186 lines
9.7 KiB
Go
186 lines
9.7 KiB
Go
/*
|
|
Copyright 2017 The Kubernetes Authors.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package v1alpha1
|
|
|
|
import (
|
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
|
componentbaseconfigv1alpha1 "k8s.io/component-base/config/v1alpha1"
|
|
)
|
|
|
|
// KubeProxyIPTablesConfiguration contains iptables-related configuration
|
|
// details for the Kubernetes proxy server.
|
|
type KubeProxyIPTablesConfiguration struct {
|
|
// masqueradeBit is the bit of the iptables fwmark space to use for SNAT if using
|
|
// the pure iptables proxy mode. Values must be within the range [0, 31].
|
|
MasqueradeBit *int32 `json:"masqueradeBit"`
|
|
// masqueradeAll tells kube-proxy to SNAT everything if using the pure iptables proxy mode.
|
|
MasqueradeAll bool `json:"masqueradeAll"`
|
|
// syncPeriod is the period that iptables rules are refreshed (e.g. '5s', '1m',
|
|
// '2h22m'). Must be greater than 0.
|
|
SyncPeriod metav1.Duration `json:"syncPeriod"`
|
|
// minSyncPeriod is the minimum period that iptables rules are refreshed (e.g. '5s', '1m',
|
|
// '2h22m').
|
|
MinSyncPeriod metav1.Duration `json:"minSyncPeriod"`
|
|
}
|
|
|
|
// KubeProxyIPVSConfiguration contains ipvs-related configuration
|
|
// details for the Kubernetes proxy server.
|
|
type KubeProxyIPVSConfiguration struct {
|
|
// syncPeriod is the period that ipvs rules are refreshed (e.g. '5s', '1m',
|
|
// '2h22m'). Must be greater than 0.
|
|
SyncPeriod metav1.Duration `json:"syncPeriod"`
|
|
// minSyncPeriod is the minimum period that ipvs rules are refreshed (e.g. '5s', '1m',
|
|
// '2h22m').
|
|
MinSyncPeriod metav1.Duration `json:"minSyncPeriod"`
|
|
// ipvs scheduler
|
|
Scheduler string `json:"scheduler"`
|
|
// excludeCIDRs is a list of CIDR's which the ipvs proxier should not touch
|
|
// when cleaning up ipvs services.
|
|
ExcludeCIDRs []string `json:"excludeCIDRs"`
|
|
// strict ARP configure arp_ignore and arp_announce to avoid answering ARP queries
|
|
// from kube-ipvs0 interface
|
|
StrictARP bool `json:"strictARP"`
|
|
// tcpTimeout is the timeout value used for idle IPVS TCP sessions.
|
|
// The default value is 0, which preserves the current timeout value on the system.
|
|
TCPTimeout metav1.Duration `json:"tcpTimeout"`
|
|
// tcpFinTimeout is the timeout value used for IPVS TCP sessions after receiving a FIN.
|
|
// The default value is 0, which preserves the current timeout value on the system.
|
|
TCPFinTimeout metav1.Duration `json:"tcpFinTimeout"`
|
|
// udpTimeout is the timeout value used for IPVS UDP packets.
|
|
// The default value is 0, which preserves the current timeout value on the system.
|
|
UDPTimeout metav1.Duration `json:"udpTimeout"`
|
|
}
|
|
|
|
// KubeProxyConntrackConfiguration contains conntrack settings for
|
|
// the Kubernetes proxy server.
|
|
type KubeProxyConntrackConfiguration struct {
|
|
// maxPerCore is the maximum number of NAT connections to track
|
|
// per CPU core (0 to leave the limit as-is and ignore min).
|
|
MaxPerCore *int32 `json:"maxPerCore"`
|
|
// min is the minimum value of connect-tracking records to allocate,
|
|
// regardless of conntrackMaxPerCore (set maxPerCore=0 to leave the limit as-is).
|
|
Min *int32 `json:"min"`
|
|
// tcpEstablishedTimeout is how long an idle TCP connection will be kept open
|
|
// (e.g. '2s'). Must be greater than 0 to set.
|
|
TCPEstablishedTimeout *metav1.Duration `json:"tcpEstablishedTimeout"`
|
|
// tcpCloseWaitTimeout is how long an idle conntrack entry
|
|
// in CLOSE_WAIT state will remain in the conntrack
|
|
// table. (e.g. '60s'). Must be greater than 0 to set.
|
|
TCPCloseWaitTimeout *metav1.Duration `json:"tcpCloseWaitTimeout"`
|
|
}
|
|
|
|
// KubeProxyWinkernelConfiguration contains Windows/HNS settings for
|
|
// the Kubernetes proxy server.
|
|
type KubeProxyWinkernelConfiguration struct {
|
|
// networkName is the name of the network kube-proxy will use
|
|
// to create endpoints and policies
|
|
NetworkName string `json:"networkName"`
|
|
// sourceVip is the IP address of the source VIP endoint used for
|
|
// NAT when loadbalancing
|
|
SourceVip string `json:"sourceVip"`
|
|
// enableDSR tells kube-proxy whether HNS policies should be created
|
|
// with DSR
|
|
EnableDSR bool `json:"enableDSR"`
|
|
}
|
|
|
|
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
|
|
|
|
// KubeProxyConfiguration contains everything necessary to configure the
|
|
// Kubernetes proxy server.
|
|
type KubeProxyConfiguration struct {
|
|
metav1.TypeMeta `json:",inline"`
|
|
|
|
// featureGates is a map of feature names to bools that enable or disable alpha/experimental features.
|
|
FeatureGates map[string]bool `json:"featureGates,omitempty"`
|
|
|
|
// bindAddress is the IP address for the proxy server to serve on (set to 0.0.0.0
|
|
// for all interfaces)
|
|
BindAddress string `json:"bindAddress"`
|
|
// healthzBindAddress is the IP address and port for the health check server to serve on,
|
|
// defaulting to 0.0.0.0:10256
|
|
HealthzBindAddress string `json:"healthzBindAddress"`
|
|
// metricsBindAddress is the IP address and port for the metrics server to serve on,
|
|
// defaulting to 127.0.0.1:10249 (set to 0.0.0.0 for all interfaces)
|
|
MetricsBindAddress string `json:"metricsBindAddress"`
|
|
// bindAddressHardFail, if true, kube-proxy will treat failure to bind to a port as fatal and exit
|
|
BindAddressHardFail bool `json:"bindAddressHardFail"`
|
|
// enableProfiling enables profiling via web interface on /debug/pprof handler.
|
|
// Profiling handlers will be handled by metrics server.
|
|
EnableProfiling bool `json:"enableProfiling"`
|
|
// clusterCIDR is the CIDR range of the pods in the cluster. It is used to
|
|
// bridge traffic coming from outside of the cluster. If not provided,
|
|
// no off-cluster bridging will be performed.
|
|
ClusterCIDR string `json:"clusterCIDR"`
|
|
// hostnameOverride, if non-empty, will be used as the identity instead of the actual hostname.
|
|
HostnameOverride string `json:"hostnameOverride"`
|
|
// clientConnection specifies the kubeconfig file and client connection settings for the proxy
|
|
// server to use when communicating with the apiserver.
|
|
ClientConnection componentbaseconfigv1alpha1.ClientConnectionConfiguration `json:"clientConnection"`
|
|
// iptables contains iptables-related configuration options.
|
|
IPTables KubeProxyIPTablesConfiguration `json:"iptables"`
|
|
// ipvs contains ipvs-related configuration options.
|
|
IPVS KubeProxyIPVSConfiguration `json:"ipvs"`
|
|
// oomScoreAdj is the oom-score-adj value for kube-proxy process. Values must be within
|
|
// the range [-1000, 1000]
|
|
OOMScoreAdj *int32 `json:"oomScoreAdj"`
|
|
// mode specifies which proxy mode to use.
|
|
Mode ProxyMode `json:"mode"`
|
|
// portRange is the range of host ports (beginPort-endPort, inclusive) that may be consumed
|
|
// in order to proxy service traffic. If unspecified (0-0) then ports will be randomly chosen.
|
|
PortRange string `json:"portRange"`
|
|
// udpIdleTimeout is how long an idle UDP connection will be kept open (e.g. '250ms', '2s').
|
|
// Must be greater than 0. Only applicable for proxyMode=userspace.
|
|
UDPIdleTimeout metav1.Duration `json:"udpIdleTimeout"`
|
|
// conntrack contains conntrack-related configuration options.
|
|
Conntrack KubeProxyConntrackConfiguration `json:"conntrack"`
|
|
// configSyncPeriod is how often configuration from the apiserver is refreshed. Must be greater
|
|
// than 0.
|
|
ConfigSyncPeriod metav1.Duration `json:"configSyncPeriod"`
|
|
// nodePortAddresses is the --nodeport-addresses value for kube-proxy process. Values must be valid
|
|
// IP blocks. These values are as a parameter to select the interfaces where nodeport works.
|
|
// In case someone would like to expose a service on localhost for local visit and some other interfaces for
|
|
// particular purpose, a list of IP blocks would do that.
|
|
// If set it to "127.0.0.0/8", kube-proxy will only select the loopback interface for NodePort.
|
|
// If set it to a non-zero IP block, kube-proxy will filter that down to just the IPs that applied to the node.
|
|
// An empty string slice is meant to select all network interfaces.
|
|
NodePortAddresses []string `json:"nodePortAddresses"`
|
|
// winkernel contains winkernel-related configuration options.
|
|
Winkernel KubeProxyWinkernelConfiguration `json:"winkernel"`
|
|
// ShowHiddenMetricsForVersion is the version for which you want to show hidden metrics.
|
|
ShowHiddenMetricsForVersion string `json:"showHiddenMetricsForVersion"`
|
|
// DetectLocalMode determines mode to use for detecting local traffic, defaults to LocalModeClusterCIDR
|
|
DetectLocalMode LocalMode `json:"detectLocalMode"`
|
|
}
|
|
|
|
// Currently, three modes of proxy are available in Linux platform: 'userspace' (older, going to be EOL), 'iptables'
|
|
// (newer, faster), 'ipvs'(newest, better in performance and scalability).
|
|
//
|
|
// Two modes of proxy are available in Windows platform: 'userspace'(older, stable) and 'kernelspace' (newer, faster).
|
|
//
|
|
// In Linux platform, if proxy mode is blank, use the best-available proxy (currently iptables, but may change in the
|
|
// future). If the iptables proxy is selected, regardless of how, but the system's kernel or iptables versions are
|
|
// insufficient, this always falls back to the userspace proxy. IPVS mode will be enabled when proxy mode is set to 'ipvs',
|
|
// and the fall back path is firstly iptables and then userspace.
|
|
|
|
// In Windows platform, if proxy mode is blank, use the best-available proxy (currently userspace, but may change in the
|
|
// future). If winkernel proxy is selected, regardless of how, but the Windows kernel can't support this mode of proxy,
|
|
// this always falls back to the userspace proxy.
|
|
type ProxyMode string
|
|
|
|
// LocalMode represents modes to detect local traffic from the node
|
|
type LocalMode string
|