Skip to content

Commit 8aff9d3

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request kubernetes#126072 from aroradaman/proxy-config-v1alpah2-windows
kube-proxy: internal config: add Linux and Windows section
2 parents a00c834 + 6c10c97 commit 8aff9d3

File tree

15 files changed

+364
-209
lines changed

15 files changed

+364
-209
lines changed

‎cmd/kube-proxy/app/init_windows.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ func initForOS(windowsService bool) error {
3737
}
3838

3939
func (o *Options) addOSFlags(fs *pflag.FlagSet) {
40-
fs.BoolVar(&o.WindowsService, "windows-service", o.WindowsService, "Enable Windows Service Control Manager API integration")
40+
fs.BoolVar(&o.config.Windows.RunAsService, "windows-service", o.config.Windows.RunAsService, "Enable Windows Service Control Manager API integration")
4141
fs.StringVar(&o.config.Winkernel.SourceVip, "source-vip", o.config.Winkernel.SourceVip, "The IP address of the source VIP for non-DSR.")
4242
fs.StringVar(&o.config.Winkernel.NetworkName, "network-name", o.config.Winkernel.NetworkName, "The name of the cluster network.")
4343
fs.BoolVar(&o.config.Winkernel.EnableDSR, "enable-dsr", o.config.Winkernel.EnableDSR, "If true make kube-proxy apply DSR policies for service VIP")

‎cmd/kube-proxy/app/options.go‎

Lines changed: 10 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -54,9 +54,6 @@ type Options struct {
5454
CleanupAndExit bool
5555
// InitAndExit, when true, makes the proxy server makes configurations that need privileged access, then exit.
5656
InitAndExit bool
57-
// WindowsService should be set to true if kube-proxy is running as a service on Windows.
58-
// Its corresponding flag only gets registered in Windows builds
59-
WindowsService bool
6057
// config is the proxy server's configuration object.
6158
config *kubeproxyconfig.KubeProxyConfiguration
6259
// watcher is used to watch on the update change of ConfigFile
@@ -121,7 +118,7 @@ func (o *Options) AddFlags(fs *pflag.FlagSet) {
121118
"This parameter is ignored if a config file is specified by --config.")
122119

123120
fs.Int32Var(o.config.IPTables.MasqueradeBit, "iptables-masquerade-bit", ptr.Deref(o.config.IPTables.MasqueradeBit, 14), "If using the iptables or ipvs proxy mode, the bit of the fwmark space to mark packets requiring SNAT with. Must be within the range [0, 31].")
124-
fs.BoolVar(&o.config.IPTables.MasqueradeAll, "masquerade-all", o.config.IPTables.MasqueradeAll, "If using the iptables or ipvs proxy mode, SNAT all traffic sent via Service cluster IPs. This may be required with some CNI plugins.")
121+
fs.BoolVar(&o.config.Linux.MasqueradeAll, "masquerade-all", o.config.Linux.MasqueradeAll, "SNAT all traffic sent via Service cluster IPs. This may be required with some CNI plugins. Only supported on Linux.")
125122
fs.BoolVar(o.config.IPTables.LocalhostNodePorts, "iptables-localhost-nodeports", ptr.Deref(o.config.IPTables.LocalhostNodePorts, true), "If false, kube-proxy will disable the legacy behavior of allowing NodePort services to be accessed via localhost. (Applies only to iptables mode and IPv4; localhost NodePorts are never allowed with other proxy modes or with IPv6.)")
126123
fs.DurationVar(&o.config.IPTables.SyncPeriod.Duration, "iptables-sync-period", o.config.IPTables.SyncPeriod.Duration, "An interval (e.g. '5s', '1m', '2h22m') indicating how frequently various re-synchronizing and cleanup operations are performed. Must be greater than 0.")
127124
fs.DurationVar(&o.config.IPTables.MinSyncPeriod.Duration, "iptables-min-sync-period", o.config.IPTables.MinSyncPeriod.Duration, "The minimum period between iptables rule resyncs (e.g. '5s', '1m', '2h22m'). A value of 0 means every Service or EndpointSlice change will result in an immediate iptables resync.")
@@ -144,21 +141,20 @@ func (o *Options) AddFlags(fs *pflag.FlagSet) {
144141
fs.StringSliceVar(&o.config.NodePortAddresses, "nodeport-addresses", o.config.NodePortAddresses,
145142
"A list of CIDR ranges that contain valid node IPs, or alternatively, the single string 'primary'. If set to a list of CIDRs, connections to NodePort services will only be accepted on node IPs in one of the indicated ranges. If set to 'primary', NodePort services will only be accepted on the node's primary IP(s) according to the Node object. If unset, NodePort connections will be accepted on all local IPs. This parameter is ignored if a config file is specified by --config.")
146143

