &fakeIptables{})
svcInfo, err := p.addServiceOnPort("echo", "UDP", 0, time.Second) svcInfo, err := p.addServiceOnPort("echo", "UDP", 0, time.Second)
if err != nil { if err != nil {
...@@ -221,7 +225,7 @@ func TestTCPProxyStop(t *testing.T) { ...@@ -221,7 +225,7 @@ func TestTCPProxyStop(t *testing.T) {
}, },
}) })
p := NewProxier(lb, net.ParseIP("127.0.0.1"), &fakeIptables{}) p := NewProxier(lb, net.ParseIP("0.0.0.0"), &fakeIptables{})
svcInfo, err := p.addServiceOnPort("echo", "TCP", 0, time.Second) svcInfo, err := p.addServiceOnPort("echo", "TCP", 0, time.Second)
if err != nil { if err != nil {
...@@ -249,7 +253,7 @@ func TestUDPProxyStop(t *testing.T) { ...@@ -249,7 +253,7 @@ func TestUDPProxyStop(t *testing.T) {
}, },
}) })
p := NewProxier(lb, net.ParseIP("127.0.0.1"), &fakeIptables{}) p := NewProxier(lb, net.ParseIP("0.0.0.0"), &fakeIptables{})
svcInfo, err := p.addServiceOnPort("echo", "UDP", 0, time.Second) svcInfo, err := p.addServiceOnPort("echo", "UDP", 0, time.Second)
if err != nil { if err != nil {
...@@ -277,7 +281,7 @@ func TestTCPProxyUpdateDelete(t *testing.T) { ...@@ -277,7 +281,7 @@ func TestTCPProxyUpdateDelete(t *testing.T) {
}, },
}) })
p := NewProxier(lb, net.ParseIP("127.0.0.1"), &fakeIptables{}) p := NewProxier(lb, net.ParseIP("0.0.0.0"), &fakeIptables{})
svcInfo, err := p.addServiceOnPort("echo", "TCP", 0, time.Second) svcInfo, err := p.addServiceOnPort("echo", "TCP", 0, time.Second)
if err != nil { if err != nil {
...@@ -304,7 +308,7 @@ func TestUDPProxyUpdateDelete(t *testing.T) { ...@@ -304,7 +308,7 @@ func TestUDPProxyUpdateDelete(t *testing.T) {
}, },
}) })
p := NewProxier(lb, net.ParseIP("127.0.0.1"), &fakeIptables{}) p := NewProxier(lb, net.ParseIP("0.0.0.0"), &fakeIptables{})
svcInfo, err := p.addServiceOnPort("echo", "UDP", 0, time.Second) svcInfo, err := p.addServiceOnPort("echo", "UDP", 0, time.Second)
if err != nil { if err != nil {
...@@ -331,7 +335,7 @@ func TestTCPProxyUpdateDeleteUpdate(t *testing.T) { ...@@ -331,7 +335,7 @@ func TestTCPProxyUpdateDeleteUpdate(t *testing.T) {
}, },
}) })
p := NewProxier(lb, net.ParseIP("127.0.0.1"), &fakeIptables{}) p := NewProxier(lb, net.ParseIP("0.0.0.0"), &fakeIptables{})
svcInfo, err := p.addServiceOnPort("echo", "TCP", 0, time.Second) svcInfo, err := p.addServiceOnPort("echo", "TCP", 0, time.Second)
if err != nil { if err != nil {
...@@ -362,7 +366,7 @@ func TestUDPProxyUpdateDeleteUpdate(t *testing.T) { ...@@ -362,7 +366,7 @@ func TestUDPProxyUpdateDeleteUpdate(t *testing.T) {
}, },
}) })
p := NewProxier(lb, net.ParseIP("127.0.0.1"), &fakeIptables{}) p := NewProxier(lb, net.ParseIP("0.0.0.0"), &fakeIptables{})
svcInfo, err := p.addServiceOnPort("echo", "UDP", 0, time.Second) svcInfo, err := p.addServiceOnPort("echo", "UDP", 0, time.Second)
if err != nil { if err != nil {
...@@ -393,7 +397,7 @@ func TestTCPProxyUpdatePort(t *testing.T) { ...@@ -393,7 +397,7 @@ func TestTCPProxyUpdatePort(t *testing.T) {
}, },
}) })
p := NewProxier(lb, net.ParseIP("127.0.0.1"), &fakeIptables{}) p := NewProxier(lb, net.ParseIP("0.0.0.0"), &fakeIptables{})
svcInfo, err := p.addServiceOnPort("echo", "TCP", 0, time.Second) svcInfo, err := p.addServiceOnPort("echo", "TCP", 0, time.Second)
if err != nil { if err != nil {
...@@ -438,7 +442,7 @@ func TestUDPProxyUpdatePort(t *testing.T) { ...@@ -438,7 +442,7 @@ func TestUDPProxyUpdatePort(t *testing.T) {
}, },
}) })
p := NewProxier(lb, net.ParseIP("127.0.0.1"), &fakeIptables{}) p := NewProxier(lb, net.ParseIP("0.0.0.0"), &fakeIptables{})
svcInfo, err := p.addServiceOnPort("echo", "UDP", 0, time.Second) svcInfo, err := p.addServiceOnPort("echo", "UDP", 0, time.Second)
if err != nil { if err != nil {
......
pkg/util/iptables/iptables.go
View file @ e045c6ce
...@@ -32,8 +32,10 @@ import ( ...@@ -32,8 +32,10 @@ import (
type Interface interface { type Interface interface {
// EnsureChain checks if the specified chain exists and, if not, creates it. If the chain existed, return true. // EnsureChain checks if the specified chain exists and, if not, creates it. If the chain existed, return true.
EnsureChain(table Table, chain Chain) (bool, error) EnsureChain(table Table, chain Chain) (bool, error)
// FlushChain clears the specified chain. // FlushChain clears the specified chain. If the chain did not exist, return error.
FlushChain(table Table, chain Chain) error FlushChain(table Table, chain Chain) error
// DeleteChain deletes the specified chain. If the chain did not exist, return error.
DeleteChain(table Table, chain Chain) error
// EnsureRule checks if the specified rule is present and, if not, creates it. If the rule existed, return true. // EnsureRule checks if the specified rule is present and, if not, creates it. If the rule existed, return true.
EnsureRule(table Table, chain Chain, args ...string) (bool, error) EnsureRule(table Table, chain Chain, args ...string) (bool, error)
// DeleteRule checks if the specified rule is present and, if so, deletes it. // DeleteRule checks if the specified rule is present and, if so, deletes it.
...@@ -108,6 +110,21 @@ func (runner *runner) FlushChain(table Table, chain Chain) error { ...@@ -108,6 +110,21 @@ func (runner *runner) FlushChain(table Table, chain Chain) error {
return nil return nil
} }
// DeleteChain is part of Interface.
func (runner *runner) DeleteChain(table Table, chain Chain) error {
fullArgs := makeFullArgs(table, chain)
runner.mu.Lock()
defer runner.mu.Unlock()
// TODO: we could call iptable -S first, ignore the output and check for non-zero return (more like DeleteRule)
out, err := runner.run(opDeleteChain, fullArgs)
if err != nil {
return fmt.Errorf("error deleting chain %q: %v: %s", chain, err, out)
}
return nil
}
// EnsureRule is part of Interface. // EnsureRule is part of Interface.
func (runner *runner) EnsureRule(table Table, chain Chain, args ...string) (bool, error) { func (runner *runner) EnsureRule(table Table, chain Chain, args ...string) (bool, error) {
fullArgs := makeFullArgs(table, chain, args...) fullArgs := makeFullArgs(table, chain, args...)
...@@ -257,6 +274,7 @@ type operation string ...@@ -257,6 +274,7 @@ type operation string
const ( const (
opCreateChain operation = "-N" opCreateChain operation = "-N"
opFlushChain operation = "-F" opFlushChain operation = "-F"
opDeleteChain operation = "-X"
opAppendRule operation = "-A" opAppendRule operation = "-A"
opCheckRule operation = "-C" opCheckRule operation = "-C"
opDeleteRule operation = "-D" opDeleteRule operation = "-D"
......
pkg/util/iptables/iptables_test.go
View file @ e045c6ce
...@@ -124,6 +124,40 @@ func TestFlushChain(t *testing.T) { ...@@ -124,6 +124,40 @@ func TestFlushChain(t *testing.T) {
} }
} }
func TestDeleteChain(t *testing.T) {
fcmd := exec.FakeCmd{
CombinedOutputScript: []exec.FakeCombinedOutputAction{
// Success.
func() ([]byte, error) { return []byte{}, nil },
// Failure.
func() ([]byte, error) { return nil, &exec.FakeExitError{1} },
},
}
fexec := exec.FakeExec{
CommandScript: []exec.FakeCommandAction{
func(cmd string, args ...string) exec.Cmd { return exec.InitFakeCmd(&fcmd, cmd, args...) },
func(cmd string, args ...string) exec.Cmd { return exec.InitFakeCmd(&fcmd, cmd, args...) },
},
}
runner := New(&fexec, ProtocolIpv4)
// Success.
err := runner.DeleteChain(TableNAT, Chain("FOOBAR"))
if err != nil {
t.Errorf("expected success, got %v", err)
}
if fcmd.CombinedOutputCalls != 1 {
t.Errorf("expected 1 CombinedOutput() call, got %d", fcmd.CombinedOutputCalls)
}
if !util.NewStringSet(fcmd.CombinedOutputLog[0]...).HasAll("iptables", "-t", "nat", "-X", "FOOBAR") {
t.Errorf("wrong CombinedOutput() log, got %s", fcmd.CombinedOutputLog[0])
}
// Failure.
err = runner.DeleteChain(TableNAT, Chain("FOOBAR"))
if err == nil {
t.Errorf("expected failure")
}
}
func TestEnsureRuleAlreadyExists(t *testing.T) { func TestEnsureRuleAlreadyExists(t *testing.T) {
fcmd := exec.FakeCmd{ fcmd := exec.FakeCmd{
CombinedOutputScript: []exec.FakeCombinedOutputAction{ CombinedOutputScript: []exec.FakeCombinedOutputAction{
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment