Skip to content

Commit 380adb9

Browse files
aroradamanaroradaman
committed
kube-proxy: internal config: consolidate SyncPeriod and MinSyncPeriod
Consolidate SyncPeriod and MinSyncPeriod for internal configuration of kube-proxy adhering to the v1alpha2 version specifications as detailed in https://kep.k8s.io/784. Signed-off-by: Daman Arora <[email protected]>
1 parent 1854839 commit 380adb9

File tree

15 files changed

+224
-298
lines changed

15 files changed

+224
-298
lines changed

‎cmd/kube-proxy/app/options.go‎

Lines changed: 30 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ import (
2121
"fmt"
2222
"os"
2323
"strings"
24+
"time"
2425

2526
"github.com/fsnotify/fsnotify"
2627
"github.com/spf13/pflag"
@@ -79,6 +80,13 @@ type Options struct {
7980
hostnameOverride string
8081

8182
logger klog.Logger
83+
84+
// The fields below here are placeholders for flags that can't be directly mapped into
85+
// config.KubeProxyConfiguration.
86+
iptablesSyncPeriod time.Duration
87+
iptablesMinSyncPeriod time.Duration
88+
ipvsSyncPeriod time.Duration
89+
ipvsMinSyncPeriod time.Duration
8290
}
8391

8492
// AddFlags adds flags to fs and binds them to options.
@@ -120,11 +128,11 @@ func (o *Options) AddFlags(fs *pflag.FlagSet) {
120128
fs.Int32Var(o.config.IPTables.MasqueradeBit, "iptables-masquerade-bit", ptr.Deref(o.config.IPTables.MasqueradeBit, 14), "If using the iptables or ipvs proxy mode, the bit of the fwmark space to mark packets requiring SNAT with. Must be within the range [0, 31].")
121129
fs.BoolVar(&o.config.Linux.MasqueradeAll, "masquerade-all", o.config.Linux.MasqueradeAll, "SNAT all traffic sent via Service cluster IPs. This may be required with some CNI plugins. Only supported on Linux.")
122130
fs.BoolVar(o.config.IPTables.LocalhostNodePorts, "iptables-localhost-nodeports", ptr.Deref(o.config.IPTables.LocalhostNodePorts, true), "If false, kube-proxy will disable the legacy behavior of allowing NodePort services to be accessed via localhost. (Applies only to iptables mode and IPv4; localhost NodePorts are never allowed with other proxy modes or with IPv6.)")
123-
fs.DurationVar(&o.config.IPTables.SyncPeriod.Duration, "iptables-sync-period", o.config.IPTables.SyncPeriod.Duration, "An interval (e.g. '5s', '1m', '2h22m') indicating how frequently various re-synchronizing and cleanup operations are performed. Must be greater than 0.")
124-
fs.DurationVar(&o.config.IPTables.MinSyncPeriod.Duration, "iptables-min-sync-period", o.config.IPTables.MinSyncPeriod.Duration, "The minimum period between iptables rule resyncs (e.g. '5s', '1m', '2h22m'). A value of 0 means every Service or EndpointSlice change will result in an immediate iptables resync.")
131+
fs.DurationVar(&o.iptablesSyncPeriod, "iptables-sync-period", o.config.SyncPeriod.Duration, "An interval (e.g. '5s', '1m', '2h22m') indicating how frequently various re-synchronizing and cleanup operations are performed. Must be greater than 0.")
132+
fs.DurationVar(&o.iptablesMinSyncPeriod, "iptables-min-sync-period", o.config.MinSyncPeriod.Duration, "The minimum period between iptables rule resyncs (e.g. '5s', '1m', '2h22m'). A value of 0 means every Service or EndpointSlice change will result in an immediate iptables resync.")
125133

126-
fs.DurationVar(&o.config.IPVS.SyncPeriod.Duration, "ipvs-sync-period", o.config.IPVS.SyncPeriod.Duration, "An interval (e.g. '5s', '1m', '2h22m') indicating how frequently various re-synchronizing and cleanup operations are performed. Must be greater than 0.")
127-
fs.DurationVar(&o.config.IPVS.MinSyncPeriod.Duration, "ipvs-min-sync-period", o.config.IPVS.MinSyncPeriod.Duration, "The minimum period between IPVS rule resyncs (e.g. '5s', '1m', '2h22m'). A value of 0 means every Service or EndpointSlice change will result in an immediate IPVS resync.")
134+
fs.DurationVar(&o.ipvsSyncPeriod, "ipvs-sync-period", o.config.SyncPeriod.Duration, "An interval (e.g. '5s', '1m', '2h22m') indicating how frequently various re-synchronizing and cleanup operations are performed. Must be greater than 0.")
135+
fs.DurationVar(&o.ipvsMinSyncPeriod, "ipvs-min-sync-period", o.config.MinSyncPeriod.Duration, "The minimum period between IPVS rule resyncs (e.g. '5s', '1m', '2h22m'). A value of 0 means every Service or EndpointSlice change will result in an immediate IPVS resync.")
128136
fs.StringVar(&o.config.IPVS.Scheduler, "ipvs-scheduler", o.config.IPVS.Scheduler, "The ipvs scheduler type when proxy mode is ipvs")
129137
fs.StringSliceVar(&o.config.IPVS.ExcludeCIDRs, "ipvs-exclude-cidrs", o.config.IPVS.ExcludeCIDRs, "A comma-separated list of CIDRs which the ipvs proxier should not touch when cleaning up IPVS rules.")
130138
fs.BoolVar(&o.config.IPVS.StrictARP, "ipvs-strict-arp", o.config.IPVS.StrictARP, "Enable strict ARP by setting arp_ignore to 1 and arp_announce to 2")
@@ -216,6 +224,8 @@ func (o *Options) Complete(fs *pflag.FlagSet) error {
216224
if err := o.initWatcher(); err != nil {
217225
return err
218226
}
227+
} else {
228+
o.processV1Alpha1Flags(fs)
219229
}
220230

221231
o.platformApplyDefaults(o.config)
@@ -302,6 +312,22 @@ func (o *Options) processHostnameOverrideFlag() error {
302312
return nil
303313
}
304314

315+
// processV1Alpha1Flags processes v1alpha1 flags which can't be directly mapped to internal config.
316+
func (o *Options) processV1Alpha1Flags(fs *pflag.FlagSet) {
317+
if fs.Changed("iptables-sync-period") && o.config.Mode != kubeproxyconfig.ProxyModeIPVS {
318+
o.config.SyncPeriod.Duration = o.iptablesSyncPeriod
319+
}
320+
if fs.Changed("iptables-min-sync-period") && o.config.Mode != kubeproxyconfig.ProxyModeIPVS {
321+
o.config.MinSyncPeriod.Duration = o.iptablesMinSyncPeriod
322+
}
323+
if fs.Changed("ipvs-sync-period") && o.config.Mode == kubeproxyconfig.ProxyModeIPVS {
324+
o.config.SyncPeriod.Duration = o.ipvsSyncPeriod
325+
}
326+
if fs.Changed("ipvs-min-sync-period") && o.config.Mode == kubeproxyconfig.ProxyModeIPVS {
327+
o.config.MinSyncPeriod.Duration = o.ipvsMinSyncPeriod
328+
}
329+
}
330+
305331
// Validate validates all the required options.
306332
func (o *Options) Validate() error {
307333
if errs := validation.Validate(o.config); len(errs) != 0 {

‎cmd/kube-proxy/app/options_test.go‎

Lines changed: 87 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -195,6 +195,8 @@ nodePortAddresses:
195195
QPS: 7,
196196
},
197197
ClusterCIDR: tc.clusterCIDR,
198+
MinSyncPeriod: metav1.Duration{Duration: 10 * time.Second},
199+
SyncPeriod: metav1.Duration{Duration: 60 * time.Second},
198200
ConfigSyncPeriod: metav1.Duration{Duration: 15 * time.Second},
199201
Linux: kubeproxyconfig.KubeProxyLinuxConfiguration{
200202
Conntrack: kubeproxyconfig.KubeProxyConntrackConfiguration{
@@ -212,18 +214,12 @@ nodePortAddresses:
212214
IPTables: kubeproxyconfig.KubeProxyIPTablesConfiguration{
213215
MasqueradeBit: ptr.To[int32](17),
214216
LocalhostNodePorts: ptr.To(true),
215-
MinSyncPeriod: metav1.Duration{Duration: 10 * time.Second},
216-
SyncPeriod: metav1.Duration{Duration: 60 * time.Second},
217217
},
218218
IPVS: kubeproxyconfig.KubeProxyIPVSConfiguration{
219-
MinSyncPeriod: metav1.Duration{Duration: 10 * time.Second},
220-
SyncPeriod: metav1.Duration{Duration: 60 * time.Second},
221-
ExcludeCIDRs: []string{"10.20.30.40/16", "fd00:1::0/64"},
219+
ExcludeCIDRs: []string{"10.20.30.40/16", "fd00:1::0/64"},
222220
},
223221
NFTables: kubeproxyconfig.KubeProxyNFTablesConfiguration{
224222
MasqueradeBit: ptr.To[int32](18),
225-
MinSyncPeriod: metav1.Duration{Duration: 10 * time.Second},
226-
SyncPeriod: metav1.Duration{Duration: 60 * time.Second},
227223
},
228224
MetricsBindAddress: tc.metricsBindAddress,
229225
Mode: kubeproxyconfig.ProxyMode(tc.mode),
@@ -377,6 +373,90 @@ func TestProcessHostnameOverrideFlag(t *testing.T) {
377373
}
378374
}
379375

376+
// TestProcessV1Alpha1Flags tests processing v1alpha1 flags.
377+
func TestProcessV1Alpha1Flags(t *testing.T) {
378+
testCases := []struct {
379+
name string
380+
flags []string
381+
validate func(*kubeproxyconfig.KubeProxyConfiguration) bool
382+
}{
383+
{
384+
name: "iptables configuration",
385+
flags: []string{
386+
"--iptables-sync-period=36s",
387+
"--iptables-min-sync-period=3s",
388+
"--proxy-mode=iptables",
389+
},
390+
validate: func(config *kubeproxyconfig.KubeProxyConfiguration) bool {
391+
return config.SyncPeriod == metav1.Duration{Duration: 36 * time.Second} &&
392+
config.MinSyncPeriod == metav1.Duration{Duration: 3 * time.Second}
393+
},
394+
},
395+
{
396+
name: "iptables + ipvs configuration with iptables mode",
397+
flags: []string{
398+
"--iptables-sync-period=36s",
399+
"--iptables-min-sync-period=3s",
400+
"--ipvs-sync-period=16s",
401+
"--ipvs-min-sync-period=7s",
402+
"--proxy-mode=iptables",
403+
},
404+
validate: func(config *kubeproxyconfig.KubeProxyConfiguration) bool {
405+
return config.SyncPeriod == metav1.Duration{Duration: 36 * time.Second} &&
406+
config.MinSyncPeriod == metav1.Duration{Duration: 3 * time.Second}
407+
},
408+
},
409+
{
410+
name: "winkernel configuration",
411+
flags: []string{
412+
"--iptables-sync-period=36s",
413+
"--iptables-min-sync-period=3s",
414+
"--proxy-mode=kernelspace",
415+
},
416+
validate: func(config *kubeproxyconfig.KubeProxyConfiguration) bool {
417+
return config.SyncPeriod == metav1.Duration{Duration: 36 * time.Second} &&
418+
config.MinSyncPeriod == metav1.Duration{Duration: 3 * time.Second}
419+
},
420+
},
421+
{
422+
name: "ipvs + iptables configuration with ipvs mode",
423+
flags: []string{
424+
"--iptables-sync-period=36s",
425+
"--iptables-min-sync-period=3s",
426+
"--ipvs-sync-period=16s",
427+
"--ipvs-min-sync-period=7s",
428+
"--proxy-mode=ipvs",
429+
},
430+
validate: func(config *kubeproxyconfig.KubeProxyConfiguration) bool {
431+
return config.SyncPeriod == metav1.Duration{Duration: 16 * time.Second} &&
432+
config.MinSyncPeriod == metav1.Duration{Duration: 7 * time.Second}
433+
},
434+
},
435+
{
436+
name: "ipvs configuration",
437+
flags: []string{
438+
"--ipvs-sync-period=16s",
439+
"--ipvs-min-sync-period=7s",
440+
"--proxy-mode=ipvs",
441+
},
442+
validate: func(config *kubeproxyconfig.KubeProxyConfiguration) bool {
443+
return config.SyncPeriod == metav1.Duration{Duration: 16 * time.Second} &&
444+
config.MinSyncPeriod == metav1.Duration{Duration: 7 * time.Second}
445+
},
446+
},
447+
}
448+
for _, tc := range testCases {
449+
t.Run(tc.name, func(t *testing.T) {
450+
options := NewOptions()
451+
fs := new(pflag.FlagSet)
452+
options.AddFlags(fs)
453+
require.NoError(t, fs.Parse(tc.flags))
454+
options.processV1Alpha1Flags(fs)
455+
require.True(t, tc.validate(options.config))
456+
})
457+
}
458+
}
459+
380460
// TestOptionsComplete checks that command line flags are combined with a
381461
// config properly.
382462
func TestOptionsComplete(t *testing.T) {

‎cmd/kube-proxy/app/server.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -222,7 +222,7 @@ func newProxyServer(ctx context.Context, config *kubeproxyconfig.KubeProxyConfig
222222
}
223223

224224
if len(config.HealthzBindAddress) > 0 {
225-
s.HealthzServer = healthcheck.NewProxierHealthServer(config.HealthzBindAddress, 2*config.IPTables.SyncPeriod.Duration)
225+
s.HealthzServer = healthcheck.NewProxierHealthServer(config.HealthzBindAddress, 2*config.SyncPeriod.Duration)
226226
}
227227

228228
err = s.platformSetup(ctx)

‎cmd/kube-proxy/app/server_linux.go‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -178,8 +178,8 @@ func (s *ProxyServer) createProxier(ctx context.Context, config *proxyconfigapi.
178178
ipt,
179179
utilsysctl.New(),
180180
exec.New(),
181-
config.IPTables.SyncPeriod.Duration,
182-
config.IPTables.MinSyncPeriod.Duration,
181+
config.SyncPeriod.Duration,
182+
config.MinSyncPeriod.Duration,
183183
config.Linux.MasqueradeAll,
184184
*config.IPTables.LocalhostNodePorts,
185185
int(*config.IPTables.MasqueradeBit),
@@ -202,8 +202,8 @@ func (s *ProxyServer) createProxier(ctx context.Context, config *proxyconfigapi.
202202
iptInterface,
203203
utilsysctl.New(),
204204
exec.New(),
205-
config.IPTables.SyncPeriod.Duration,
206-
config.IPTables.MinSyncPeriod.Duration,
205+
config.SyncPeriod.Duration,
206+
config.MinSyncPeriod.Duration,
207207
config.Linux.MasqueradeAll,
208208
*config.IPTables.LocalhostNodePorts,
209209
int(*config.IPTables.MasqueradeBit),
@@ -238,8 +238,8 @@ func (s *ProxyServer) createProxier(ctx context.Context, config *proxyconfigapi.
238238
ipsetInterface,
239239
utilsysctl.New(),
240240
execer,
241-
config.IPVS.SyncPeriod.Duration,
242-
config.IPVS.MinSyncPeriod.Duration,
241+
config.SyncPeriod.Duration,
242+
config.MinSyncPeriod.Duration,
243243
config.IPVS.ExcludeCIDRs,
244244
config.IPVS.StrictARP,
245245
config.IPVS.TCPTimeout.Duration,
@@ -266,8 +266,8 @@ func (s *ProxyServer) createProxier(ctx context.Context, config *proxyconfigapi.
266266
ipsetInterface,
267267
utilsysctl.New(),
268268
execer,
269-
config.IPVS.SyncPeriod.Duration,
270-
config.IPVS.MinSyncPeriod.Duration,
269+
config.SyncPeriod.Duration,
270+
config.MinSyncPeriod.Duration,
271271
config.IPVS.ExcludeCIDRs,
272272
config.IPVS.StrictARP,
273273
config.IPVS.TCPTimeout.Duration,
@@ -295,8 +295,8 @@ func (s *ProxyServer) createProxier(ctx context.Context, config *proxyconfigapi.
295295
// TODO this has side effects that should only happen when Run() is invoked.
296296
proxier, err = nftables.NewDualStackProxier(
297297
ctx,
298-
config.NFTables.SyncPeriod.Duration,
299-
config.NFTables.MinSyncPeriod.Duration,
298+
config.SyncPeriod.Duration,
299+
config.MinSyncPeriod.Duration,
300300
config.Linux.MasqueradeAll,
301301
int(*config.NFTables.MasqueradeBit),
302302
localDetectors,
@@ -313,8 +313,8 @@ func (s *ProxyServer) createProxier(ctx context.Context, config *proxyconfigapi.
313313
proxier, err = nftables.NewProxier(
314314
ctx,
315315
s.PrimaryIPFamily,
316-
config.NFTables.SyncPeriod.Duration,
317-
config.NFTables.MinSyncPeriod.Duration,
316+
config.SyncPeriod.Duration,
317+
config.MinSyncPeriod.Duration,
318318
config.Linux.MasqueradeAll,
319319
int(*config.NFTables.MasqueradeBit),
320320
localDetectors[s.PrimaryIPFamily],

