kube-proxy: filter INPUT as well as OUTPUT

[thockin]

We need to apply filter rules on the way in (nodeports) and out (cluster
IPs). Testing here is insufficient to have caught this - will come back
for that.

Fixes #43969

@justinsb since you have the best repro, can you test? It passes what I think is repro.

@ethernetdan we will want this in 1.6.x

Fix bug with service nodeports that have no backends not being rejected, when they should be. This is not a regression vs v1.5 - it's a fix that didn't quite fix hard enough.

kube-proxy handling of services with no endpoints now applies to both INPUT and OUTPUT chains, preventing socket leak.

[k8s-reviewable]

This change is 

[ncdc]

cc @eparis @dcbw @danwinship @sttts

[thockin]

@k8s-bot gce etcd3 e2e test this

[thockin]

@k8s-bot cvm gce e2e test this

[justinsb]

The bad news:

> iptables -t filter --list-rules
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N DOCKER
-N DOCKER-ISOLATION
-N KUBE-FIREWALL
-N KUBE-SERVICES
-A INPUT -j KUBE-FIREWALL
-A FORWARD -j DOCKER-ISOLATION
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A OUTPUT -m comment --comment "kubernetes service portals" -j KUBE-SERVICES
-A OUTPUT -j KUBE-FIREWALL
-A DOCKER-ISOLATION -j RETURN
-A KUBE-FIREWALL -m comment --comment "kubernetes firewall for dropping marked packets" -m mark --mark 0x8000/0x8000 -j DROP
-A KUBE-SERVICES -p tcp -m comment --comment "default/guestbook: has no endpoints" -m addrtype --dst-type LOCAL -m tcp --dport 30849 -j REJECT --reject-with icmp-port-unreachable
-A KUBE-SERVICES -d 100.70.10.247/32 -p tcp -m comment --comment "default/guestbook: has no endpoints" -m tcp --dport 3000 -j REJECT --reject-with icmp-port-unreachable

The good news: if I then do iptables -A INPUT -m comment --comment "kubernetes service portals" -j KUBE-SERVICES the count stops going up.

I think you also want it here: https://github.com/kubernetes/kubernetes/blob/master/pkg/proxy/iptables/proxier.go#L793

[thockin]

urg, I thought I hit both places.

[thockin]

re-pushed

[thockin]

ping @justinsb

[justinsb]

It works for me - thanks for fixing :-)

/lgtm

[k8s-github-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: justinsb, thockin

Needs approval from an approver in each of these OWNERS Files:

• pkg/proxy/OWNERS [thockin]

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

[k8s-github-robot]

Automatic merge from submit-queue

[k8s-cherrypick-bot]

Commit found in the "release-1.6" branch appears to be this PR. Removing the "cherrypick-candidate" label. If this is an error find help to get your PR picked.