Skip to content

Commit 37651f1

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request kubernetes#80368 from danwinship/iptables-checks
iptables feature detection improvements
2 parents 5713c22 + 81cd27a commit 37651f1

File tree

11 files changed

+213
-507
lines changed

11 files changed

+213
-507
lines changed

‎cmd/kube-proxy/app/BUILD‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -171,43 +171,33 @@ go_test(
171171
] + select({
172172
"@io_bazel_rules_go//go/platform:android": [
173173
"//pkg/proxy/ipvs:go_default_library",
174-
"//pkg/util/iptables:go_default_library",
175174
],
176175
"@io_bazel_rules_go//go/platform:darwin": [
177176
"//pkg/proxy/ipvs:go_default_library",
178-
"//pkg/util/iptables:go_default_library",
179177
],
180178
"@io_bazel_rules_go//go/platform:dragonfly": [
181179
"//pkg/proxy/ipvs:go_default_library",
182-
"//pkg/util/iptables:go_default_library",
183180
],
184181
"@io_bazel_rules_go//go/platform:freebsd": [
185182
"//pkg/proxy/ipvs:go_default_library",
186-
"//pkg/util/iptables:go_default_library",
187183
],
188184
"@io_bazel_rules_go//go/platform:linux": [
189185
"//pkg/proxy/ipvs:go_default_library",
190-
"//pkg/util/iptables:go_default_library",
191186
],
192187
"@io_bazel_rules_go//go/platform:nacl": [
193188
"//pkg/proxy/ipvs:go_default_library",
194-
"//pkg/util/iptables:go_default_library",
195189
],
196190
"@io_bazel_rules_go//go/platform:netbsd": [
197191
"//pkg/proxy/ipvs:go_default_library",
198-
"//pkg/util/iptables:go_default_library",
199192
],
200193
"@io_bazel_rules_go//go/platform:openbsd": [
201194
"//pkg/proxy/ipvs:go_default_library",
202-
"//pkg/util/iptables:go_default_library",
203195
],
204196
"@io_bazel_rules_go//go/platform:plan9": [
205197
"//pkg/proxy/ipvs:go_default_library",
206-
"//pkg/util/iptables:go_default_library",
207198
],
208199
"@io_bazel_rules_go//go/platform:solaris": [
209200
"//pkg/proxy/ipvs:go_default_library",
210-
"//pkg/util/iptables:go_default_library",
211201
],
212202
"//conditions:default": [],
213203
}),

‎cmd/kube-proxy/app/server_others.go‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -133,7 +133,7 @@ func newProxyServer(
133133

134134
var proxier proxy.ProxyProvider
135135

136-
proxyMode := getProxyMode(string(config.Mode), iptInterface, kernelHandler, ipsetInterface, iptables.LinuxKernelCompatTester{})
136+
proxyMode := getProxyMode(string(config.Mode), kernelHandler, ipsetInterface, iptables.LinuxKernelCompatTester{})
137137
nodeIP := net.ParseIP(config.BindAddress)
138138
if nodeIP.IsUnspecified() {
139139
nodeIP = utilnode.GetNodeIP(client, hostname)
@@ -238,20 +238,20 @@ func newProxyServer(
238238
}, nil
239239
}
240240

241-
func getProxyMode(proxyMode string, iptver iptables.Versioner, khandle ipvs.KernelHandler, ipsetver ipvs.IPSetVersioner, kcompat iptables.KernelCompatTester) string {
241+
func getProxyMode(proxyMode string, khandle ipvs.KernelHandler, ipsetver ipvs.IPSetVersioner, kcompat iptables.KernelCompatTester) string {
242242
switch proxyMode {
243243
case proxyModeUserspace:
244244
return proxyModeUserspace
245245
case proxyModeIPTables:
246-
return tryIPTablesProxy(iptver, kcompat)
246+
return tryIPTablesProxy(kcompat)
247247
case proxyModeIPVS:
248-
return tryIPVSProxy(iptver, khandle, ipsetver, kcompat)
248+
return tryIPVSProxy(khandle, ipsetver, kcompat)
249249
}
250250
klog.Warningf("Flag proxy-mode=%q unknown, assuming iptables proxy", proxyMode)
251-
return tryIPTablesProxy(iptver, kcompat)
251+
return tryIPTablesProxy(kcompat)
252252
}
253253

254-
func tryIPVSProxy(iptver iptables.Versioner, khandle ipvs.KernelHandler, ipsetver ipvs.IPSetVersioner, kcompat iptables.KernelCompatTester) string {
254+
func tryIPVSProxy(khandle ipvs.KernelHandler, ipsetver ipvs.IPSetVersioner, kcompat iptables.KernelCompatTester) string {
255255
// guaranteed false on error, error only necessary for debugging
256256
// IPVS Proxier relies on ip_vs_* kernel modules and ipset
257257
useIPVSProxy, err := ipvs.CanUseIPVSProxier(khandle, ipsetver)
@@ -265,12 +265,12 @@ func tryIPVSProxy(iptver iptables.Versioner, khandle ipvs.KernelHandler, ipsetve
265265

266266
// Try to fallback to iptables before falling back to userspace
267267
klog.V(1).Infof("Can't use ipvs proxier, trying iptables proxier")
268-
return tryIPTablesProxy(iptver, kcompat)
268+
return tryIPTablesProxy(kcompat)
269269
}
270270

271-
func tryIPTablesProxy(iptver iptables.Versioner, kcompat iptables.KernelCompatTester) string {
271+
func tryIPTablesProxy(kcompat iptables.KernelCompatTester) string {
272272
// guaranteed false on error, error only necessary for debugging
273-
useIPTablesProxy, err := iptables.CanUseIPTablesProxier(iptver, kcompat)
273+
useIPTablesProxy, err := iptables.CanUseIPTablesProxier(kcompat)
274274
if err != nil {
275275
utilruntime.HandleError(fmt.Errorf("can't determine whether to use iptables proxy, using userspace proxier: %v", err))
276276
return proxyModeUserspace

‎cmd/kube-proxy/app/server_others_test.go‎

Lines changed: 76 additions & 100 deletions
Original file line numberDiff line numberDiff line change
@@ -23,68 +23,75 @@ import (
2323
"testing"
2424

2525
"k8s.io/kubernetes/pkg/proxy/ipvs"
26-
"k8s.io/kubernetes/pkg/util/iptables"
2726
)
2827

