Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

daemon: Fix fallback to iptables-based masquerading #12081

Merged
merged 2 commits into from
Jun 16, 2020
Merged

daemon: Fix fallback to iptables-based masquerading #12081

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0ed8546
daemon: Fix fallback to iptables-based masquerading
brb Jun 15, 2020
4c61216
daemon: Fallback to iptables-based MASQ if egress iface is specified
brb Jun 16, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
15 changes: 8 additions & 7 deletions daemon/cmd/daemon.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -437,14 +437,15 @@ func NewDaemon(ctx context.Context, dp datapath.Datapath) (*Daemon, *endpointRes
}
// BPF masquerade depends on BPF NodePort, so the following checks should
// happen after invoking initKubeProxyReplacementOptions().
if option.Config.Masquerade && option.Config.EnableBPFMasquerade &&
!option.Config.EnableNodePort {
// ipt.InstallRules() (called by Reinitialize()) happens later than
// this statement, so it's OK to fallback to iptables-based MASQ.
log.Warnf("BPF masquerade requires NodePort (--%s=\"true\"). "+
"Falling back to iptables-based masquerading.", option.EnableNodePort)
option.Config.EnableBPFMasquerade = false
}
if option.Config.Masquerade && option.Config.EnableBPFMasquerade {
if !option.Config.EnableNodePort {
// ipt.InstallRules() (called by Reinitialize()) happens later than
// this statement, so it's OK to fallback to iptables-based MASQ.
log.Warnf("BPF masquerade requires NodePort (--%s=\"true\"). "+
"Falling back to iptables-based masquerading.", option.EnableNodePort)
option.Config.EnableBPFMasquerade = false
}
// TODO(brb) nodeport + ipvlan constraints will be lifted once the SNAT BPF code has been refactored
if option.Config.DatapathMode == datapathOption.DatapathModeIpvlan {
log.Fatalf("BPF masquerade works only in veth mode (--%s=\"%s\"", option.DatapathMode, datapathOption.DatapathModeVeth)
Expand Down