kubernetes
/
kops
mirror of https://github.com/kubernetes/kops.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Ensure iptables forwarding is enabled 

Docker 1.13 changed how it set up iptables in a way that broke
forwarding.

We previously got away with it because we set the ip_forward sysctl,
which meant that docker wouldn't change the rule.  But if we're using an
image that preinstalled docker, docker might have already reconfigured
iptables before we run, and we didn't set it back.

We now set it back.

https://github.com/kubernetes/kubernetes/issues/40182
This commit is contained in:
Justin Santa Barbara 2017-11-30 19:44:33 -05:00
parent cf70f997e2
commit 7fa4c28b1b
2 changed files with 8 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
nodeup/pkg/model/firewall.go
View File

@ -17,12 +17,10 @@ limitations under the License.
package model package model
import ( import (
"k8s.io/kops/nodeup/pkg/distros" "github.com/golang/glog"
"k8s.io/kops/pkg/systemd" "k8s.io/kops/pkg/systemd"
"k8s.io/kops/upup/pkg/fi" "k8s.io/kops/upup/pkg/fi"
"k8s.io/kops/upup/pkg/fi/nodeup/nodetasks" "k8s.io/kops/upup/pkg/fi/nodeup/nodetasks"
"github.com/golang/glog"
) )
// FirewallBuilder configures the firewall (iptables) // FirewallBuilder configures the firewall (iptables)
@ -34,10 +32,9 @@ var _ fi.ModelBuilder = &FirewallBuilder{}
// Build is responsible for generating any node firewall rules // Build is responsible for generating any node firewall rules
func (b *FirewallBuilder) Build(c *fi.ModelBuilderContext) error { func (b *FirewallBuilder) Build(c *fi.ModelBuilderContext) error {
if b.Distribution == distros.DistributionContainerOS { // We need forwarding enabled (https://github.com/kubernetes/kubernetes/issues/40182)
c.AddTask(b.buildFirewallScript()) c.AddTask(b.buildFirewallScript())
c.AddTask(b.buildSystemdService()) c.AddTask(b.buildSystemdService())
}
return nil return nil
} }

5
nodeup/pkg/model/sysctls.go
View File

@ -115,13 +115,10 @@ func (b *SysctlBuilder) Build(c *fi.ModelBuilderContext) error {
"") "")
} }
if b.Cluster.Spec.CloudProvider == string(kops.CloudProviderGCE) {
sysctls = append(sysctls, sysctls = append(sysctls,
"# GCE settings", "# Prevent docker from changing iptables: https://github.com/kubernetes/kubernetes/issues/40182",
"",
"net.ipv4.ip_forward=1", "net.ipv4.ip_forward=1",
"") "")
}
t := &nodetasks.File{ t := &nodetasks.File{
Path: "/etc/sysctl.d/99-k8s-general.conf", Path: "/etc/sysctl.d/99-k8s-general.conf",