Skip to content

Commit 737c301

Browse files
zhangzujianzhangzujian
committed
cni-server: fix inserting and deleting iptables rules (#5421)
Signed-off-by: zhangzujian <zhangzujian.7@gmail.com>
1 parent 30c8c58 commit 737c301

File tree

5 files changed

+62
-48
lines changed

5 files changed

+62
-48
lines changed

‎Makefile‎

Lines changed: 48 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ include kind.mk
66
include talos.mk
77
include e2e.mk
88

9+
COMMA = ,
10+
911
REGISTRY = kubeovn
1012
DEV_TAG = dev
1113
RELEASE_TAG = $(shell cat VERSION)
@@ -183,55 +185,59 @@ install-chart:
183185
kubectl label node --overwrite -l node-role.kubernetes.io/control-plane kube-ovn/role=master
184186
helm install kubeovn ./charts/kube-ovn --wait \
185187
--set global.images.kubeovn.tag=$(VERSION) \
186-
--set OVN_DIR=$(shell echo $${OVN_DIR:-/etc/origin/ovn}) \
187-
--set OPENVSWITCH_DIR=$(shell echo $${OPENVSWITCH_DIR:-/etc/origin/openvswitch}) \
188-
--set DISABLE_MODULES_MANAGEMENT=$(shell echo $${DISABLE_MODULES_MANAGEMENT:-false}) \
189-
--set cni_conf.MOUNT_LOCAL_BIN_DIR=$(shell echo $${MOUNT_LOCAL_BIN_DIR:-true}) \
190-
--set networking.ENABLE_SSL=$(shell echo $${ENABLE_SSL:-false}) \
191-
--set networking.NETWORK_TYPE=$(shell echo $${NETWORK_TYPE:-geneve}) \
192-
--set networking.TUNNEL_TYPE=$(shell echo $${TUNNEL_TYPE:-geneve}) \
193-
--set networking.vlan.VLAN_INTERFACE_NAME=$(shell echo $${VLAN_INTERFACE_NAME:-}) \
194-
--set networking.vlan.VLAN_ID=$(shell echo $${VLAN_ID:-100}) \
195-
--set networking.NET_STACK=$(shell echo $${NET_STACK:-ipv4} | sed 's/^dual$$/dual_stack/') \
196-
--set-json networking.EXCLUDE_IPS='"$(shell echo $${EXCLUDE_IPS:-})"' \
197-
--set-json ipv4.POD_CIDR='"$(shell echo $${POD_CIDR:-10.16.0.0/16})"' \
198-
--set-json ipv4.POD_GATEWAY='"$(shell echo $${POD_GATEWAY:-10.16.0.1})"' \
199-
--set-json ipv6.POD_CIDR='"$(shell echo $${POD_CIDR:-fd00:10:16::/112})"' \
200-
--set-json ipv6.POD_GATEWAY='"$(shell echo $${POD_GATEWAY:-fd00:10:16::1})"' \
201-
--set-json dual_stack.POD_CIDR='"$(shell echo $${POD_CIDR:-10.16.0.0/16,fd00:10:16::/112})"' \
202-
--set-json dual_stack.POD_GATEWAY='"$(shell echo $${POD_GATEWAY:-10.16.0.1,fd00:10:16::1})"' \
203-
--set func.SECURE_SERVING=$(shell echo $${SECURE_SERVING:-false}) \
204-
--set func.ENABLE_BIND_LOCAL_IP=$(shell echo $${ENABLE_BIND_LOCAL_IP:-true}) \
205-
--set func.ENABLE_OVN_IPSEC=$(shell echo $${ENABLE_OVN_IPSEC:-false}) \
188+
--set image.pullPolicy=$(or $(IMAGE_PULL_POLICY),IfNotPresent) \
189+
--set OVN_DIR=$(or $(OVN_DIR),/etc/origin/ovn) \
190+
--set OPENVSWITCH_DIR=$(or $(OPENVSWITCH_DIR),/etc/origin/openvswitch) \
191+
--set DISABLE_MODULES_MANAGEMENT=$(or $(DISABLE_MODULES_MANAGEMENT),false) \
192+
--set cni_conf.MOUNT_LOCAL_BIN_DIR=$(or $(MOUNT_LOCAL_BIN_DIR),true) \
193+
--set networking.ENABLE_SSL=$(or $(ENABLE_SSL),false) \
194+
--set networking.NETWORK_TYPE=$(or $(NETWORK_TYPE),geneve) \
195+
--set networking.TUNNEL_TYPE=$(or $(TUNNEL_TYPE),geneve) \
196+
--set networking.vlan.VLAN_INTERFACE_NAME=$(or $(VLAN_INTERFACE_NAME),) \
197+
--set networking.vlan.VLAN_ID=$(or $(VLAN_ID),100) \
198+
--set networking.NET_STACK=$(subst dual,dual_stack,$(or $(NET_STACK),ipv4)) \
199+
--set-json networking.EXCLUDE_IPS='"$(or $(EXCLUDE_IPS),)"' \
200+
--set-json ipv4.POD_CIDR='"$(or $(POD_CIDR),10.16.0.0/16)"' \
201+
--set-json ipv4.POD_GATEWAY='"$(or $(POD_GATEWAY),10.16.0.1)"' \
202+
--set-json ipv6.POD_CIDR='"$(or $(POD_CIDR),fd00:10:16::/112)"' \
203+
--set-json ipv6.POD_GATEWAY='"$(or $(POD_GATEWAY),fd00:10:16::1)"' \
204+
--set-json dual_stack.POD_CIDR='"$(or $(POD_CIDR),10.16.0.0/16$(COMMA)fd00:10:16::/112)"' \
205+
--set-json dual_stack.POD_GATEWAY='"$(or $(POD_GATEWAY),10.16.0.1$(COMMA)fd00:10:16::1)"' \
206+
--set func.SECURE_SERVING=$(or $(SECURE_SERVING),false) \
207+
--set func.ENABLE_BIND_LOCAL_IP=$(or $(ENABLE_BIND_LOCAL_IP),true) \
208+
--set func.ENABLE_OVN_IPSEC=$(or $(ENABLE_OVN_IPSEC),false) \
209+
--set func.ENABLE_TPROXY=$(or $(ENABLE_TPROXY),false) \
206210
--set func.ENABLE_IC=$(shell kubectl get node --show-labels | grep -qw "ovn.kubernetes.io/ic-gw" && echo true || echo false) \
207-
--set func.ENABLE_ANP=$(shell echo $${ENABLE_ANP:-false})
211+
--set func.ENABLE_ANP=$(or $(ENABLE_ANP),false)
208212

