Set iptables rules to restrict user access to ports other than the load balancer service port through the VIP

[yaocw2020]

Set IPTables rules to Restricts user access to ports other than the load balancer service port through the VIP. Moreover, considering DHCP and any other protocol port requirement, those ports should be reachable.

By the way, we also modify the watch_services.go to support changing service load balancer IP.

IPTables Rules example:

-A INPUT -d 172.19.104.147/32 -p tcp -m tcp --dport 80 -m comment --comment "default/primary kube-vip load balancer IP" -j ACCEPT
-A INPUT -d 172.19.104.147/32 -p udp -m udp --dport 68 -m comment --comment "default/primary kube-vip load balancer IP" -j ACCEPT
-A INPUT -d 172.19.104.147/32 -m comment --comment "default/primary kube-vip load balancer IP" -j DROP

Related issue: #479

[yaocw2020]

The CI error is introduced by other PRs. We may need to submit a new PR to solve it.

[thebsdbox]

There is already a PR to fix this although I was going to merge it into the v1 branch.

[thebsdbox]

Is this behind a flag? We currently have two releases (kube-vip and kube-vip-iptables), changing this to default behaviour will break the default image behaviour.

[yaocw2020]

Is this behind a flag? We currently have two releases (kube-vip and kube-vip-iptables), changing this to default behaviour will break the default image behaviour.

How can we modify it to the kube-vip-iptables?

[thebsdbox]

As in a flag/env on the implementation, as in it's current form it is would be the default behaviour.
Something like --secureService?

[yaocw2020]

As in a flag/env on the implementation, as in it's current form it is would be the default behaviour. Something like --secureService?

Done, use an env called enable_service_security.

[thebsdbox]

Awesome looks good to go! If there is nothing else, I'll give this PR one last look over tomorrow (Awesome work) 😄

[yaocw2020]

Awesome looks good to go! If there is nothing else, I'll give this PR one last look over tomorrow (Awesome work) 😄

Thanks. If merged, could you help draft a new release? Our product whose new version is close to release needs this new feature.

[thebsdbox]

/LGTM