masquerade and route forwarded packets from host's loopback to the pod #2027
Conversation
Is this already implemented on CNI? |
|
No, otherwise I would've made use of that. |
steveej
changed the title
|
|
||
| defaultHostIPstring := defaultHostIP.String() | ||
| switch { | ||
| case strings.Contains(defaultHostIPstring, "."): |
There was a problem hiding this comment.
Can it use case net.ParseIP(defaultHostIPstring).To4() != nil?
There was a problem hiding this comment.
I will try that, thanks!
There was a problem hiding this comment.
Unfortunately .ToIPv16() is a false positive in this case. I'm digging for the origin but I'm leaving the code as is (working).
2016/01/28 17:41:39 unexpected IPv6 Address returned for default host interface: "172.16.28.1"
Failed to setup network: unexpected IPv6 Address returned for default host interface: "172.16.28.1"
FAIL
exit status 1
FAIL github.com/coreos/rkt/tests 3.150s
There was a problem hiding this comment.
A TODO to follow up would be nice.
There was a problem hiding this comment.
I'd prefer to put it in an issue since we need a follow-up for this already. Are you okay with that?
There was a problem hiding this comment.
Sure
Stefan Junker notifications@github.com schrieb am Fr., 29. Jan. 2016
15:37:
In networking/networking.go
#2027 (comment):@@ -116,6 +125,54 @@ func Setup(podRoot string, podID types.UUID, fps []ForwardedPort, netList common
return &n, nil
}+// enableDefaultLocalnetRouting enables the route_localnet attribute on the supposedly default network interface.
+// This allows to setup a loopback NAT to access port forwardings to Pods on the host with the localhost address.
+func (n *Networking) enableDefaultLocalnetRouting() error {
- routeLocalnetFormat := ""
- defaultHostIP, err := n.GetDefaultHostIP()
- if err != nil {
return err- }
- defaultHostIPstring := defaultHostIP.String()
- switch {
- case strings.Contains(defaultHostIPstring, "."):
I'd prefer to put it in an issue since we need a follow-up for this
already. Are you okay with that?—
Reply to this email directly or view it on GitHub
https://github.com/coreos/rkt/pull/2027/files#r51266774.
|
@steveej could you document the potential scaling issue (?) with this we discussed in the sync? |
|
@jonboulle yes, I'll create an issue as soon as this gets merged! |
|
|
||
| if len(resultInterfaces) == 0 { | ||
| return nil, fmt.Errorf("no interface found with IP %q", ifaceIP) | ||
| } else { |
There was a problem hiding this comment.
Thanks, such a bad habit.
|
style nits, but LGTM wenn es funktioniert. |
| resultInterfaces := make([]net.Interface, 0) | ||
|
|
||
| for _, iface := range ifaces { | ||
| if iface.Flags&net.FlagLoopback == 0 { |
There was a problem hiding this comment.
if != 0 continue maybe nicer..
There was a problem hiding this comment.
Indeed, makes it a little easier to read
|
LGTM modulo previous requests for (two?) follow ups |
| @@ -183,6 +243,43 @@ func (n *Networking) GetDefaultHostIP() (net.IP, error) { | |||
| return n.nets[len(n.nets)-1].runtime.HostIP, nil | |||
| } | |||
|
|
|||
| // GetIfacesByIP searches for and returns the interfaces with the given IP | |||
| // Disregards the subnet mask since not every net.IP object contains on | |||
| // On success it will return the list of found interfaces | |||
|
LGTM after fixing a couple of nits. |
| }{ | ||
| {"POSTROUTING", chainRuleSNAT}, // traffic originating on this host | ||
| {"PREROUTING", chainRuleDNAT}, // outside traffic hitting this host | ||
| {"OUTPUT", chainRuleDNAT}, // traffic originating on this host |
There was a problem hiding this comment.
s/on this host/from this host? (x2)
|
|
||
| ga.Wait() | ||
| } | ||
| f("172.16.28.1", "--net=default", true) |
There was a problem hiding this comment.
Where does this IP come from? 172.16.28.1
I guess it is the first IP available in the default network. What happens if another rkt pod is running with this IP while the tests are being run?
There was a problem hiding this comment.
This is the IP of the host in the default network, it's not affected by other rkt instances.
There was a problem hiding this comment.
Oh, right. Thanks for the explanation. You can use a comment to say that, or a constant if it already exists.
This function takes an argument that allows to exclude ports from the search range.
masquerade and route forwarded packets from host's loopback to the pod
|
sick On Mon, Feb 1, 2016 at 6:30 PM, Iago López Galeiras <
|
This implementation is not ideal because it uses heuristics to find interface names.
The host's veth interface has to be found with the only thing that's known, it's IP address. The names are randomly generated by CNI and are not returned in the CNI result. Further, due to the way the PTP plugin works, multiple veth interfaces have the same address, so they are all candidates for needing route_localnet enabled.
Fixes #1256.
Follow-Up: