Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add support for NFT with Calico and Canal #8076

Merged
merged 1 commit into from
Dec 10, 2019
Merged

Add support for NFT with Calico and Canal #8076

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions k8s/crds/kops.k8s.io_clusters.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2376,6 +2376,10 @@ spec:
ipipMode:
description: IPIPMode is mode for CALICO_IPV4POOL_IPIP
type: string
iptablesBackend:
description: 'IptablesBackend controls which variant of iptables
binary Felix uses Default: Legacy (other options: NFT)'
type: string
logSeverityScreen:
description: 'LogSeverityScreen lets us set the desired log
level. (Default: info)'
Expand Down Expand Up @@ -2441,6 +2445,10 @@ spec:
NOT add the default ACCEPT traffic rules to the iptables FORWARD
chain
type: boolean
iptablesBackend:
description: 'IptablesBackend controls which variant of iptables
binary Felix uses Default: Legacy (other options: NFT)'
type: string
logSeveritySys:
description: 'LogSeveritySys the severity to set for logs which
are sent to syslog Default: INFO (other options: DEBUG, WARNING,
Expand Down
6 changes: 6 additions & 0 deletions pkg/apis/kops/networking.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,6 +94,9 @@ type CalicoNetworkingSpec struct {
PrometheusProcessMetricsEnabled bool `json:"prometheusProcessMetricsEnabled,omitempty"`
// MajorVersion is the version of Calico to use
MajorVersion string `json:"majorVersion,omitempty"`
// IptablesBackend controls which variant of iptables binary Felix uses
// Default: Legacy (other options: NFT)
IptablesBackend string `json:"iptablesBackend,omitempty"`
// IPIPMode is mode for CALICO_IPV4POOL_IPIP
IPIPMode string `json:"ipipMode,omitempty"`
// TyphaPrometheusMetricsEnabled enables Prometheus metrics collection from Typha
Expand All @@ -119,6 +122,9 @@ type CanalNetworkingSpec struct {
// DisableFlannelForwardRules configures Flannel to NOT add the
// default ACCEPT traffic rules to the iptables FORWARD chain
DisableFlannelForwardRules bool `json:"disableFlannelForwardRules,omitempty"`
// IptablesBackend controls which variant of iptables binary Felix uses
// Default: Legacy (other options: NFT)
IptablesBackend string `json:"iptablesBackend,omitempty"`
// LogSeveritySys the severity to set for logs which are sent to syslog
// Default: INFO (other options: DEBUG, WARNING, ERROR, CRITICAL, NONE)
LogSeveritySys string `json:"logSeveritySys,omitempty"`
Expand Down
6 changes: 6 additions & 0 deletions pkg/apis/kops/v1alpha1/networking.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,6 +94,9 @@ type CalicoNetworkingSpec struct {
PrometheusProcessMetricsEnabled bool `json:"prometheusProcessMetricsEnabled,omitempty"`
// MajorVersion is the version of Calico to use
MajorVersion string `json:"majorVersion,omitempty"`
// IptablesBackend controls which variant of iptables binary Felix uses
// Default: Legacy (other options: NFT)
IptablesBackend string `json:"iptablesBackend,omitempty"`
// IPIPMode is mode for CALICO_IPV4POOL_IPIP
IPIPMode string `json:"ipipMode,omitempty"`
// TyphaPrometheusMetricsEnabled enables Prometheus metrics collection from Typha
Expand All @@ -119,6 +122,9 @@ type CanalNetworkingSpec struct {
// DisableFlannelForwardRules configures Flannel to NOT add the
// default ACCEPT traffic rules to the iptables FORWARD chain
DisableFlannelForwardRules bool `json:"disableFlannelForwardRules,omitempty"`
// IptablesBackend controls which variant of iptables binary Felix uses
// Default: Legacy (other options: NFT)
IptablesBackend string `json:"iptablesBackend,omitempty"`
// LogSeveritySys the severity to set for logs which are sent to syslog
// Default: INFO (other options: DEBUG, WARNING, ERROR, CRITICAL, NONE)
LogSeveritySys string `json:"logSeveritySys,omitempty"`
Expand Down
4 changes: 4 additions & 0 deletions pkg/apis/kops/v1alpha1/zz_generated.conversion.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