209213
.PHONY: upgrade-chart
210214
upgrade-chart:
211215
helm upgrade kubeovn ./charts/kube-ovn --wait \
212216
--set global.images.kubeovn.tag=$(VERSION) \
213-
--set OVN_DIR=$(shell echo $${OVN_DIR:-/etc/origin/ovn}) \
214-
--set OPENVSWITCH_DIR=$(shell echo $${OPENVSWITCH_DIR:-/etc/origin/openvswitch}) \
215-
--set DISABLE_MODULES_MANAGEMENT=$(shell echo $${DISABLE_MODULES_MANAGEMENT:-false}) \
216-
--set cni_conf.MOUNT_LOCAL_BIN_DIR=$(shell echo $${MOUNT_LOCAL_BIN_DIR:-true}) \
217-
--set networking.ENABLE_SSL=$(shell echo $${ENABLE_SSL:-false}) \
218-
--set networking.NETWORK_TYPE=$(shell echo $${NETWORK_TYPE:-geneve}) \
219-
--set networking.TUNNEL_TYPE=$(shell echo $${TUNNEL_TYPE:-geneve}) \
220-
--set networking.vlan.VLAN_INTERFACE_NAME=$(shell echo $${VLAN_INTERFACE_NAME:-}) \
221-
--set networking.vlan.VLAN_ID=$(shell echo $${VLAN_ID:-100}) \
222-
--set networking.NET_STACK=$(shell echo $${NET_STACK:-ipv4} | sed 's/^dual$$/dual_stack/') \
223-
--set-json networking.EXCLUDE_IPS='"$(shell echo $${EXCLUDE_IPS:-})"' \
224-
--set-json ipv4.POD_CIDR='"$(shell echo $${POD_CIDR:-10.16.0.0/16})"' \
225-
--set-json ipv4.POD_GATEWAY='"$(shell echo $${POD_GATEWAY:-10.16.0.1})"' \
226-
--set-json ipv6.POD_CIDR='"$(shell echo $${POD_CIDR:-fd00:10:16::/112})"' \
227-
--set-json ipv6.POD_GATEWAY='"$(shell echo $${POD_GATEWAY:-fd00:10:16::1})"' \
228-
--set-json dual_stack.POD_CIDR='"$(shell echo $${POD_CIDR:-10.16.0.0/16,fd00:10:16::/112})"' \
229-
--set-json dual_stack.POD_GATEWAY='"$(shell echo $${POD_GATEWAY:-10.16.0.1,fd00:10:16::1})"' \
230-
--set func.SECURE_SERVING=$(shell echo $${SECURE_SERVING:-false}) \
231-
--set func.ENABLE_BIND_LOCAL_IP=$(shell echo $${ENABLE_BIND_LOCAL_IP:-true}) \
232-
--set func.ENABLE_OVN_IPSEC=$(shell echo $${ENABLE_OVN_IPSEC:-false}) \
217+
--set image.pullPolicy=$(or $(IMAGE_PULL_POLICY),IfNotPresent) \
218+
--set OVN_DIR=$(or $(OVN_DIR),/etc/origin/ovn) \
219+
--set OPENVSWITCH_DIR=$(or $(OPENVSWITCH_DIR),/etc/origin/openvswitch) \
220+
--set DISABLE_MODULES_MANAGEMENT=$(or $(DISABLE_MODULES_MANAGEMENT),false) \
221+
--set cni_conf.MOUNT_LOCAL_BIN_DIR=$(or $(MOUNT_LOCAL_BIN_DIR),true) \
222+
--set networking.ENABLE_SSL=$(or $(ENABLE_SSL),false) \
223+
--set networking.NETWORK_TYPE=$(or $(NETWORK_TYPE),geneve) \
224+
--set networking.TUNNEL_TYPE=$(or $(TUNNEL_TYPE),geneve) \
225+
--set networking.vlan.VLAN_INTERFACE_NAME=$(or $(VLAN_INTERFACE_NAME),) \
226+
--set networking.vlan.VLAN_ID=$(or $(VLAN_ID),100) \
227+
--set networking.NET_STACK=$(subst dual,dual_stack,$(or $(NET_STACK),ipv4)) \
228+
--set-json networking.EXCLUDE_IPS='"$(or $(EXCLUDE_IPS),)"' \
229+
--set-json ipv4.POD_CIDR='"$(or $(POD_CIDR),10.16.0.0/16)"' \
230+
--set-json ipv4.POD_GATEWAY='"$(or $(POD_GATEWAY),10.16.0.1)"' \
231+
--set-json ipv6.POD_CIDR='"$(or $(POD_CIDR),fd00:10:16::/112)"' \
232+
--set-json ipv6.POD_GATEWAY='"$(or $(POD_GATEWAY),fd00:10:16::1)"' \
233+
--set-json dual_stack.POD_CIDR='"$(or $(POD_CIDR),10.16.0.0/16$(COMMA)fd00:10:16::/112)"' \
234+
--set-json dual_stack.POD_GATEWAY='"$(or $(POD_GATEWAY),10.16.0.1$(COMMA)fd00:10:16::1)"' \
235+
--set func.SECURE_SERVING=$(or $(SECURE_SERVING),false) \
236+
--set func.ENABLE_BIND_LOCAL_IP=$(or $(ENABLE_BIND_LOCAL_IP),true) \
237+
--set func.ENABLE_OVN_IPSEC=$(or $(ENABLE_OVN_IPSEC),false) \
238+
--set func.ENABLE_TPROXY=$(or $(ENABLE_TPROXY),false) \
233239
--set func.ENABLE_IC=$(shell kubectl get node --show-labels | grep -qw "ovn.kubernetes.io/ic-gw" && echo true || echo false) \
234-
--set func.ENABLE_ANP=$(shell echo $${ENABLE_ANP:-false})
240+
--set func.ENABLE_ANP=$(or $(ENABLE_ANP),false)
235241
kubectl -n kube-system wait pod --for=condition=ready -l app=ovs --timeout=60s
236242

