Bug 1726045: skip OPENSHIFT-MASQ for traffic already marked for masquerade #13
Conversation
If a packet has already been marked by other kube-proxy rules for masquerade, don't run it through the OPENSHIFT-MASQUERADE chain for further twiddling. Most notably, this chain is used for Egress IPs. This change fixes a bug where egress IPs can't access services via their ExternalIP. (bz 1726045)
openshift-ci-robot
added
size/S
|
@danwinship you already LGTM'd this - but now it's in the correct repo. |
squeed
changed the title
openshift-ci-robot
added
the
bugzilla/valid-bug
|
@squeed: This pull request references a valid Bugzilla bug. The bug has been moved to the POST state. The bug has been updated to refer to the pull request using the external bug tracker. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: danwinship, squeed The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
@squeed: All pull requests linked via external trackers have merged. The Bugzilla bug has been moved to the MODIFIED state. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
PR openshift#13 changed the source rule for OPENSHIFT-MASQUERADE. However, rolling out source-rule changes on a running system isn't clean. Easier to leave the source-rule unchanged, and just add a rule first in the chain that gets us where we want to be. So, -j RETURN for traffic that's already marked for MASQ.
iptables: partial #13 revert, skip masq in chain
If a packet has already been marked by other kube-proxy rules for masquerade, don't run it through the OPENSHIFT-MASQUERADE chain for further twiddling.
Most notably, this chain is used for Egress IPs.
This change fixes a bug where egress IPs can't access services via their ExternalIP. (bz 1726045)