‎cmd/kube-proxy/app/server_windows.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -91,8 +91,8 @@ func (s *ProxyServer) createProxier(ctx context.Context, config *proxyconfigapi.
9191

9292
if dualStackMode {
9393
proxier, err = winkernel.NewDualStackProxier(
94-
config.IPTables.SyncPeriod.Duration,
95-
config.IPTables.MinSyncPeriod.Duration,
94+
config.SyncPeriod.Duration,
95+
config.MinSyncPeriod.Duration,
9696
s.Hostname,
9797
s.NodeIPs,
9898
s.Recorder,
@@ -103,8 +103,8 @@ func (s *ProxyServer) createProxier(ctx context.Context, config *proxyconfigapi.
103103
} else {
104104
proxier, err = winkernel.NewProxier(
105105
s.PrimaryIPFamily,
106-
config.IPTables.SyncPeriod.Duration,
107-
config.IPTables.MinSyncPeriod.Duration,
106+
config.SyncPeriod.Duration,
107+
config.MinSyncPeriod.Duration,
108108
s.Hostname,
109109
s.NodeIPs[s.PrimaryIPFamily],
110110
s.Recorder,

‎pkg/proxy/apis/config/scheme/testdata/KubeProxyConfiguration/after/v1alpha1.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ ipvs:
3535
minSyncPeriod: 0s
3636
scheduler: ""
3737
strictARP: false
38-
syncPeriod: 30s
38+
syncPeriod: 0s
3939
tcpFinTimeout: 0s
4040
tcpTimeout: 0s
4141
udpTimeout: 0s
@@ -54,8 +54,8 @@ mode: ""
5454
nftables:
5555
masqueradeAll: false
5656
masqueradeBit: 14
57-
minSyncPeriod: 1s
58-
syncPeriod: 30s
57+
minSyncPeriod: 0s
58+
syncPeriod: 0s
5959
nodePortAddresses: null
6060
oomScoreAdj: -999
6161
portRange: ""

‎pkg/proxy/apis/config/scheme/testdata/KubeProxyConfiguration/roundtrip/default/v1alpha1.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ ipvs:
3535
minSyncPeriod: 0s
3636
scheduler: ""
3737
strictARP: false
38-
syncPeriod: 30s
38+
syncPeriod: 0s
3939
tcpFinTimeout: 0s
4040
tcpTimeout: 0s
4141
udpTimeout: 0s
@@ -54,8 +54,8 @@ mode: ""
5454
nftables:
5555
masqueradeAll: false
5656
masqueradeBit: 14
57-
minSyncPeriod: 1s
58-
syncPeriod: 30s
57+
minSyncPeriod: 0s
58+
syncPeriod: 0s
5959
nodePortAddresses: null
6060
oomScoreAdj: -999
6161
portRange: ""

‎pkg/proxy/apis/config/types.go‎

Lines changed: 8 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -53,27 +53,11 @@ type KubeProxyIPTablesConfiguration struct {
5353
// iptables mode and IPv4; localhost NodePorts are never allowed with other proxy
5454
// modes or with IPv6.)
5555
LocalhostNodePorts *bool
56-
// syncPeriod is an interval (e.g. '5s', '1m', '2h22m') indicating how frequently
57-
// various re-synchronizing and cleanup operations are performed. Must be greater
58-
// than 0.
59-
SyncPeriod metav1.Duration
60-
// minSyncPeriod is the minimum period between iptables rule resyncs (e.g. '5s',
61-
// '1m', '2h22m'). A value of 0 means every Service or EndpointSlice change will
62-
// result in an immediate iptables resync.
63-
MinSyncPeriod metav1.Duration
6456
}
6557

6658
// KubeProxyIPVSConfiguration contains ipvs-related configuration
6759
// details for the Kubernetes proxy server.
6860
type KubeProxyIPVSConfiguration struct {
69-
// syncPeriod is an interval (e.g. '5s', '1m', '2h22m') indicating how frequently
70-
// various re-synchronizing and cleanup operations are performed. Must be greater
71-
// than 0.
72-
SyncPeriod metav1.Duration
73-
// minSyncPeriod is the minimum period between IPVS rule resyncs (e.g. '5s', '1m',
74-
// '2h22m'). A value of 0 means every Service or EndpointSlice change will result
75-
// in an immediate IPVS resync.
76-
MinSyncPeriod metav1.Duration
7761
// scheduler is the IPVS scheduler to use
7862
Scheduler string
7963
// excludeCIDRs is a list of CIDRs which the ipvs proxier should not touch
@@ -99,14 +83,6 @@ type KubeProxyNFTablesConfiguration struct {
9983
// masqueradeBit is the bit of the iptables fwmark space to use for SNAT if using
10084
// the nftables proxy mode. Values must be within the range [0, 31].
10185
MasqueradeBit *int32
102-
// syncPeriod is an interval (e.g. '5s', '1m', '2h22m') indicating how frequently
103-
// various re-synchronizing and cleanup operations are performed. Must be greater
104-
// than 0.
105-
SyncPeriod metav1.Duration
106-
// minSyncPeriod is the minimum period between iptables rule resyncs (e.g. '5s',
107-
// '1m', '2h22m'). A value of 0 means every Service or EndpointSlice change will
108-
// result in an immediate iptables resync.
109-
MinSyncPeriod metav1.Duration
11086
}
11187

11288
// KubeProxyConntrackConfiguration contains conntrack settings for
@@ -251,6 +227,14 @@ type KubeProxyConfiguration struct {
251227
// object. If unset, NodePort connections will be accepted on all local IPs.
252228
NodePortAddresses []string
253229

230+
// syncPeriod is an interval (e.g. '5s', '1m', '2h22m') indicating how frequently
231+
// various re-synchronizing and cleanup operations are performed. Must be greater
232+
// than 0.
233+
SyncPeriod metav1.Duration
234+
// minSyncPeriod is the minimum period between proxier rule resyncs (e.g. '5s',
235+
// '1m', '2h22m'). A value of 0 means every Service or EndpointSlice change will
236+
// result in an immediate proxier resync.
237+
MinSyncPeriod metav1.Duration
254238
// configSyncPeriod is how often configuration from the apiserver is refreshed. Must be greater
255239
// than 0.
256240
ConfigSyncPeriod metav1.Duration

0 commit comments

Comments
 (0)