147-
fs.Int32Var(o.config.OOMScoreAdj, "oom-score-adj", ptr.Deref(o.config.OOMScoreAdj, int32(qos.KubeProxyOOMScoreAdj)), "The oom-score-adj value for kube-proxy process. Values must be within the range [-1000, 1000]. This parameter is ignored if a config file is specified by --config.")
148-
fs.Int32Var(o.config.Conntrack.MaxPerCore, "conntrack-max-per-core", *o.config.Conntrack.MaxPerCore,
144+
fs.Int32Var(o.config.Linux.OOMScoreAdj, "oom-score-adj", ptr.Deref(o.config.Linux.OOMScoreAdj, int32(qos.KubeProxyOOMScoreAdj)), "The oom-score-adj value for kube-proxy process. Values must be within the range [-1000, 1000]. This parameter is ignored if a config file is specified by --config.")
145+
fs.Int32Var(o.config.Linux.Conntrack.MaxPerCore, "conntrack-max-per-core", *o.config.Linux.Conntrack.MaxPerCore,
149146
"Maximum number of NAT connections to track per CPU core (0 to leave the limit as-is and ignore conntrack-min).")
150-
fs.Int32Var(o.config.Conntrack.Min, "conntrack-min", *o.config.Conntrack.Min,
147+
fs.Int32Var(o.config.Linux.Conntrack.Min, "conntrack-min", *o.config.Linux.Conntrack.Min,
151148
"Minimum number of conntrack entries to allocate, regardless of conntrack-max-per-core (set conntrack-max-per-core=0 to leave the limit as-is).")
152149

153-
fs.DurationVar(&o.config.Conntrack.TCPEstablishedTimeout.Duration, "conntrack-tcp-timeout-established", o.config.Conntrack.TCPEstablishedTimeout.Duration, "Idle timeout for established TCP connections (0 to leave as-is)")
150+
fs.DurationVar(&o.config.Linux.Conntrack.TCPEstablishedTimeout.Duration, "conntrack-tcp-timeout-established", o.config.Linux.Conntrack.TCPEstablishedTimeout.Duration, "Idle timeout for established TCP connections (0 to leave as-is)")
154151
fs.DurationVar(
155-
&o.config.Conntrack.TCPCloseWaitTimeout.Duration, "conntrack-tcp-timeout-close-wait",
156-
o.config.Conntrack.TCPCloseWaitTimeout.Duration,
152+
&o.config.Linux.Conntrack.TCPCloseWaitTimeout.Duration, "conntrack-tcp-timeout-close-wait",
153+
o.config.Linux.Conntrack.TCPCloseWaitTimeout.Duration,
157154
"NAT timeout for TCP connections in the CLOSE_WAIT state")
158-
fs.BoolVar(&o.config.Conntrack.TCPBeLiberal, "conntrack-tcp-be-liberal", o.config.Conntrack.TCPBeLiberal, "Enable liberal mode for tracking TCP packets by setting nf_conntrack_tcp_be_liberal to 1")
159-
fs.DurationVar(&o.config.Conntrack.UDPTimeout.Duration, "conntrack-udp-timeout", o.config.Conntrack.UDPTimeout.Duration, "Idle timeout for UNREPLIED UDP connections (0 to leave as-is)")
160-
fs.DurationVar(&o.config.Conntrack.UDPStreamTimeout.Duration, "conntrack-udp-timeout-stream", o.config.Conntrack.UDPStreamTimeout.Duration, "Idle timeout for ASSURED UDP connections (0 to leave as-is)")
161-
155+
fs.BoolVar(&o.config.Linux.Conntrack.TCPBeLiberal, "conntrack-tcp-be-liberal", o.config.Linux.Conntrack.TCPBeLiberal, "Enable liberal mode for tracking TCP packets by setting nf_conntrack_tcp_be_liberal to 1")
156+
fs.DurationVar(&o.config.Linux.Conntrack.UDPTimeout.Duration, "conntrack-udp-timeout", o.config.Linux.Conntrack.UDPTimeout.Duration, "Idle timeout for UNREPLIED UDP connections (0 to leave as-is)")
157+
fs.DurationVar(&o.config.Linux.Conntrack.UDPStreamTimeout.Duration, "conntrack-udp-timeout-stream", o.config.Linux.Conntrack.UDPStreamTimeout.Duration, "Idle timeout for ASSURED UDP connections (0 to leave as-is)")
162158
fs.DurationVar(&o.config.ConfigSyncPeriod.Duration, "config-sync-period", o.config.ConfigSyncPeriod.Duration, "How often configuration from the apiserver is refreshed. Must be greater than 0.")
163159

164160
fs.Int32Var(&o.healthzPort, "healthz-port", o.healthzPort, "The port to bind the health check server. Use 0 to disable.")

‎cmd/kube-proxy/app/options_test.go‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -196,17 +196,20 @@ nodePortAddresses:
196196
},
197197
ClusterCIDR: tc.clusterCIDR,
198198
ConfigSyncPeriod: metav1.Duration{Duration: 15 * time.Second},
199-
Conntrack: kubeproxyconfig.KubeProxyConntrackConfiguration{
200-
MaxPerCore: ptr.To[int32](2),
201-
Min: ptr.To[int32](1),
202-
TCPCloseWaitTimeout: &metav1.Duration{Duration: 10 * time.Second},
203-
TCPEstablishedTimeout: &metav1.Duration{Duration: 20 * time.Second},
199+
Linux: kubeproxyconfig.KubeProxyLinuxConfiguration{
200+
Conntrack: kubeproxyconfig.KubeProxyConntrackConfiguration{
201+
MaxPerCore: ptr.To[int32](2),
202+
Min: ptr.To[int32](1),
203+
TCPCloseWaitTimeout: &metav1.Duration{Duration: 10 * time.Second},
204+
TCPEstablishedTimeout: &metav1.Duration{Duration: 20 * time.Second},
205+
},
206+
MasqueradeAll: true,
207+
OOMScoreAdj: ptr.To[int32](17),
204208
},
205209
FeatureGates: map[string]bool{},
206210
HealthzBindAddress: tc.healthzBindAddress,
207211
HostnameOverride: "foo",
208212
IPTables: kubeproxyconfig.KubeProxyIPTablesConfiguration{
209-
MasqueradeAll: true,
210213
MasqueradeBit: ptr.To[int32](17),
211214
LocalhostNodePorts: ptr.To(true),
212215
MinSyncPeriod: metav1.Duration{Duration: 10 * time.Second},
@@ -218,14 +221,12 @@ nodePortAddresses:
218221
ExcludeCIDRs: []string{"10.20.30.40/16", "fd00:1::0/64"},
219222
},
220223
NFTables: kubeproxyconfig.KubeProxyNFTablesConfiguration{
221-
MasqueradeAll: true,
222224
MasqueradeBit: ptr.To[int32](18),
223225
MinSyncPeriod: metav1.Duration{Duration: 10 * time.Second},
224226
SyncPeriod: metav1.Duration{Duration: 60 * time.Second},
225227
},
226228
MetricsBindAddress: tc.metricsBindAddress,
227229
Mode: kubeproxyconfig.ProxyMode(tc.mode),
228-
OOMScoreAdj: ptr.To[int32](17),
229230
PortRange: "2-7",
230231
NodePortAddresses: []string{"10.20.30.40/16", "fd00:1::0/64"},
231232
DetectLocalMode: kubeproxyconfig.LocalModeClusterCIDR,

‎cmd/kube-proxy/app/server.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -104,7 +104,7 @@ with the apiserver API to configure the proxy.`,
104104
RunE: func(cmd *cobra.Command, args []string) error {
105105
verflag.PrintAndExitIfRequested()
106106

107-
if err := initForOS(opts.WindowsService); err != nil {
107+
if err := initForOS(opts.config.Windows.RunAsService); err != nil {
108108
return fmt.Errorf("failed os init: %w", err)
109109
}
110110

@@ -493,9 +493,9 @@ func (s *ProxyServer) Run(ctx context.Context) error {
493493

494494
// TODO(vmarmol): Use container config for this.
495495
var oomAdjuster *oom.OOMAdjuster
496-
if s.Config.OOMScoreAdj != nil {
496+
if s.Config.Linux.OOMScoreAdj != nil {
497497
oomAdjuster = oom.NewOOMAdjuster()
498-
if err := oomAdjuster.ApplyOOMScoreAdj(0, int(*s.Config.OOMScoreAdj)); err != nil {
498+
if err := oomAdjuster.ApplyOOMScoreAdj(0, int(*s.Config.Linux.OOMScoreAdj)); err != nil {
499499
logger.V(2).Info("Failed to apply OOMScore", "err", err)
500500
}
501501
}

‎cmd/kube-proxy/app/server_linux.go‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -180,7 +180,7 @@ func (s *ProxyServer) createProxier(ctx context.Context, config *proxyconfigapi.
180180
exec.New(),
181181
config.IPTables.SyncPeriod.Duration,
182182
config.IPTables.MinSyncPeriod.Duration,
183-
config.IPTables.MasqueradeAll,
183+
config.Linux.MasqueradeAll,
184184
*config.IPTables.LocalhostNodePorts,
185185
int(*config.IPTables.MasqueradeBit),
186186
localDetectors,
@@ -204,7 +204,7 @@ func (s *ProxyServer) createProxier(ctx context.Context, config *proxyconfigapi.
204204
exec.New(),
205205
config.IPTables.SyncPeriod.Duration,
206206
config.IPTables.MinSyncPeriod.Duration,
207-
config.IPTables.MasqueradeAll,
207+
config.Linux.MasqueradeAll,
208208
*config.IPTables.LocalhostNodePorts,
209209
int(*config.IPTables.MasqueradeBit),
210210
localDetectors[s.PrimaryIPFamily],
@@ -245,7 +245,7 @@ func (s *ProxyServer) createProxier(ctx context.Context, config *proxyconfigapi.
245245
config.IPVS.TCPTimeout.Duration,
246246
config.IPVS.TCPFinTimeout.Duration,
247247
config.IPVS.UDPTimeout.Duration,
248-
config.IPTables.MasqueradeAll,
248+
config.Linux.MasqueradeAll,
249249
int(*config.IPTables.MasqueradeBit),
250250
localDetectors,
251251
s.Hostname,
@@ -273,7 +273,7 @@ func (s *ProxyServer) createProxier(ctx context.Context, config *proxyconfigapi.
273273
config.IPVS.TCPTimeout.Duration,
274274
config.IPVS.TCPFinTimeout.Duration,
275275
config.IPVS.UDPTimeout.Duration,
276-
config.IPTables.MasqueradeAll,
276+
config.Linux.MasqueradeAll,
277277
int(*config.IPTables.MasqueradeBit),
278278
localDetectors[s.PrimaryIPFamily],
279279
s.Hostname,
@@ -297,7 +297,7 @@ func (s *ProxyServer) createProxier(ctx context.Context, config *proxyconfigapi.
297297
ctx,
298298
config.NFTables.SyncPeriod.Duration,
299299
config.NFTables.MinSyncPeriod.Duration,
300-
config.NFTables.MasqueradeAll,
300+
config.Linux.MasqueradeAll,
301301
int(*config.NFTables.MasqueradeBit),
302302
localDetectors,
303303
s.Hostname,
@@ -315,7 +315,7 @@ func (s *ProxyServer) createProxier(ctx context.Context, config *proxyconfigapi.
315315
s.PrimaryIPFamily,
316316
config.NFTables.SyncPeriod.Duration,
317317
config.NFTables.MinSyncPeriod.Duration,
318-
config.NFTables.MasqueradeAll,
318+
config.Linux.MasqueradeAll,
319319
int(*config.NFTables.MasqueradeBit),
320320
localDetectors[s.PrimaryIPFamily],
321321
s.Hostname,
@@ -338,7 +338,7 @@ func (s *ProxyServer) createProxier(ctx context.Context, config *proxyconfigapi.
338338
func (s *ProxyServer) setupConntrack(ctx context.Context) error {
339339
ct := &realConntracker{}
340340

341-
max, err := getConntrackMax(ctx, s.Config.Conntrack)
341+
max, err := getConntrackMax(ctx, s.Config.Linux.Conntrack)
342342
if err != nil {
343343
return err
344344
}
@@ -361,35 +361,35 @@ func (s *ProxyServer) setupConntrack(ctx context.Context) error {
361361
}
362362
}
363363

364-
if s.Config.Conntrack.TCPEstablishedTimeout != nil && s.Config.Conntrack.TCPEstablishedTimeout.Duration > 0 {
365-
timeout := int(s.Config.Conntrack.TCPEstablishedTimeout.Duration / time.Second)
364+
if s.Config.Linux.Conntrack.TCPEstablishedTimeout != nil && s.Config.Linux.Conntrack.TCPEstablishedTimeout.Duration > 0 {
365+
timeout := int(s.Config.Linux.Conntrack.TCPEstablishedTimeout.Duration / time.Second)
366366
if err := ct.SetTCPEstablishedTimeout(ctx, timeout); err != nil {
367367
return err
368368
}
369369
}
370370

