Skip to content

Commit 9684c13

Browse files
yliaogyliaog
committed
switched to default non-masquerade destination ranges
1 parent 3c082d5 commit 9684c13

File tree

1 file changed

+32
-56
lines changed

1 file changed

+32
-56
lines changed

‎cluster/gce/windows/k8s-node-setup.psm1‎

Lines changed: 32 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -445,34 +445,6 @@ function ConvertTo_MaskLength
445445
# is the subnet that VM internal IPs are allocated from.
446446
#
447447
# This function will fail if Add_InitialHnsNetwork() has not been called first.
448-
function Get_MgmtSubnet {
449-
$net_adapter = Get_MgmtNetAdapter
450-
451-
# TODO(pjh): applying the primary interface's subnet mask to its IP address
452-
# *should* give us the GCE network subnet that VM IP addresses are being
453-
# allocated from... however it might be more accurate or straightforward to
454-
# just fetch the IP address range for the VPC subnet that the kube-up script
455-
# creates (kubernetes-subnet-default).
456-
$addr = (Get-NetIPAddress `
457-
-InterfaceAlias ${net_adapter}.ifAlias `
458-
-AddressFamily IPv4).IPAddress
459-
# Get the adapter's mask from the registry rather than WMI or some other
460-
# approach: this is compatible with Windows' forthcoming LWVNICs (lightweight
461-
# VNICs).
462-
# https://github.com/kubernetes-sigs/sig-windows-tools/pull/16/commits/c5b5c67d5da6c23ad870cb16146eaa58131caf29
463-
$adapter_registry = Get-Item `
464-
-Path ("HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\" +
465-
"Parameters\Interfaces\$($net_adapter.InterfaceGuid)")
466-
# In this command the value name is 'DhcpSubnetMask' for current network
467-
# interfaces but could be different for "LWVNIC" interfaces.
468-
$mask = ($adapter_registry.GetValueNames() -like "*SubnetMask" |
469-
% { $adapter_registry.GetValue($_) })
470-
$mgmt_subnet = `
471-
(ConvertTo_DecimalIP ${addr}) -band (ConvertTo_DecimalIP ${mask})
472-
$mgmt_subnet = ConvertTo_DottedDecimalIP ${mgmt_subnet}
473-
return "${mgmt_subnet}/$(ConvertTo_MaskLength $mask)"
474-
}
475-
476448
# Returns a network adapter object for the "management" interface via which the
477449
# Windows pods+kubelet will communicate with the rest of the Kubernetes cluster.
478450
#
@@ -984,7 +956,6 @@ function Install_Cni_Binaries {
984956
# Required ${kube_env} keys:
985957
# DNS_SERVER_IP
986958
# DNS_DOMAIN
987-
# CLUSTER_IP_RANGE
988959
# SERVICE_CLUSTER_IP_RANGE
989960
function Configure_Dockerd_CniNetworking {
990961
$l2bridge_conf = "${env:CNI_CONFIG_DIR}\l2bridge.conf"
@@ -994,24 +965,20 @@ function Configure_Dockerd_CniNetworking {
994965

995966
$mgmt_ip = (Get_MgmtNetAdapter |
996967
Get-NetIPAddress -AddressFamily IPv4).IPAddress
997-
$mgmt_subnet = Get_MgmtSubnet
998-
Log-Output ("using mgmt IP ${mgmt_ip} and mgmt subnet ${mgmt_subnet} for " +
999-
"CNI config")
1000968

1001969
$cidr_range_start = Get_PodIP_Range_Start(${env:POD_CIDR})
1002970

1003971
# Explanation of the CNI config values:
1004-
# CLUSTER_CIDR: the cluster CIDR from which pod CIDRs are allocated.
1005972
# POD_CIDR: the pod CIDR assigned to this node.
1006973
# CIDR_RANGE_START: start of the pod CIDR range.
1007-
# MGMT_SUBNET: the subnet on which the Windows pods + kubelet will
1008-
# communicate with the rest of the cluster without NAT (i.e. the subnet
1009-
# that VM internal IPs are allocated from).
1010974
# MGMT_IP: the IP address assigned to the node's primary network interface
1011975
# (i.e. the internal IP of the GCE VM).
1012976
# SERVICE_CIDR: the CIDR used for kubernetes services.
1013977
# DNS_SERVER_IP: the cluster's DNS server IP address.
1014978
# DNS_DOMAIN: the cluster's DNS domain, e.g. "cluster.local".
979+
#
980+
# OutBoundNAT ExceptionList: No SNAT for CIDRs in the list, the same as default GKE non-masquerade destination ranges listed at https://cloud.google.com/kubernetes-engine/docs/how-to/ip-masquerade-agent#default-non-masq-dests
981+
1015982
New-Item -Force -ItemType file ${l2bridge_conf} | Out-Null
1016983
Set-Content ${l2bridge_conf} `
1017984
'{
@@ -1041,9 +1008,18 @@ function Configure_Dockerd_CniNetworking {
10411008
"Value": {
10421009
"Type": "OutBoundNAT",
10431010
"ExceptionList": [
1044-
"CLUSTER_CIDR",
1045-
"SERVICE_CIDR",
1046-
"MGMT_SUBNET"
1011+
"169.254.0.0/16",
1012+
"10.0.0.0/8",
1013+
"172.16.0.0/12",
1014+
"192.168.0.0/16",
1015+
"100.64.0.0/10",
1016+
"192.0.0.0/24",
1017+
"192.0.2.0/24",
1018+
"192.88.99.0/24",
1019+
"198.18.0.0/15",
1020+
"198.51.100.0/24",
1021+
"203.0.113.0/24",
1022+
"240.0.0.0/4"
10471023
]
10481024
}
10491025
},
@@ -1069,9 +1045,7 @@ function Configure_Dockerd_CniNetworking {
10691045
replace('DNS_SERVER_IP', ${kube_env}['DNS_SERVER_IP']).`
10701046
replace('DNS_DOMAIN', ${kube_env}['DNS_DOMAIN']).`
10711047
replace('MGMT_IP', ${mgmt_ip}).`
1072-
replace('CLUSTER_CIDR', ${kube_env}['CLUSTER_IP_RANGE']).`
1073-
replace('SERVICE_CIDR', ${kube_env}['SERVICE_CLUSTER_IP_RANGE']).`
1074-
replace('MGMT_SUBNET', ${mgmt_subnet})
1048+
replace('SERVICE_CIDR', ${kube_env}['SERVICE_CLUSTER_IP_RANGE'])
10751049

10761050
Log-Output "CNI config:`n$(Get-Content -Raw ${l2bridge_conf})"
10771051
}
@@ -1338,7 +1312,6 @@ function Configure_Dockerd {
13381312
# Required ${kube_env} keys:
13391313
# DNS_SERVER_IP
13401314
# DNS_DOMAIN
1341-
# CLUSTER_IP_RANGE
13421315
# SERVICE_CLUSTER_IP_RANGE
13431316
function Configure_Containerd_CniNetworking {
13441317
$l2bridge_conf = "${env:CNI_CONFIG_DIR}\l2bridge.conf"
@@ -1348,24 +1321,20 @@ function Configure_Containerd_CniNetworking {
13481321

13491322
$mgmt_ip = (Get_MgmtNetAdapter |
13501323
Get-NetIPAddress -AddressFamily IPv4).IPAddress
1351-
$mgmt_subnet = Get_MgmtSubnet
1352-
Log-Output ("using mgmt IP ${mgmt_ip} and mgmt subnet ${mgmt_subnet} for " +
1353-
"CNI config")
13541324

13551325
$pod_gateway = Get_Endpoint_Gateway_From_CIDR(${env:POD_CIDR})
13561326

13571327
# Explanation of the CNI config values:
1358-
# CLUSTER_CIDR: the cluster CIDR from which pod CIDRs are allocated.
13591328
# POD_CIDR: the pod CIDR assigned to this node.
13601329
# POD_GATEWAY: the gateway IP.
1361-
# MGMT_SUBNET: the subnet on which the Windows pods + kubelet will
1362-
# communicate with the rest of the cluster without NAT (i.e. the subnet
1363-
# that VM internal IPs are allocated from).
13641330
# MGMT_IP: the IP address assigned to the node's primary network interface
13651331
# (i.e. the internal IP of the GCE VM).
13661332
# SERVICE_CIDR: the CIDR used for kubernetes services.
13671333
# DNS_SERVER_IP: the cluster's DNS server IP address.
13681334
# DNS_DOMAIN: the cluster's DNS domain, e.g. "cluster.local".
1335+
#
1336+
# OutBoundNAT ExceptionList: No SNAT for CIDRs in the list, the same as default GKE non-masquerade destination ranges listed at https://cloud.google.com/kubernetes-engine/docs/how-to/ip-masquerade-agent#default-non-masq-dests
1337+
13691338
New-Item -Force -ItemType file ${l2bridge_conf} | Out-Null
13701339
Set-Content ${l2bridge_conf} `
13711340
'{
@@ -1400,9 +1369,18 @@ function Configure_Containerd_CniNetworking {
14001369
"Type": "OutBoundNAT",
14011370
"Settings": {
14021371
"Exceptions": [
1403-
"CLUSTER_CIDR",
1404-
"SERVICE_CIDR",
1405-
"MGMT_SUBNET"
1372+
"169.254.0.0/16",
1373+
"10.0.0.0/8",
1374+
"172.16.0.0/12",
1375+
"192.168.0.0/16",
1376+
"100.64.0.0/10",
1377+
"192.0.0.0/24",
1378+
"192.0.2.0/24",
1379+
"192.88.99.0/24",
1380+
"198.18.0.0/15",
1381+
"198.51.100.0/24",
1382+
"203.0.113.0/24",
1383+
"240.0.0.0/4"
14061384
]
14071385
}
14081386
}
@@ -1433,9 +1411,7 @@ function Configure_Containerd_CniNetworking {
14331411
replace('DNS_SERVER_IP', ${kube_env}['DNS_SERVER_IP']).`
14341412
replace('DNS_DOMAIN', ${kube_env}['DNS_DOMAIN']).`
14351413
replace('MGMT_IP', ${mgmt_ip}).`
1436-
replace('CLUSTER_CIDR', ${kube_env}['CLUSTER_IP_RANGE']).`
1437-
replace('SERVICE_CIDR', ${kube_env}['SERVICE_CLUSTER_IP_RANGE']).`
1438-
replace('MGMT_SUBNET', ${mgmt_subnet})
1414+
replace('SERVICE_CIDR', ${kube_env}['SERVICE_CLUSTER_IP_RANGE'])
14391415

14401416
Log-Output "containerd CNI config:`n$(Get-Content -Raw ${l2bridge_conf})"
14411417
}

0 commit comments

Comments
 (0)