Skip to content

Commit 323ce7e

Browse files
zhangzujianzhangzujian
committed
cni-server: fix inserting and deleting iptables rules (#5421)
Signed-off-by: zhangzujian <zhangzujian.7@gmail.com>
1 parent ae247ed commit 323ce7e

File tree

4 files changed

+61
-47
lines changed

4 files changed

+61
-47
lines changed

‎Makefile‎

Lines changed: 48 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ include ut.mk
55
include kind.mk
66
include talos.mk
77

8+
COMMA = ,
9+
810
REGISTRY = kubeovn
911
DEV_TAG = dev
1012
RELEASE_TAG = $(shell cat VERSION)
@@ -178,55 +180,59 @@ install-chart: untaint-control-plane
178180
kubectl label node -lovn.kubernetes.io/ovs_dp_type!=userspace ovn.kubernetes.io/ovs_dp_type=kernel --overwrite
179181
helm install kubeovn ./charts/kube-ovn --wait \
180182
--set global.images.kubeovn.tag=$(VERSION) \
181-
--set OVN_DIR=$(shell echo $${OVN_DIR:-/etc/origin/ovn}) \
182-
--set OPENVSWITCH_DIR=$(shell echo $${OPENVSWITCH_DIR:-/etc/origin/openvswitch}) \
183-
--set DISABLE_MODULES_MANAGEMENT=$(shell echo $${DISABLE_MODULES_MANAGEMENT:-false}) \
184-
--set cni_conf.MOUNT_LOCAL_BIN_DIR=$(shell echo $${MOUNT_LOCAL_BIN_DIR:-true}) \
185-
--set networking.ENABLE_SSL=$(shell echo $${ENABLE_SSL:-false}) \
186-
--set networking.NETWORK_TYPE=$(shell echo $${NETWORK_TYPE:-geneve}) \
187-
--set networking.TUNNEL_TYPE=$(shell echo $${TUNNEL_TYPE:-geneve}) \
188-
--set networking.vlan.VLAN_INTERFACE_NAME=$(shell echo $${VLAN_INTERFACE_NAME:-}) \
189-
--set networking.vlan.VLAN_ID=$(shell echo $${VLAN_ID:-100}) \
190-
--set networking.NET_STACK=$(shell echo $${NET_STACK:-ipv4} | sed 's/^dual$$/dual_stack/') \
191-
--set-json networking.EXCLUDE_IPS='"$(shell echo $${EXCLUDE_IPS:-})"' \
192-
--set-json ipv4.POD_CIDR='"$(shell echo $${POD_CIDR:-10.16.0.0/16})"' \
193-
--set-json ipv4.POD_GATEWAY='"$(shell echo $${POD_GATEWAY:-10.16.0.1})"' \
194-
--set-json ipv6.POD_CIDR='"$(shell echo $${POD_CIDR:-fd00:10:16::/112})"' \
195-
--set-json ipv6.POD_GATEWAY='"$(shell echo $${POD_GATEWAY:-fd00:10:16::1})"' \
196-
--set-json dual_stack.POD_CIDR='"$(shell echo $${POD_CIDR:-10.16.0.0/16,fd00:10:16::/112})"' \
197-
--set-json dual_stack.POD_GATEWAY='"$(shell echo $${POD_GATEWAY:-10.16.0.1,fd00:10:16::1})"' \
198-
--set func.SECURE_SERVING=$(shell echo $${SECURE_SERVING:-false}) \
199-
--set func.ENABLE_BIND_LOCAL_IP=$(shell echo $${ENABLE_BIND_LOCAL_IP:-true}) \
200-
--set func.ENABLE_OVN_IPSEC=$(shell echo $${ENABLE_OVN_IPSEC:-false}) \
183+
--set image.pullPolicy=$(or $(IMAGE_PULL_POLICY),IfNotPresent) \
184+
--set OVN_DIR=$(or $(OVN_DIR),/etc/origin/ovn) \
185+
--set OPENVSWITCH_DIR=$(or $(OPENVSWITCH_DIR),/etc/origin/openvswitch) \
186+
--set DISABLE_MODULES_MANAGEMENT=$(or $(DISABLE_MODULES_MANAGEMENT),false) \
187+
--set cni_conf.MOUNT_LOCAL_BIN_DIR=$(or $(MOUNT_LOCAL_BIN_DIR),true) \
188+
--set networking.ENABLE_SSL=$(or $(ENABLE_SSL),false) \
189+
--set networking.NETWORK_TYPE=$(or $(NETWORK_TYPE),geneve) \
190+
--set networking.TUNNEL_TYPE=$(or $(TUNNEL_TYPE),geneve) \
191+
--set networking.vlan.VLAN_INTERFACE_NAME=$(or $(VLAN_INTERFACE_NAME),) \
192+
--set networking.vlan.VLAN_ID=$(or $(VLAN_ID),100) \
193+
--set networking.NET_STACK=$(subst dual,dual_stack,$(or $(NET_STACK),ipv4)) \
194+
--set-json networking.EXCLUDE_IPS='"$(or $(EXCLUDE_IPS),)"' \
195+
--set-json ipv4.POD_CIDR='"$(or $(POD_CIDR),10.16.0.0/16)"' \
196+
--set-json ipv4.POD_GATEWAY='"$(or $(POD_GATEWAY),10.16.0.1)"' \
197+
--set-json ipv6.POD_CIDR='"$(or $(POD_CIDR),fd00:10:16::/112)"' \
198+
--set-json ipv6.POD_GATEWAY='"$(or $(POD_GATEWAY),fd00:10:16::1)"' \
199+
--set-json dual_stack.POD_CIDR='"$(or $(POD_CIDR),10.16.0.0/16$(COMMA)fd00:10:16::/112)"' \
200+
--set-json dual_stack.POD_GATEWAY='"$(or $(POD_GATEWAY),10.16.0.1$(COMMA)fd00:10:16::1)"' \
201+
--set func.SECURE_SERVING=$(or $(SECURE_SERVING),false) \
202+
--set func.ENABLE_BIND_LOCAL_IP=$(or $(ENABLE_BIND_LOCAL_IP),true) \
203+
--set func.ENABLE_OVN_IPSEC=$(or $(ENABLE_OVN_IPSEC),false) \
204+
--set func.ENABLE_TPROXY=$(or $(ENABLE_TPROXY),false) \
201205
--set func.ENABLE_IC=$(shell kubectl get node --show-labels | grep -qw "ovn.kubernetes.io/ic-gw" && echo true || echo false) \
202-
--set func.ENABLE_ANP=$(shell echo $${ENABLE_ANP:-false})
206+
--set func.ENABLE_ANP=$(or $(ENABLE_ANP),false)
203207

204208
.PHONY: upgrade-chart
205209
upgrade-chart:
206210
helm upgrade kubeovn ./charts/kube-ovn --wait \
207211
--set global.images.kubeovn.tag=$(VERSION) \
208-
--set OVN_DIR=$(shell echo $${OVN_DIR:-/etc/origin/ovn}) \
209-
--set OPENVSWITCH_DIR=$(shell echo $${OPENVSWITCH_DIR:-/etc/origin/openvswitch}) \
210-
--set DISABLE_MODULES_MANAGEMENT=$(shell echo $${DISABLE_MODULES_MANAGEMENT:-false}) \
211-
--set cni_conf.MOUNT_LOCAL_BIN_DIR=$(shell echo $${MOUNT_LOCAL_BIN_DIR:-true}) \
212-
--set networking.ENABLE_SSL=$(shell echo $${ENABLE_SSL:-false}) \
213-
--set networking.NETWORK_TYPE=$(shell echo $${NETWORK_TYPE:-geneve}) \
214-
--set networking.TUNNEL_TYPE=$(shell echo $${TUNNEL_TYPE:-geneve}) \
215-
--set networking.vlan.VLAN_INTERFACE_NAME=$(shell echo $${VLAN_INTERFACE_NAME:-}) \
216-
--set networking.vlan.VLAN_ID=$(shell echo $${VLAN_ID:-100}) \
217-
--set networking.NET_STACK=$(shell echo $${NET_STACK:-ipv4} | sed 's/^dual$$/dual_stack/') \
218-
--set-json networking.EXCLUDE_IPS='"$(shell echo $${EXCLUDE_IPS:-})"' \
219-
--set-json ipv4.POD_CIDR='"$(shell echo $${POD_CIDR:-10.16.0.0/16})"' \
220-
--set-json ipv4.POD_GATEWAY='"$(shell echo $${POD_GATEWAY:-10.16.0.1})"' \
221-
--set-json ipv6.POD_CIDR='"$(shell echo $${POD_CIDR:-fd00:10:16::/112})"' \
222-
--set-json ipv6.POD_GATEWAY='"$(shell echo $${POD_GATEWAY:-fd00:10:16::1})"' \
223-
--set-json dual_stack.POD_CIDR='"$(shell echo $${POD_CIDR:-10.16.0.0/16,fd00:10:16::/112})"' \
224-
--set-json dual_stack.POD_GATEWAY='"$(shell echo $${POD_GATEWAY:-10.16.0.1,fd00:10:16::1})"' \
225-
--set func.SECURE_SERVING=$(shell echo $${SECURE_SERVING:-false}) \
226-
--set func.ENABLE_BIND_LOCAL_IP=$(shell echo $${ENABLE_BIND_LOCAL_IP:-true}) \
227-
--set func.ENABLE_OVN_IPSEC=$(shell echo $${ENABLE_OVN_IPSEC:-false}) \
212+
--set image.pullPolicy=$(or $(IMAGE_PULL_POLICY),IfNotPresent) \
213+
--set OVN_DIR=$(or $(OVN_DIR),/etc/origin/ovn) \
214+
--set OPENVSWITCH_DIR=$(or $(OPENVSWITCH_DIR),/etc/origin/openvswitch) \
215+
--set DISABLE_MODULES_MANAGEMENT=$(or $(DISABLE_MODULES_MANAGEMENT),false) \
216+
--set cni_conf.MOUNT_LOCAL_BIN_DIR=$(or $(MOUNT_LOCAL_BIN_DIR),true) \
217+
--set networking.ENABLE_SSL=$(or $(ENABLE_SSL),false) \
218+
--set networking.NETWORK_TYPE=$(or $(NETWORK_TYPE),geneve) \
219+
--set networking.TUNNEL_TYPE=$(or $(TUNNEL_TYPE),geneve) \
220+
--set networking.vlan.VLAN_INTERFACE_NAME=$(or $(VLAN_INTERFACE_NAME),) \
221+
--set networking.vlan.VLAN_ID=$(or $(VLAN_ID),100) \
222+
--set networking.NET_STACK=$(subst dual,dual_stack,$(or $(NET_STACK),ipv4)) \
223+
--set-json networking.EXCLUDE_IPS='"$(or $(EXCLUDE_IPS),)"' \
224+
--set-json ipv4.POD_CIDR='"$(or $(POD_CIDR),10.16.0.0/16)"' \
225+
--set-json ipv4.POD_GATEWAY='"$(or $(POD_GATEWAY),10.16.0.1)"' \
226+
--set-json ipv6.POD_CIDR='"$(or $(POD_CIDR),fd00:10:16::/112)"' \
227+
--set-json ipv6.POD_GATEWAY='"$(or $(POD_GATEWAY),fd00:10:16::1)"' \
228+
--set-json dual_stack.POD_CIDR='"$(or $(POD_CIDR),10.16.0.0/16$(COMMA)fd00:10:16::/112)"' \
229+
--set-json dual_stack.POD_GATEWAY='"$(or $(POD_GATEWAY),10.16.0.1$(COMMA)fd00:10:16::1)"' \
230+
--set func.SECURE_SERVING=$(or $(SECURE_SERVING),false) \
231+
--set func.ENABLE_BIND_LOCAL_IP=$(or $(ENABLE_BIND_LOCAL_IP),true) \
232+
--set func.ENABLE_OVN_IPSEC=$(or $(ENABLE_OVN_IPSEC),false) \
233+
--set func.ENABLE_TPROXY=$(or $(ENABLE_TPROXY),false) \
228234
--set func.ENABLE_IC=$(shell kubectl get node --show-labels | grep -qw "ovn.kubernetes.io/ic-gw" && echo true || echo false) \
229-
--set func.ENABLE_ANP=$(shell echo $${ENABLE_ANP:-false})
235+
--set func.ENABLE_ANP=$(or $(ENABLE_ANP),false)
230236
kubectl -n kube-system wait pod --for=condition=ready -l app=ovs --timeout=60s
231237

232238
.PHONY: uninstall

‎kind.mk‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ KIND_VLAN_NIC = eth1
2424
endif
2525

2626
KIND_AUDITING = $(shell echo $${KIND_AUDITING:-false})
27-
ifeq ($(shell echo $${CI:-false}),true)
27+
ifeq ($(or $(CI),false),true)
2828
KIND_AUDITING = true
2929
endif
3030

@@ -549,6 +549,8 @@ kind-install-cilium-chaining-%:
549549
--set k8sServiceHost=$(KUBERNETES_SERVICE_HOST) \
550550
--set k8sServicePort=6443 \
551551
--set kubeProxyReplacement=false \
552+
--set image.useDigest=false \
553+
--set operator.image.useDigest=false \
552554
--set operator.replicas=1 \
553555
--set socketLB.enabled=true \
554556
--set nodePort.enabled=true \
@@ -558,6 +560,7 @@ kind-install-cilium-chaining-%:
558560
--set enableIPv4Masquerade=false \
559561
--set enableIPv6Masquerade=false \
560562
--set hubble.enabled=true \
563+
--set envoy.enabled=false \
561564
--set sctp.enabled=true \
562565
--set ipv4.enabled=$(shell if echo $* | grep -q ipv6; then echo false; else echo true; fi) \
563566
--set ipv6.enabled=$(shell if echo $* | grep -q ipv4; then echo false; else echo true; fi) \

‎pkg/daemon/gateway_linux.go‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -463,9 +463,12 @@ func ensureNatPreroutingRulePosition(ipt *iptables.IPTables, rule util.IPTableRu
463463
if err != nil {
464464
return fmt.Errorf("failed to find nat prerouting rule position: %w", err)
465465
}
466-
if len(existingNatPreroutingPosList) > 0 && existingNatPreroutingPosList[len(existingNatPreroutingPosList)-1] < insertPosition {
467-
klog.V(5).Infof("nat prerouting rule already exists at position %d", existingNatPreroutingPosList[len(existingNatPreroutingPosList)-1])
468-
return nil
466+
if len(existingNatPreroutingPosList) > 0 {
467+
pos := existingNatPreroutingPosList[len(existingNatPreroutingPosList)-1]
468+
if pos <= insertPosition {
469+
klog.V(5).Infof("nat prerouting rule already exists at position %d", pos)
470+
return nil
471+
}
469472
}
470473

471474
klog.Infof("inserting nat prerouting rule %q at position %d", rule.Rule, insertPosition)

‎talos.mk‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ TALOS_UNDERLAY_EXCLUDE_IPS_DUAL = $(TALOS_UNDERLAY_EXCLUDE_IPS_IPV4),$(TALOS_UND
4848
# geneve causes kernel panic on my local libvirt virtual machines
4949
# use vxlan instead
5050
TALOS_TUNNEL_TYPE = vxlan
51-
ifeq ($(shell echo $${CI:-false}),true)
51+
ifeq ($(or $(CI),false),true)
5252
TALOS_TUNNEL_TYPE = geneve
5353
endif
5454

@@ -278,6 +278,8 @@ talos-install: talos-install-prepare
278278
OPENVSWITCH_DIR=/var/lib/openvswitch \
279279
DISABLE_MODULES_MANAGEMENT=true \
280280
MOUNT_LOCAL_BIN_DIR=false \
281+
ENABLE_TPROXY=true \
282+
IMAGE_PULL_POLICY=Always \
281283
TUNNEL_TYPE=$(TALOS_TUNNEL_TYPE) \
282284
$(MAKE) install-chart
283285

0 commit comments

Comments
 (0)