28+
type fakeIPSetVersioner struct {
29+
version string // what to return
30+
err error // what to return
31+
}
32+
33+
func (fake *fakeIPSetVersioner) GetVersion() (string, error) {
34+
return fake.version, fake.err
35+
}
36+
37+
type fakeKernelCompatTester struct {
38+
ok bool
39+
}
40+
41+
func (fake *fakeKernelCompatTester) IsCompatible() error {
42+
if !fake.ok {
43+
return fmt.Errorf("error")
44+
}
45+
return nil
46+
}
47+
48+
// fakeKernelHandler implements KernelHandler.
49+
type fakeKernelHandler struct {
50+
modules []string
51+
kernelVersion string
52+
}
53+
54+
func (fake *fakeKernelHandler) GetModules() ([]string, error) {
55+
return fake.modules, nil
56+
}
57+
58+
func (fake *fakeKernelHandler) GetKernelVersion() (string, error) {
59+
return fake.kernelVersion, nil
60+
}
61+
2962
func Test_getProxyMode(t *testing.T) {
3063
var cases = []struct {
31-
flag string
32-
iptablesVersion string
33-
ipsetVersion string
34-
kmods []string
35-
kernelVersion string
36-
kernelCompat bool
37-
iptablesError error
38-
ipsetError error
39-
expected string
64+
flag string
65+
ipsetVersion string
66+
kmods []string
67+
kernelVersion string
68+
kernelCompat bool
69+
ipsetError error
70+
expected string
4071
}{
4172
{ // flag says userspace
4273
flag: "userspace",
4374
expected: proxyModeUserspace,
4475
},
45-
{ // flag says iptables, error detecting version
46-
flag: "iptables",
47-
iptablesError: fmt.Errorf("flag says iptables, error detecting version"),
48-
expected: proxyModeUserspace,
49-
},
50-
{ // flag says iptables, version too low
51-
flag: "iptables",
52-
iptablesVersion: "0.0.0",
53-
expected: proxyModeUserspace,
76+
{ // flag says iptables, kernel not compatible
77+
flag: "iptables",
78+
kernelCompat: false,
79+
expected: proxyModeUserspace,
5480
},
55-
{ // flag says iptables, version ok, kernel not compatible
56-
flag: "iptables",
57-
iptablesVersion: iptables.MinCheckVersion,
58-
kernelCompat: false,
59-
expected: proxyModeUserspace,
81+
{ // flag says iptables, kernel is compatible
82+
flag: "iptables",
83+
kernelCompat: true,
84+
expected: proxyModeIPTables,
6085
},
61-
{ // flag says iptables, version ok, kernel is compatible
62-
flag: "iptables",
63-
iptablesVersion: iptables.MinCheckVersion,
64-
kernelCompat: true,
65-
expected: proxyModeIPTables,
86+
{ // detect, kernel not compatible
87+
flag: "",
88+
kernelCompat: false,
89+
expected: proxyModeUserspace,
6690
},
67-
{ // detect, error
68-
flag: "",
69-
iptablesError: fmt.Errorf("oops"),
70-
expected: proxyModeUserspace,
71-
},
72-
{ // detect, version too low
73-
flag: "",
74-
iptablesVersion: "0.0.0",
75-
expected: proxyModeUserspace,
76-
},
77-
{ // detect, version ok, kernel not compatible
78-
flag: "",
79-
iptablesVersion: iptables.MinCheckVersion,
80-
kernelCompat: false,
81-
expected: proxyModeUserspace,
82-
},
83-
{ // detect, version ok, kernel is compatible
84-
flag: "",
85-
iptablesVersion: iptables.MinCheckVersion,
86-
kernelCompat: true,
87-
expected: proxyModeIPTables,
91+
{ // detect, kernel is compatible
92+
flag: "",
93+
kernelCompat: true,
94+
expected: proxyModeIPTables,
8895
},
8996
{ // flag says ipvs, ipset version ok, kernel modules installed for linux kernel before 4.19
9097
flag: "ipvs",
@@ -101,69 +108,38 @@ func Test_getProxyMode(t *testing.T) {
101108
expected: proxyModeIPVS,
102109
},
103110
{ // flag says ipvs, ipset version too low, fallback on iptables mode
104-
flag: "ipvs",
105-
kmods: []string{"ip_vs", "ip_vs_rr", "ip_vs_wrr", "ip_vs_sh", "nf_conntrack"},
106-
kernelVersion: "4.19",
107-
ipsetVersion: "0.0",
108-
iptablesVersion: iptables.MinCheckVersion,
109-
kernelCompat: true,
110-
expected: proxyModeIPTables,
111+
flag: "ipvs",
112+
kmods: []string{"ip_vs", "ip_vs_rr", "ip_vs_wrr", "ip_vs_sh", "nf_conntrack"},
113+
kernelVersion: "4.19",
114+
ipsetVersion: "0.0",
115+
kernelCompat: true,
116+
expected: proxyModeIPTables,
111117
},
112118
{ // flag says ipvs, bad ipset version, fallback on iptables mode
113-
flag: "ipvs",
114-
kmods: []string{"ip_vs", "ip_vs_rr", "ip_vs_wrr", "ip_vs_sh", "nf_conntrack"},
115-
kernelVersion: "4.19",
116-
ipsetVersion: "a.b.c",
117-
iptablesVersion: iptables.MinCheckVersion,
118-
kernelCompat: true,
119-
expected: proxyModeIPTables,
119+
flag: "ipvs",
120+
kmods: []string{"ip_vs", "ip_vs_rr", "ip_vs_wrr", "ip_vs_sh", "nf_conntrack"},
121+
kernelVersion: "4.19",
122+
ipsetVersion: "a.b.c",
123+
kernelCompat: true,
124+
expected: proxyModeIPTables,
120125
},
121126
{ // flag says ipvs, required kernel modules are not installed, fallback on iptables mode
122-
flag: "ipvs",
123-
kmods: []string{"foo", "bar", "baz"},
124-
kernelVersion: "4.19",
125-
ipsetVersion: ipvs.MinIPSetCheckVersion,
126-
iptablesVersion: iptables.MinCheckVersion,
127-
kernelCompat: true,
128-
expected: proxyModeIPTables,
129-
},
130-
{ // flag says ipvs, required kernel modules are not installed, iptables version too old, fallback on userspace mode
131-
flag: "ipvs",
132-
kmods: []string{"foo", "bar", "baz"},
133-
kernelVersion: "4.19",
134-
ipsetVersion: ipvs.MinIPSetCheckVersion,
135-
iptablesVersion: "0.0.0",
136-
kernelCompat: true,
137-
expected: proxyModeUserspace,
138-
},
139-
{ // flag says ipvs, required kernel modules are not installed, iptables version too old, fallback on userspace mode
140-
flag: "ipvs",
141-
kmods: []string{"foo", "bar", "baz"},
142-
kernelVersion: "4.19",
143-
ipsetVersion: ipvs.MinIPSetCheckVersion,
144-
iptablesVersion: "0.0.0",
145-
kernelCompat: true,
146-
expected: proxyModeUserspace,
147-
},
148-
{ // flag says ipvs, ipset version too low, iptables version too old, kernel not compatible, fallback on userspace mode
149-
flag: "ipvs",
150-
kmods: []string{"ip_vs", "ip_vs_rr", "ip_vs_wrr", "ip_vs_sh", "nf_conntrack"},
151-
kernelVersion: "4.19",
152-
ipsetVersion: "0.0",
153-
iptablesVersion: iptables.MinCheckVersion,
154-
kernelCompat: false,
155-
expected: proxyModeUserspace,
127+
flag: "ipvs",
128+
kmods: []string{"foo", "bar", "baz"},
129+
kernelVersion: "4.19",
130+
ipsetVersion: ipvs.MinIPSetCheckVersion,
131+
kernelCompat: true,
132+
expected: proxyModeIPTables,
156133
},
157134
}
158135
for i, c := range cases {
159-
versioner := &fakeIPTablesVersioner{c.iptablesVersion, c.iptablesError}
160136
kcompater := &fakeKernelCompatTester{c.kernelCompat}
161137
ipsetver := &fakeIPSetVersioner{c.ipsetVersion, c.ipsetError}
162138
khandler := &fakeKernelHandler{
163139
modules: c.kmods,
164140
kernelVersion: c.kernelVersion,
165141
}
166-
r := getProxyMode(c.flag, versioner, khandler, ipsetver, kcompater)
142+
r := getProxyMode(c.flag, khandler, ipsetver, kcompater)
167143
if r != c.expected {
168144
t.Errorf("Case[%d] Expected %q, got %q", i, c.expected, r)
169145
}

‎cmd/kube-proxy/app/server_test.go‎

Lines changed: 0 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -38,53 +38,6 @@ import (
3838
utilpointer "k8s.io/utils/pointer"
3939
)
4040

41-
type fakeIPTablesVersioner struct {
42-
version string // what to return
43-
err error // what to return
44-
}
45-
46-
func (fake *fakeIPTablesVersioner) GetVersion() (string, error) {
47-
return fake.version, fake.err
48-
}
49-
50-
func (fake *fakeIPTablesVersioner) IsCompatible() error {
51-
return fake.err
52-
}
53-
54-
type fakeIPSetVersioner struct {
55-
version string // what to return
56-
err error // what to return
57-
}
58-
59-
func (fake *fakeIPSetVersioner) GetVersion() (string, error) {
60-
return fake.version, fake.err
61-
}
62-
63-
type fakeKernelCompatTester struct {
64-
ok bool
65-
}
66-
67-
func (fake *fakeKernelCompatTester) IsCompatible() error {
68-
if !fake.ok {
69-
return fmt.Errorf("error")
70-
}
71-
return nil
72-
}
73-
74-
// fakeKernelHandler implements KernelHandler.
75-
type fakeKernelHandler struct {
76-
modules []string
77-
kernelVersion string
78-
}
79-
80-
func (fake *fakeKernelHandler) GetModules() ([]string, error) {
81-
return fake.modules, nil
82-
}
83-
84-
func (fake *fakeKernelHandler) GetKernelVersion() (string, error) {
85-
return fake.kernelVersion, nil
86-
}
87-
8841
// This test verifies that NewProxyServer does not crash when CleanupAndExit is true.
8942
func TestProxyServerWithCleanupAndExit(t *testing.T) {
9043
// Each bind address below is a separate test case

‎pkg/kubelet/dockershim/network/hostport/fake_iptables.go‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -52,10 +52,6 @@ func NewFakeIPTables() *fakeIPTables {
5252
}
5353
}
5454

55-
func (f *fakeIPTables) GetVersion() (string, error) {
56-
return "1.4.21", nil
57-
}
58-
5955
func (f *fakeIPTables) getTable(tableName utiliptables.Table) (*fakeTable, error) {
6056
table, ok := f.tables[string(tableName)]
6157
if !ok {

‎pkg/proxy/iptables/BUILD‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,6 @@ go_library(
2121
"//pkg/util/sysctl:go_default_library",
2222
"//staging/src/k8s.io/api/core/v1:go_default_library",
2323
"//staging/src/k8s.io/apimachinery/pkg/types:go_default_library",
24-
"//staging/src/k8s.io/apimachinery/pkg/util/version:go_default_library",
2524
"//staging/src/k8s.io/apimachinery/pkg/util/wait:go_default_library",
2625
"//staging/src/k8s.io/client-go/tools/record:go_default_library",
2726
"//vendor/k8s.io/klog:go_default_library",

0 commit comments

Comments
 (0)