371-
if s.Config.Conntrack.TCPCloseWaitTimeout != nil && s.Config.Conntrack.TCPCloseWaitTimeout.Duration > 0 {
372-
timeout := int(s.Config.Conntrack.TCPCloseWaitTimeout.Duration / time.Second)
371+
if s.Config.Linux.Conntrack.TCPCloseWaitTimeout != nil && s.Config.Linux.Conntrack.TCPCloseWaitTimeout.Duration > 0 {
372+
timeout := int(s.Config.Linux.Conntrack.TCPCloseWaitTimeout.Duration / time.Second)
373373
if err := ct.SetTCPCloseWaitTimeout(ctx, timeout); err != nil {
374374
return err
375375
}
376376
}
377377

378-
if s.Config.Conntrack.TCPBeLiberal {
378+
if s.Config.Linux.Conntrack.TCPBeLiberal {
379379
if err := ct.SetTCPBeLiberal(ctx, 1); err != nil {
380380
return err
381381
}
382382
}
383383

384-
if s.Config.Conntrack.UDPTimeout.Duration > 0 {
385-
timeout := int(s.Config.Conntrack.UDPTimeout.Duration / time.Second)
384+
if s.Config.Linux.Conntrack.UDPTimeout.Duration > 0 {
385+
timeout := int(s.Config.Linux.Conntrack.UDPTimeout.Duration / time.Second)
386386
if err := ct.SetUDPTimeout(ctx, timeout); err != nil {
387387
return err
388388
}
389389
}
390390

391-
if s.Config.Conntrack.UDPStreamTimeout.Duration > 0 {
392-
timeout := int(s.Config.Conntrack.UDPStreamTimeout.Duration / time.Second)
391+
if s.Config.Linux.Conntrack.UDPStreamTimeout.Duration > 0 {
392+
timeout := int(s.Config.Linux.Conntrack.UDPStreamTimeout.Duration / time.Second)
393393
if err := ct.SetUDPStreamTimeout(ctx, timeout); err != nil {
394394
return err
395395
}

‎pkg/generated/openapi/zz_generated.openapi.go‎

Lines changed: 7 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pkg/proxy/apis/config/fuzzer/fuzzer.go‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -35,17 +35,17 @@ func Funcs(codecs runtimeserializer.CodecFactory) []interface{} {
3535
c.FuzzNoCustom(obj)
3636
obj.BindAddress = fmt.Sprintf("%d.%d.%d.%d", c.Intn(256), c.Intn(256), c.Intn(256), c.Intn(256))
3737
obj.ClientConnection.ContentType = c.RandString()
38-
obj.Conntrack.MaxPerCore = ptr.To(c.Int31())
39-
obj.Conntrack.Min = ptr.To(c.Int31())
40-
obj.Conntrack.TCPCloseWaitTimeout = &metav1.Duration{Duration: time.Duration(c.Int63()) * time.Hour}
41-
obj.Conntrack.TCPEstablishedTimeout = &metav1.Duration{Duration: time.Duration(c.Int63()) * time.Hour}
38+
obj.Linux.Conntrack.MaxPerCore = ptr.To(c.Int31())
39+
obj.Linux.Conntrack.Min = ptr.To(c.Int31())
40+
obj.Linux.Conntrack.TCPCloseWaitTimeout = &metav1.Duration{Duration: time.Duration(c.Int63()) * time.Hour}
41+
obj.Linux.Conntrack.TCPEstablishedTimeout = &metav1.Duration{Duration: time.Duration(c.Int63()) * time.Hour}
4242
obj.FeatureGates = map[string]bool{c.RandString(): true}
4343
obj.HealthzBindAddress = fmt.Sprintf("%d.%d.%d.%d:%d", c.Intn(256), c.Intn(256), c.Intn(256), c.Intn(256), c.Intn(65536))
4444
obj.IPTables.MasqueradeBit = ptr.To(c.Int31())
4545
obj.IPTables.LocalhostNodePorts = ptr.To(c.RandBool())
4646
obj.NFTables.MasqueradeBit = ptr.To(c.Int31())
4747
obj.MetricsBindAddress = fmt.Sprintf("%d.%d.%d.%d:%d", c.Intn(256), c.Intn(256), c.Intn(256), c.Intn(256), c.Intn(65536))
48-
obj.OOMScoreAdj = ptr.To(c.Int31())
48+
obj.Linux.OOMScoreAdj = ptr.To(c.Int31())
4949
obj.ClientConnection.ContentType = "bar"
5050
obj.NodePortAddresses = []string{"1.2.3.0/24"}
5151
if obj.Logging.Format == "" {

0 commit comments

Comments
 (0)