Join GitHub today
GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.Sign up
Don't create no-op iptables rules for services with no endpoints #57461
Currently for all services we create
This PR gets rid of the match rules in this case. Which is to say, it changes things so that every incoming service packet is matched either by nat rules to rewrite it or by filter rules to ICMP reject it, but not both. (Actually, that's not quite true: there are no filter rules to reject Ingress-addressed packets, and I think that's a bug?)
I also got rid of some comments that seemed redundant.
The patch is mostly reindentation, so best viewed with
1 similar comment
There are unit tests in pkg/proxy/iptables/proxier_test.go that check that rewrite rules are correctly written for services with endpoints, and reject rules are correctly written for services without endpoints, and those tests continue to pass without having needed any changes, because this patch only removes rules that we weren't checking for (because they're irrelevant).
There are plenty of e2e tests that make sure that services with endpoints work. There doesn't seem to be a comprehensive set of tests that services without endpoints fail immediately rather than slowly timing out, so I could add some more of those.
referenced this pull request
Feb 21, 2018
TBH, I'm not 100% sure. This is mostly supposed to be fixing #56842, as an alternative version of a patch they wrote that I didn't like (it required reserving another bit in the iptables mark), but then the filer of that bug wasn't able to test it.
At any rate, without this patch (which, as mentioned in the original comment, is mostly just reindentation), we are definitely adding thousands of no-op iptables rules on some clusters.
[APPROVALNOTIFIER] This PR is APPROVED
The full list of commands accepted by this bot can be found here.
The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing