Use iptables-wrapper in Antrea container #3276
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
This was tested on Ubuntu 20.04 (default is "legacy") and Ubuntu 21.04 (default is "nft"). |
antoninbas
added
action/backport
Codecov Report
@@ Coverage Diff @@
## main #3276 +/- ##
==========================================
+ Coverage 59.04% 60.08% +1.04%
==========================================
Files 331 331
Lines 28420 28420
==========================================
+ Hits 16781 17077 +296
+ Misses 9798 9478 -320
- Partials 1841 1865 +24
Flags with carried forward coverage won't be shown. Click here to find out more.
|
tnqn
reviewed
Feb 8, 2022
build/images/base/Dockerfile
Outdated
| rm -rf /var/lib/apt/lists/* && \ | ||
| chmod +x /iptables-wrapper-installer.sh && \ | ||
| /iptables-wrapper-installer.sh && \ | ||
| rm -rf /iptables-wrapper-installer.sh |
There was a problem hiding this comment.
I saw the installer has the following:
# Cleanup
rm -f "$0"
There was a problem hiding this comment.
thanks, I removed the rm command
antoninbas
force-pushed
the
use-iptables-wrapper-in-antrea-container
branch
from
377b766
to
4754d44
Compare
tnqn
previously approved these changes
Feb 9, 2022
build/images/base/Dockerfile
Outdated
| && rm -rf /var/lib/apt/lists/* | ||
| # See https://github.com/kubernetes-sigs/iptables-wrappers | ||
| # /iptables-wrapper-installer.sh will have permissions of 600. | ||
| # --chmod=644 doesn't work with older versions of Docker and requires DOCKER_BUILDKIT=1, so we use |
There was a problem hiding this comment.
I think I meant 700, just need the owner to be able to execute the script. Let me fix it.
Instead of iptables directly. Antrea uses a Ubuntu 20.04 base container image, for which the default iptables mode is "legacy". This may not match the iptables mode for the Node OS, which in turn can create issues: * Other K8s components (kubelet, kube-proxy) will create rules using the default iptables mode for the Node. Assumptions about evaluation order between these rules and the Antrea rules may break. * The required kernel module for the "legacy" mode (ip_tables) may not be available on the Node. The iptables-wrapper is meant to address these issues: https://github.com/kubernetes-sigs/iptables-wrappers. We install it in the Antrea container image. The first time Antrea invokes iptables, the wrapper will determine the underlying iptables mode (for the Node OS) and adjust the iptables symlinks in the container. Fixes antrea-io#3243 Fixes antrea-io#3274 Signed-off-by: Antonin Bas <abas@vmware.com>
antoninbas
force-pushed
the
use-iptables-wrapper-in-antrea-container
branch
from
4754d44
to
c9ca8d6
Compare
tnqn
approved these changes
Feb 10, 2022
|
/test-all |
|
/test-e2e |
|
/test-e2e |
|
/test-e2e unrelated failure: #3307. Maybe we could skip it if it still fails. |
|
Another unrelated failure: I'll merge now |
This was referenced Feb 11, 2022
yanjunz97
pushed a commit
to yanjunz97/antrea
that referenced
this pull request
Feb 14, 2022
Instead of iptables directly. Antrea uses a Ubuntu 20.04 base container image, for which the default iptables mode is "legacy". This may not match the iptables mode for the Node OS, which in turn can create issues: * Other K8s components (kubelet, kube-proxy) will create rules using the default iptables mode for the Node. Assumptions about evaluation order between these rules and the Antrea rules may break. * The required kernel module for the "legacy" mode (ip_tables) may not be available on the Node. The iptables-wrapper is meant to address these issues: https://github.com/kubernetes-sigs/iptables-wrappers. We install it in the Antrea container image. The first time Antrea invokes iptables, the wrapper will determine the underlying iptables mode (for the Node OS) and adjust the iptables symlinks in the container. Fixes antrea-io#3243 Fixes antrea-io#3274 Signed-off-by: Antonin Bas <abas@vmware.com>
bangqipropel
pushed a commit
to bangqipropel/antrea
that referenced
this pull request
Mar 2, 2022
Instead of iptables directly. Antrea uses a Ubuntu 20.04 base container image, for which the default iptables mode is "legacy". This may not match the iptables mode for the Node OS, which in turn can create issues: * Other K8s components (kubelet, kube-proxy) will create rules using the default iptables mode for the Node. Assumptions about evaluation order between these rules and the Antrea rules may break. * The required kernel module for the "legacy" mode (ip_tables) may not be available on the Node. The iptables-wrapper is meant to address these issues: https://github.com/kubernetes-sigs/iptables-wrappers. We install it in the Antrea container image. The first time Antrea invokes iptables, the wrapper will determine the underlying iptables mode (for the Node OS) and adjust the iptables symlinks in the container. Fixes antrea-io#3243 Fixes antrea-io#3274 Signed-off-by: Antonin Bas <abas@vmware.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Instead of iptables directly.
Antrea uses a Ubuntu 20.04 base container image, for which the default iptables
mode is "legacy". This may not match the iptables mode for the Node OS, which in
turn can create issues:
default iptables mode for the Node. Assumptions about evaluation order
between these rules and the Antrea rules may break.
available on the Node.
The iptables-wrapper is meant to address these issues:
https://github.com/kubernetes-sigs/iptables-wrappers. We install it in the
Antrea container image. The first time Antrea invokes iptables, the wrapper will
determine the underlying iptables mode (for the Node OS) and adjust the iptables
symlinks in the container.
Fixes #3243
Fixes #3274
Signed-off-by: Antonin Bas abas@vmware.com