Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ip6tables should be set in the noop plugin #53148

Merged
merged 1 commit into from
Nov 15, 2017
Merged

ip6tables should be set in the noop plugin #53148

merged 1 commit into from
Nov 15, 2017

Conversation

rpothier
Copy link

What this PR does / why we need it:
The noop plugin currently sets the iptables for IPv4.
This updates that to also set the iptables for IPv6 so
IPv6 can have parity with IPv4.

Which issue this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close that issue when PR gets merged): fixes #53147

Special notes for your reviewer:

Release note:

NONE

@k8s-ci-robot k8s-ci-robot added size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Sep 27, 2017
@rpothier
Copy link
Author

/sig network
/area ipv6

@k8s-ci-robot k8s-ci-robot added the sig/network Categorizes an issue or PR as relevant to SIG Network. label Sep 27, 2017
@k8s-github-robot k8s-github-robot added the release-note-none Denotes a PR that doesn't merit a release note. label Sep 27, 2017
@MrHohn
Copy link
Member

MrHohn commented Sep 27, 2017

/assign @freehan

@cmluciano
Copy link

/ok-to-test

@k8s-ci-robot k8s-ci-robot removed the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Sep 27, 2017
@rpothier
Copy link
Author

/test pull-kubernetes-e2e-gce-etcd3

dcbw
dcbw reviewed Oct 5, 2017
View reviewed changes
pkg/kubelet/network/plugins.go Outdated
@@ -215,6 +216,9 @@ func (plugin *NoopNetworkPlugin) Init(host Host, hairpinMode kubeletconfig.Hairp
if err := utilsysctl.New().SetSysctl(sysctlBridgeCallIPTables, 1); err != nil {
glog.Warningf("can't set sysctl %s: %v", sysctlBridgeCallIPTables, err)
}
if err := utilsysctl.New().SetSysctl(sysctlBridgeCallIP6Tables, 1); err != nil {
glog.Warningf("can't set sysctl %s: %v", sysctlBridgeCallIP6Tables, err)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this sysctl even exist if the kernel is booted with IPv6 disabled or compiled out? Not sure if we care about that case, but people still do this when they don't want IPv6, and I believe those make the sysctl simply not present and thus will always error spuriously.

Perhaps you can check if the err is os.IsNotExist() and ignore the warning?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I can ignore the warning when the element doesn't exist. There is a GetSysctl() to see if it exists, I will look at using that.

@dims
Copy link
Member

dims commented Oct 21, 2017

cc @leblancd

cmluciano
cmluciano reviewed Oct 23, 2017
View reviewed changes
Copy link

@cmluciano cmluciano left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If possible, can you please add a unit test for this? The sysctl pkg has a fake interface

cmluciano
cmluciano reviewed Oct 23, 2017
View reviewed changes
pkg/kubelet/network/plugins.go Outdated
@@ -217,6 +218,13 @@ func (plugin *NoopNetworkPlugin) Init(host Host, hairpinMode kubeletconfig.Hairp
if err := utilsysctl.New().SetSysctl(sysctlBridgeCallIPTables, 1); err != nil {
glog.Warningf("can't set sysctl %s: %v", sysctlBridgeCallIPTables, err)
}
if val, err := utilsysctl.New().GetSysctl(sysctlBridgeCallIP6Tables); err == nil {
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we log the error returned from GetSysctl if it cannot find the module?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the review, this PR was changed to not show the error if it cannot find the module.
As dcbw pointed out in an earlier review,
"Does this sysctl even exist if the kernel is booted with IPv6 disabled or compiled out? Not sure if we care about that case, but people still do this when they don't want IPv6, and I believe those make the sysctl simply not present and thus will always error spuriously."

So in the case where it can't find it, it just continues.

@rpothier
Copy link
Author

@cmluciano I'll look into the unit test with the sysctl pkg. Thanks.

@k8s-ci-robot k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Oct 30, 2017
@rpothier
Copy link
Author

/test pull-kubernetes-verify

@danehans
Copy link

@rpothier Since you import "github.com/stretchr/testify/assert", you need to run ./hack/update-bazel.sh and resubmit your PR.

@rpothier
Copy link
Author

@danehans Thanks, will run that.

@danehans
Copy link

danehans commented Nov 8, 2017

@dcbw @freehan @MrHohn do you mind reviewing when you have a moment? It would be good to get this PR merged for IPv6 alpha support in 1.9.

cc @bowei @luxas

@luxas
Copy link
Member

luxas commented Nov 8, 2017

This PR needs approval by someone of @thockin @dchen1107 @matchstick @freehan
/assign @thockin @dchen1107 @matchstick

MrHohn
MrHohn approved these changes Nov 8, 2017
View reviewed changes
Copy link
Member

@MrHohn MrHohn left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM with a nit.

pkg/kubelet/network/testing/plugins_test.go Outdated
// Verify the sysctl specified is set
assert.Equal(t, 1, sysctl.Settings[tt.setting], tt.setting+" sysctl should have been set")
// Verify iptables is always set
assert.Equal(t, 1, sysctl.Settings["net/bridge/bridge-nf-call-iptables"], "net/bridge/bridge-nf-call-ip6tables sysctl should have been set")
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

net/bridge/bridge-nf-call-ip6tables -> net/bridge/bridge-nf-call-iptables?

@thockin
Copy link
Member

thockin commented Nov 9, 2017

@MrHohn has the review

/approve

@k8s-github-robot k8s-github-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 9, 2017
@thockin thockin removed their assignment Nov 13, 2017
ip6tables should be set in the noop plugin
0fd30ad 
The noop plugin currently sets the iptables for IPv4.
This updates that to also set the iptables for IPv6 so
IPv6 can have parity with IPv4.
@MrHohn
Copy link
Member

MrHohn commented Nov 14, 2017

/lgtm
/retest

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 14, 2017
@k8s-github-robot
Copy link

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: MrHohn, rpothier, thockin

Associated issue: 53147

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these OWNERS Files:

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

@danehans
Copy link

@cmluciano @freehan @bowei @thockin anything else needed to get this PR merged?

@MrHohn
Copy link
Member

MrHohn commented Nov 14, 2017

@danehans Just time, it is already in submit queue :)
https://submit-queue.k8s.io/#/queue

@danehans
Copy link

thanks @MrHohn

@fejta-bot
Copy link

/retest
This bot automatically retries jobs that failed/flaked on approved PRs (send feedback to @fejta).

Review the full test history for this PR.

@k8s-github-robot
Copy link

/test all [submit-queue is verifying that this PR is safe to merge]

@k8s-github-robot
Copy link

Automatic merge from submit-queue (batch tested with PRs 54436, 53148, 55153, 55614, 55484). If you want to cherry-pick this change to another branch, please follow the instructions here.

@k8s-github-robot k8s-github-robot merged commit dca71e0 into kubernetes:master Nov 15, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@cmluciano cmluciano cmluciano left review comments

@dcbw dcbw dcbw left review comments

@MrHohn MrHohn MrHohn approved these changes

Assignees

@freehan freehan

@dchen1107 dchen1107

@MrHohn MrHohn

@dcbw dcbw

@matchstick matchstick

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. area/ipv6 cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. lgtm "Looks good to me", indicates that a PR is ready to be merged. release-note-none Denotes a PR that doesn't merit a release note. sig/network Categorizes an issue or PR as relevant to SIG Network. size/M Denotes a PR that changes 30-99 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

ip6tables should be set in the noop plugin