Skip to content

K
k3s
Commit e43f6057 authored by Kubernetes Submit Queue's avatar Kubernetes Submit Queue Committed by GitHub
Browse files
Options

Merge pull request #32413 from freehan/hostportfix

Automatic merge from submit-queue Fix a bug in kubelet hostport logic which flushes KUBE-MARK-MASQ iptables chain Fixes #32415
parents f5077ff8 118ebd57
Hide whitespace changes
Inline Side-by-side
Showing with 1 addition and 8 deletions
pkg/kubelet/network/hostport/hostport.go
View file @ e43f6057
...@@ -251,14 +251,6 @@ func (h *handler) SyncHostports(natInterfaceName string, runningPods []*RunningP ...@@ -251,14 +251,6 @@ func (h *handler) SyncHostports(natInterfaceName string, runningPods []*RunningP
} else { } else {
writeLine(natChains, utiliptables.MakeChainLine(kubeHostportsChain)) writeLine(natChains, utiliptables.MakeChainLine(kubeHostportsChain))
} }
// Assuming the node is running kube-proxy in iptables mode
// Reusing kube-proxy's KubeMarkMasqChain for SNAT
// TODO: let kubelet manage KubeMarkMasqChain. Other components should just be able to use it
if chain, ok := existingNATChains[iptablesproxy.KubeMarkMasqChain]; ok {
writeLine(natChains, chain)
} else {
writeLine(natChains, utiliptables.MakeChainLine(iptablesproxy.KubeMarkMasqChain))
}
// Accumulate NAT chains to keep. // Accumulate NAT chains to keep.
activeNATChains := map[utiliptables.Chain]bool{} // use a map as a set activeNATChains := map[utiliptables.Chain]bool{} // use a map as a set
...@@ -284,6 +276,7 @@ func (h *handler) SyncHostports(natInterfaceName string, runningPods []*RunningP ...@@ -284,6 +276,7 @@ func (h *handler) SyncHostports(natInterfaceName string, runningPods []*RunningP
} }
writeLine(natRules, args...) writeLine(natRules, args...)
// Assuming kubelet is syncing iptables KUBE-MARK-MASQ chain
// If the request comes from the pod that is serving the hostport, then SNAT // If the request comes from the pod that is serving the hostport, then SNAT
args = []string{ args = []string{
"-A", string(hostportChain), "-A", string(hostportChain),
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment