Skip to content

Commit dc8c731

Browse files
jimmidysonjimmidyson
committed
fixup! feat: Support nftables kube-proxy mode
1 parent 519cf80 commit dc8c731

File tree

9 files changed

+301
-45
lines changed

9 files changed

+301
-45
lines changed

‎api/v1alpha1/clusterconfig_types.go‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -340,14 +340,19 @@ const (
340340
// KubeProxyModeIPTables indicates that kube-proxy should be installed in iptables
341341
// mode.
342342
KubeProxyModeIPTables KubeProxyMode = "iptables"
343+
// KubeProxyModeNFTables indicates that kube-proxy should be installed in iptables
344+
// mode.
345+
KubeProxyModeNFTables KubeProxyMode = "nftables"
343346
)
344347

345348
type KubeProxy struct {
346-
// Mode specifies the mode for kube-proxy.
347-
// Disabled means that kube-proxy is not installed.
348-
// iptables means that kube-proxy is installed in iptables mode.
349+
// Mode specifies the mode for kube-proxy:
350+
//
351+
// - Disabled means that kube-proxy is not installed.
352+
// - iptables means that kube-proxy is installed in iptables mode.
353+
// - nftables means that kube-proxy is installed in nftables mode.
349354
// +kubebuilder:validation:Optional
350-
// +kubebuilder:validation:Enum=Disabled;iptables
355+
// +kubebuilder:validation:Enum=Disabled;iptables;nftables
351356
// +kubebuilder:default=iptables
352357
// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="Value cannot be changed after cluster creation"
353358
Mode KubeProxyMode `json:"mode,omitempty"`

‎api/v1alpha1/crds/caren.nutanix.com_awsclusterconfigs.yaml‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -566,12 +566,15 @@ spec:
566566
mode:
567567
default: iptables
568568
description: |-
569-
Mode specifies the mode for kube-proxy.
570-
Disabled means that kube-proxy is not installed.
571-
iptables means that kube-proxy is installed in iptables mode.
569+
Mode specifies the mode for kube-proxy:
570+
571+
- Disabled means that kube-proxy is not installed.
572+
- iptables means that kube-proxy is installed in iptables mode.
573+
- nftables means that kube-proxy is installed in nftables mode.
572574
enum:
573575
- Disabled
574576
- iptables
577+
- nftables
575578
type: string
576579
x-kubernetes-validations:
577580
- message: Value cannot be changed after cluster creation

‎api/v1alpha1/crds/caren.nutanix.com_dockerclusterconfigs.yaml‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -503,12 +503,15 @@ spec:
503503
mode:
504504
default: iptables
505505
description: |-
506-
Mode specifies the mode for kube-proxy.
507-
Disabled means that kube-proxy is not installed.
508-
iptables means that kube-proxy is installed in iptables mode.
506+
Mode specifies the mode for kube-proxy:
507+
508+
- Disabled means that kube-proxy is not installed.
509+
- iptables means that kube-proxy is installed in iptables mode.
510+
- nftables means that kube-proxy is installed in nftables mode.
509511
enum:
510512
- Disabled
511513
- iptables
514+
- nftables
512515
type: string
513516
x-kubernetes-validations:
514517
- message: Value cannot be changed after cluster creation

‎api/v1alpha1/crds/caren.nutanix.com_genericclusterconfigs.yaml‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -181,12 +181,15 @@ spec:
181181
mode:
182182
default: iptables
183183
description: |-
184-
Mode specifies the mode for kube-proxy.
185-
Disabled means that kube-proxy is not installed.
186-
iptables means that kube-proxy is installed in iptables mode.
184+
Mode specifies the mode for kube-proxy:
185+
186+
- Disabled means that kube-proxy is not installed.
187+
- iptables means that kube-proxy is installed in iptables mode.
188+
- nftables means that kube-proxy is installed in nftables mode.
187189
enum:
188190
- Disabled
189191
- iptables
192+
- nftables
190193
type: string
191194
x-kubernetes-validations:
192195
- message: Value cannot be changed after cluster creation

‎api/v1alpha1/crds/caren.nutanix.com_nutanixclusterconfigs.yaml‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -682,12 +682,15 @@ spec:
682682
mode:
683683
default: iptables
684684
description: |-
685-
Mode specifies the mode for kube-proxy.
686-
Disabled means that kube-proxy is not installed.
687-
iptables means that kube-proxy is installed in iptables mode.
685+
Mode specifies the mode for kube-proxy:
686+
687+
- Disabled means that kube-proxy is not installed.
688+
- iptables means that kube-proxy is installed in iptables mode.
689+
- nftables means that kube-proxy is installed in nftables mode.
688690
enum:
689691
- Disabled
690692
- iptables
693+
- nftables
691694
type: string
692695
x-kubernetes-validations:
693696
- message: Value cannot be changed after cluster creation

‎docs/content/customization/generic/kube-proxy-mode.md‎

Lines changed: 48 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,55 @@
22
title = "kube-proxy mode"
33
+++
44

5-
This customization allows configuration of the `kube-proxy` proxy mode. Currently, only `iptables` or `Disabled` modes
6-
are supported. `Disabled` is useful when deploying a CNI implementation that can replace `kube-proxy` to avoid
7-
potential conflicts. By default, `kube-proxy` is enabled in `iptables` mode.
5+
This customization allows configuration of the `kube-proxy` proxy mode. Currently, only `iptables`, `nftables` or
6+
`Disabled` modes are supported. `Disabled` is useful when deploying a CNI implementation that can replace `kube-proxy`
7+
to avoid potential conflicts. By default, `kube-proxy` is enabled in `iptables` mode.
88

9-
## Example
9+
## Examples
10+
11+
### Enabling nftables kube-proxy mode
12+
13+
Enabling `nftables` is done via the following configuration:
14+
15+
```yaml
16+
apiVersion: cluster.x-k8s.io/v1beta1
17+
kind: Cluster
18+
metadata:
19+
name: <NAME>
20+
spec:
21+
topology:
22+
variables:
23+
- name: clusterConfig
24+
value:
25+
kubeProxy:
26+
mode: nftables
27+
```
28+
29+
Applying this configuration will result in the following configuration being applied to create a
30+
`KubeProxyConfiguration` and append it to the kubeadm configuration that is used when `kubeadm init`
31+
is executed:
32+
33+
- `KubeadmControlPlaneTemplate`:
34+
35+
- ```yaml
36+
spec:
37+
template:
38+
spec:
39+
kubeadmConfigSpec:
40+
files:
41+
- path: "/etc/kubernetes/kubeproxy-config.yaml"
42+
owner: "root:root"
43+
permissions: "0644"
44+
content: |-
45+
---
46+
apiVersion: kubeproxy.config.k8s.io/v1alpha1
47+
kind: KubeProxyConfiguration
48+
mode: nftables
49+
preKubeadmCommands:
50+
- /bin/sh -ec 'cat /etc/kubernetes/kubeproxy-config.yaml >> /run/kubeadm/kubeadm.yaml'
51+
```
52+
53+
### Skipping kube-proxy installation
1054

1155
To disable the deployment of `kube-proxy`, specify the following configuration:
1256

‎pkg/handlers/generic/mutation/kubeproxymode/inject.go‎

Lines changed: 28 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,13 @@ import (
2525
const (
2626
// VariableName is the external patch variable name.
2727
VariableName = "kubeProxy"
28+
29+
kubeProxyConfigYAMLTemplate = `
30+
---
31+
apiVersion: kubeproxy.config.k8s.io/v1alpha1
32+
kind: KubeProxyConfiguration
33+
mode: %s
34+
`
2835
)
2936

3037
type kubeProxyMode struct {
@@ -101,20 +108,33 @@ func (h *kubeProxyMode) Mutate(
101108
"patchedObjectKind", obj.GetObjectKind().GroupVersionKind().String(),
102109
"patchedObjectName", client.ObjectKeyFromObject(obj),
103110
).Info("adding kube proxy mode to control plane kubeadm config spec")
104-
if obj.Spec.Template.Spec.KubeadmConfigSpec.InitConfiguration == nil {
105-
obj.Spec.Template.Spec.KubeadmConfigSpec.InitConfiguration = &bootstrapv1.InitConfiguration{}
106-
}
107111

108112
switch kubeProxyMode {
109113
case v1alpha1.KubeProxyModeDisabled:
110114
log.Info("kube proxy mode is set to disabled, skipping kube-proxy addon")
111-
obj.Spec.Template.Spec.KubeadmConfigSpec.InitConfiguration.SkipPhases = append(
112-
obj.Spec.Template.Spec.KubeadmConfigSpec.InitConfiguration.SkipPhases,
115+
if obj.Spec.Template.Spec.KubeadmConfigSpec.InitConfiguration == nil {
116+
obj.Spec.Template.Spec.KubeadmConfigSpec.InitConfiguration = &bootstrapv1.InitConfiguration{}
117+
}
118+
initConfiguration := obj.Spec.Template.Spec.KubeadmConfigSpec.InitConfiguration
119+
initConfiguration.SkipPhases = append(
120+
initConfiguration.SkipPhases,
113121
"addon/kube-proxy",
114122
)
115-
case v1alpha1.KubeProxyModeIPTables:
116-
log.Info(
117-
"kube proxy mode is set to iptables, no patches required as this is the default mode configured by kubeadm",
123+
case v1alpha1.KubeProxyModeIPTables, v1alpha1.KubeProxyModeNFTables:
124+
kubeProxyConfig := bootstrapv1.File{
125+
Path: "/etc/kubernetes/kubeproxy-config.yaml",
126+
Owner: "root:root",
127+
Permissions: "0644",
128+
Content: fmt.Sprintf(kubeProxyConfigYAMLTemplate, kubeProxyMode),
129+
}
130+
obj.Spec.Template.Spec.KubeadmConfigSpec.Files = append(
131+
obj.Spec.Template.Spec.KubeadmConfigSpec.Files,
132+
kubeProxyConfig,
133+
)
134+
mergeKubeProxyConfigCmd := "/bin/sh -ec 'cat /etc/kubernetes/kubeproxy-config.yaml >> /run/kubeadm/kubeadm.yaml'"
135+
obj.Spec.Template.Spec.KubeadmConfigSpec.PreKubeadmCommands = append(
136+
obj.Spec.Template.Spec.KubeadmConfigSpec.PreKubeadmCommands,
137+
mergeKubeProxyConfigCmd,
118138
)
119139
default:
120140
return fmt.Errorf("unknown kube proxy mode %q", kubeProxyMode)

0 commit comments

Comments
 (0)