Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

kube-proxy iptables performance fixes #18754

Merged
merged 4 commits into from Feb 27, 2018
Merged

kube-proxy iptables performance fixes #18754

merged 4 commits into from Feb 27, 2018

Conversation

danwinship
Copy link
Contributor

@danwinship danwinship commented Feb 26, 2018 •
edited

Pull in multiple upstream iptables fixes to improve performance in "very large clusters" (ie, Online).

Includes kubernetes/kubernetes#57336, kubernetes/kubernetes#56164, kubernetes/kubernetes#57461, and kubernetes/kubernetes#60306.

Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1514174

@danwinship danwinship requested a review from dcbw February 26, 2018 21:50
@openshift-ci-robot openshift-ci-robot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Feb 26, 2018
@openshift-merge-robot openshift-merge-robot added the vendor-update Touching vendor dir or related files label Feb 26, 2018
@danwinship
Copy link
Contributor Author

/test extended_networking

@eparis, can you compare with what we're currently doing on Online? I think we are currently hacking it with one change that effectively bypasses KUBE-SERVICES from INPUT (which has the same effect as "UPSTREAM: 56164: Split out a KUBE-EXTERNAL-SERVICES chain...") and another that adds "-m conntrack --connstate NEW", like "UPSTREAM: 60306: Only run connection-rejecting rules on new connections"

Also, do we want to backport this to 3.7 (which may require some annoying rebasing) or is just 3.9 fine at this point?

@eparis
Copy link
Member

eparis commented Feb 26, 2018

3.9 is fine.

@eparis
Copy link
Member

eparis commented Feb 26, 2018 

[Unit]
Description=Temporary fix to OpenShift iptables rules on INPUT chain
After=atomic-openshift-node.service
Wants=atomic-openshift-node.service


[Service]
Type=oneshot
RemainAfterExit=yes
ExecStartPre=-/usr/sbin/iptables -w -N KUBE-SERVICES
ExecStart=-/usr/sbin/iptables -w -D INPUT -m comment --comment "kubernetes service portals" -j KUBE-SERVICES
ExecStart=/usr/sbin/iptables -w -A INPUT -m comment --comment "kubernetes service portals" -j KUBE-SERVICES
ExecStart=/usr/sbin/iptables -w -I INPUT -m comment --comment "kubernetes service portals" -d 172.17.0.0/24 -j KUBE-SERVICES
ExecReload=-/usr/sbin/iptables -w -D INPUT -m comment --comment "kubernetes service portals" -d 172.17.0.0/24 -j KUBE-SERVICES
ExecReload=-/usr/sbin/iptables -w -D INPUT -m comment --comment "kubernetes service portals" -j KUBE-SERVICES
ExecReload=/usr/sbin/iptables -w -A INPUT -m comment --comment "kubernetes service portals" -j KUBE-SERVICES
ExecReload=/usr/sbin/iptables -w -I INPUT -m comment --comment "kubernetes service portals" -d 172.17.0.0/24 -j KUBE-SERVICES
ExecStop=-/usr/sbin/iptables -w -D INPUT -m comment --comment "kubernetes service portals" -j KUBE-SERVICES
ExecStop=-/usr/sbin/iptables -w -D INPUT -m comment --comment "kubernetes service portals" -d 172.17.0.0/24 -j KUBE-SERVICES
ExecStop=/usr/sbin/iptables -w -I INPUT -m comment --comment "kubernetes service portals" -j KUBE-SERVICES
StandardOutput=syslog
StandardError=syslog

[Install]
WantedBy=multi-user.target

@eparis
Copy link
Member

eparis commented Feb 26, 2018

/lgtm

@openshift-ci-robot openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Feb 26, 2018
@openshift-ci-robot
Copy link

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: danwinship, eparis

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci-robot openshift-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Feb 26, 2018
@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

1 similar comment
@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@smarterclayton
Copy link
Contributor

smarterclayton commented Feb 27, 2018 via email

@smarterclayton
Copy link
Contributor

/retest

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-merge-robot
Copy link
Contributor

Automatic merge from submit-queue (batch tested with PRs 18754, 18761).

@openshift-merge-robot openshift-merge-robot merged commit e2e14cb into openshift:master Feb 27, 2018
@danwinship danwinship deleted the upstream-iptables-fixes branch February 27, 2018 21:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@dcbw dcbw Awaiting requested review from dcbw

@smarterclayton smarterclayton Awaiting requested review from smarterclayton

Assignees

@eparis eparis

@knobunc knobunc

@dcbw dcbw

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. component/networking lgtm Indicates that a PR is ready to be merged. sig/networking size/L Denotes a PR that changes 100-499 lines, ignoring generated files. vendor-update Touching vendor dir or related files
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
8 participants
@danwinship @eparis @openshift-ci-robot @openshift-bot @smarterclayton @openshift-merge-robot @knobunc @dcbw