Remove knowledge of pod cluster CIDR from iptables rules

[shekhar-rajak]

Enhancement Description

• One-line enhancement description (can be used as a release note):

Remove knowledge of pod cluster CIDR from iptables rules

• Kubernetes Enhancement Proposal:

The iptables implementation of kube-proxy today references the cluster CIDR for pods in three places for the following reasons.

   1. [Masquerade off cluster traffic to services by node IP](https://github.com/kubernetes/kubernetes/blob/v1.17.0/pkg/proxy/iptables/proxier.go#L965-L970)
   2. [Redirecting pods traffic to external loadbalancer VIP to cluster IP](https://github.com/kubernetes/kubernetes/blob/v1.17.0/pkg/proxy/iptables/proxier.go#L1327-L1339)
   3. [Accepting traffic after first packet, after being accepted by kubernetes rules](https://github.com/kubernetes/kubernetes/blob/v1.17.0/pkg/proxy/iptables/proxier.go#L1468-L1490)

In addition, the ipvs implementation also references it in two places for similar purposes

   1. [Masquerade off cluster traffic to services by node IP](https://github.com/kubernetes/kubernetes/blob/master/pkg/proxy/ipvs/proxier.go#L1649-L1654)
   2. [Accepting traffic after first packet, after being accepted by kubernetes](https://github.com/kubernetes/kubernetes/blob/master/pkg/proxy/ipvs/proxier.go#L1726-L1745)

This enhancement proposes ways to achieve similar goals without tracking the pod cluster CIDR to do so.

• Discussion Link:
• Primary contact (assignee): @satyasm
• Responsible SIGs: sig-network
• Enhancement target (which target equals to which milestone):
  • Alpha release target (x.y):
  • Beta release target (x.y):
  • Stable release target (x.y):
• Alpha
  • KEP (k/enhancements) update PR(s):
  • Code (k/k) update PR(s):
  • Docs (k/website) update PR(s):

Please keep this description up to date. This will help the Enhancement Team to track the evolution of the enhancement efficiently.

[shekhar-rajak]

Migrating all the old template keps to new template : #2446

[thockin]

Implemented

[sftim]

It looks like KEP from this issue is being linked to deprecating use of the podCIDR field in the Node resource: kubernetes/kubernetes#57130

Have I got that right?

[aojea]

Have I got that right?

This removes kube-proxy dependency, that is one step towards deprecating it, however, it seems the field is "happily" used by CNI and other projects in the ecosystem

[sftim]

Maybe the field deprecation should have its own KEP?