6 changes: 6 additions & 0 deletions pkg/apis/kops/v1alpha2/networking.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,6 +94,9 @@ type CalicoNetworkingSpec struct {
PrometheusProcessMetricsEnabled bool `json:"prometheusProcessMetricsEnabled,omitempty"`
// MajorVersion is the version of Calico to use
MajorVersion string `json:"majorVersion,omitempty"`
// IptablesBackend controls which variant of iptables binary Felix uses
// Default: Legacy (other options: NFT)
IptablesBackend string `json:"iptablesBackend,omitempty"`
// IPIPMode is mode for CALICO_IPV4POOL_IPIP
IPIPMode string `json:"ipipMode,omitempty"`
// TyphaPrometheusMetricsEnabled enables Prometheus metrics collection from Typha
Expand All @@ -119,6 +122,9 @@ type CanalNetworkingSpec struct {
// DisableFlannelForwardRules configures Flannel to NOT add the
// default ACCEPT traffic rules to the iptables FORWARD chain
DisableFlannelForwardRules bool `json:"disableFlannelForwardRules,omitempty"`
// IptablesBackend controls which variant of iptables binary Felix uses
// Default: Legacy (other options: NFT)
IptablesBackend string `json:"iptablesBackend,omitempty"`
// LogSeveritySys the severity to set for logs which are sent to syslog
// Default: INFO (other options: DEBUG, WARNING, ERROR, CRITICAL, NONE)
LogSeveritySys string `json:"logSeveritySys,omitempty"`
Expand Down
4 changes: 4 additions & 0 deletions pkg/apis/kops/v1alpha2/zz_generated.conversion.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 3 additions & 0 deletions ...models/cloudup/resources/addons/networking.projectcalico.org.canal/k8s-1.15.yaml.template
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -721,6 +721,9 @@ spec:
configMapKeyRef:
name: canal-config
key: veth_mtu
# Set Felix iptables binary variant, Legacy or NFT
- name: FELIX_IPTABLESBACKEND
value: "{{- or .Networking.Canal.IptablesBackend "Legacy" }}"
# Disable IPv6 on Kubernetes.
- name: FELIX_IPV6SUPPORT
value: "false"
Expand Down
3 changes: 3 additions & 0 deletions upup/models/cloudup/resources/addons/networking.projectcalico.org/k8s-1.12.yaml.template
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -819,6 +819,9 @@ spec:
value: "true"

# kops additions
# Set Felix iptables binary variant, Legacy or NFT
- name: FELIX_IPTABLESBACKEND
value: "{{- or .Networking.Calico.IptablesBackend "Legacy" }}"
# Set to enable the experimental Prometheus metrics server
- name: FELIX_PROMETHEUSMETRICSENABLED
value: "{{- or .Networking.Calico.PrometheusMetricsEnabled "false" }}"
Expand Down
4 changes: 2 additions & 2 deletions upup/pkg/fi/cloudup/bootstrapchannelbuilder.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -828,7 +828,7 @@ func (b *BootstrapChannelBuilder) buildAddons() *channelsapi.Addons {
"k8s-1.6": "2.6.9-kops.1",
"k8s-1.7": "2.6.12-kops.1",
"k8s-1.7-v3": "3.8.0-kops.2",
"k8s-1.12": "3.9.3-kops.1",
"k8s-1.12": "3.9.3-kops.2",
}

{
Expand Down Expand Up @@ -912,7 +912,7 @@ func (b *BootstrapChannelBuilder) buildAddons() *channelsapi.Addons {
"k8s-1.8": "2.6.7-kops.3",
"k8s-1.9": "3.2.3-kops.1",
"k8s-1.12": "3.7.4",
"k8s-1.15": "3.10.1",
"k8s-1.15": "3.10.1-kops.2",
}
{
id := "pre-k8s-1.6"
Expand Down