237243
.PHONY: install-chart-v2

‎e2e.mk‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ endif
5959

6060
GINKGO_OUTPUT_OPT =
6161
GINKGO_PARALLEL_OPT =
62-
ifeq ($(shell echo $${CI:-false}),true)
62+
ifeq ($(or $(CI),false),true)
6363
GINKGO_OUTPUT_OPT = --github-output --silence-skips
6464
GINKGO_PARALLEL_OPT = --procs $$(($$(nproc) * $(GINKGO_PARALLEL_MULTIPLIER)))
6565
endif

‎kind.mk‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ KIND_VLAN_NIC = eth1
2424
endif
2525

2626
KIND_AUDITING = $(shell echo $${KIND_AUDITING:-false})
27-
ifeq ($(shell echo $${CI:-false}),true)
27+
ifeq ($(or $(CI),false),true)
2828
KIND_AUDITING = true
2929
endif
3030

@@ -549,6 +549,8 @@ kind-install-cilium-chaining-%:
549549
--set k8sServiceHost=$(KUBERNETES_SERVICE_HOST) \
550550
--set k8sServicePort=6443 \
551551
--set kubeProxyReplacement=false \
552+
--set image.useDigest=false \
553+
--set operator.image.useDigest=false \
552554
--set operator.replicas=1 \
553555
--set socketLB.enabled=true \
554556
--set nodePort.enabled=true \
@@ -558,6 +560,7 @@ kind-install-cilium-chaining-%:
558560
--set enableIPv4Masquerade=false \
559561
--set enableIPv6Masquerade=false \
560562
--set hubble.enabled=true \
563+
--set envoy.enabled=false \
561564
--set sctp.enabled=true \
562565
--set ipv4.enabled=$(shell if echo $* | grep -q ipv6; then echo false; else echo true; fi) \
563566
--set ipv6.enabled=$(shell if echo $* | grep -q ipv4; then echo false; else echo true; fi) \

‎pkg/daemon/gateway_linux.go‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -463,9 +463,12 @@ func ensureNatPreroutingRulePosition(ipt *iptables.IPTables, rule util.IPTableRu
463463
if err != nil {
464464
return fmt.Errorf("failed to find nat prerouting rule position: %w", err)
465465
}
466-
if len(existingNatPreroutingPosList) > 0 && existingNatPreroutingPosList[len(existingNatPreroutingPosList)-1] < insertPosition {
467-
klog.V(5).Infof("nat prerouting rule already exists at position %d", existingNatPreroutingPosList[len(existingNatPreroutingPosList)-1])
468-
return nil
466+
if len(existingNatPreroutingPosList) > 0 {
467+
pos := existingNatPreroutingPosList[len(existingNatPreroutingPosList)-1]
468+
if pos <= insertPosition {
469+
klog.V(5).Infof("nat prerouting rule already exists at position %d", pos)
470+
return nil
471+
}
469472
}
470473

471474
klog.Infof("inserting nat prerouting rule %q at position %d", rule.Rule, insertPosition)

‎talos.mk‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ TALOS_UNDERLAY_EXCLUDE_IPS_DUAL = $(TALOS_UNDERLAY_EXCLUDE_IPS_IPV4),$(TALOS_UND
4848
# geneve causes kernel panic on my local libvirt virtual machines
4949
# use vxlan instead
5050
TALOS_TUNNEL_TYPE = vxlan
51-
ifeq ($(shell echo $${CI:-false}),true)
51+
ifeq ($(or $(CI),false),true)
5252
TALOS_TUNNEL_TYPE = geneve
5353
endif
5454

@@ -278,6 +278,8 @@ talos-install: talos-install-prepare
278278
OPENVSWITCH_DIR=/var/lib/openvswitch \
279279
DISABLE_MODULES_MANAGEMENT=true \
280280
MOUNT_LOCAL_BIN_DIR=false \
281+
ENABLE_TPROXY=true \
282+
IMAGE_PULL_POLICY=Always \
281283
TUNNEL_TYPE=$(TALOS_TUNNEL_TYPE) \
282284
$(MAKE) install-chart
283285

0 commit comments

Comments
 (0)