iptables

Documentation

Index

• Constants
• func CanUseIPTablesProxier(iptver Versioner, kcompat KernelCompatTester) (bool, error)
• func CleanupLeftovers(ipt utiliptables.Interface) (encounteredError bool)
• type KernelCompatTester
• type LinuxKernelCompatTester
  • func (lkct LinuxKernelCompatTester) IsCompatible() error
• type Proxier
  • func NewProxier(ipt utiliptables.Interface, sysctl utilsysctl.Interface, ...) (*Proxier, error)
  • func (proxier *Proxier) OnEndpointsAdd(endpoints *v1.Endpoints)
  • func (proxier *Proxier) OnEndpointsDelete(endpoints *v1.Endpoints)
  • func (proxier *Proxier) OnEndpointsSynced()
  • func (proxier *Proxier) OnEndpointsUpdate(oldEndpoints, endpoints *v1.Endpoints)
  • func (proxier *Proxier) OnServiceAdd(service *v1.Service)
  • func (proxier *Proxier) OnServiceDelete(service *v1.Service)
  • func (proxier *Proxier) OnServiceSynced()
  • func (proxier *Proxier) OnServiceUpdate(oldService, service *v1.Service)
  • func (proxier *Proxier) Sync()
  • func (proxier *Proxier) SyncLoop()
• type Versioner

Constants

const (

	// KubeMarkMasqChain is the mark-for-masquerade chain
	KubeMarkMasqChain utiliptables.Chain = "KUBE-MARK-MASQ"

	// KubeMarkDropChain is the mark-for-drop chain
	KubeMarkDropChain utiliptables.Chain = "KUBE-MARK-DROP"
)

Functions

func CanUseIPTablesProxier

func CanUseIPTablesProxier(iptver Versioner, kcompat KernelCompatTester) (bool, error)

CanUseIPTablesProxier returns true if we should use the iptables Proxier instead of the "classic" userspace Proxier. This is determined by checking the iptables version and for the existence of kernel features. It may return an error if it fails to get the iptables version without error, in which case it will also return false.

func CleanupLeftovers

func CleanupLeftovers(ipt utiliptables.Interface) (encounteredError bool)

CleanupLeftovers removes all iptables rules and chains created by the Proxier It returns true if an error was encountered. Errors are logged.

Types

type KernelCompatTester

type KernelCompatTester interface {
	IsCompatible() error
}

KernelCompatTester tests whether the required kernel capabilities are present to run the iptables proxier.

type LinuxKernelCompatTester

type LinuxKernelCompatTester struct{}

LinuxKernelCompatTester is the Linux implementation of KernelCompatTester

func (LinuxKernelCompatTester) IsCompatible

func (lkct LinuxKernelCompatTester) IsCompatible() error

IsCompatible checks for the required sysctls. We don't care about the value, just that it exists. If this Proxier is chosen, we'll initialize it as we need.

type Proxier

type Proxier struct {
	// contains filtered or unexported fields
}

Proxier is an iptables based proxy for connections between a localhost:lport and services that provide the actual backends.

func NewProxier

func NewProxier(ipt utiliptables.Interface,
	sysctl utilsysctl.Interface,
	exec utilexec.Interface,
	syncPeriod time.Duration,
	minSyncPeriod time.Duration,
	masqueradeAll bool,
	masqueradeBit int,
	clusterCIDR string,
	hostname string,
	nodeIP net.IP,
	recorder record.EventRecorder,
	healthzServer healthcheck.HealthzUpdater,
	nodePortAddresses []string,
) (*Proxier, error)

NewProxier returns a new Proxier given an iptables Interface instance. Because of the iptables logic, it is assumed that there is only a single Proxier active on a machine. An error will be returned if iptables fails to update or acquire the initial lock. Once a proxier is created, it will keep iptables up to date in the background and will not terminate if a particular iptables call fails.

func (*Proxier) OnEndpointsAdd

func (proxier *Proxier) OnEndpointsAdd(endpoints *v1.Endpoints)

OnEndpointsAdd is called whenever creation of new endpoints object is observed.

func (*Proxier) OnEndpointsDelete

func (proxier *Proxier) OnEndpointsDelete(endpoints *v1.Endpoints)

OnEndpointsDelete is called whever deletion of an existing endpoints object is observed.

func (*Proxier) OnEndpointsSynced

func (proxier *Proxier) OnEndpointsSynced()

OnEndpointsSynced is called once all the initial event handlers were called and the state is fully propagated to local cache.

func (*Proxier) OnEndpointsUpdate

func (proxier *Proxier) OnEndpointsUpdate(oldEndpoints, endpoints *v1.Endpoints)

OnEndpointsUpdate is called whenever modification of an existing endpoints object is observed.

func (*Proxier) OnServiceAdd

func (proxier *Proxier) OnServiceAdd(service *v1.Service)

OnServiceAdd is called whenever creation of new service object is observed.

func (*Proxier) OnServiceDelete

func (proxier *Proxier) OnServiceDelete(service *v1.Service)

OnServiceDelete is called whenever deletion of an existing service object is observed.

func (*Proxier) OnServiceSynced

func (proxier *Proxier) OnServiceSynced()

OnServiceSynced is called once all the initial even handlers were called and the state is fully propagated to local cache.

func (*Proxier) OnServiceUpdate

func (proxier *Proxier) OnServiceUpdate(oldService, service *v1.Service)

OnServiceUpdate is called whenever modification of an existing service object is observed.

func (*Proxier) Sync

func (proxier *Proxier) Sync()

Sync is called to synchronize the proxier state to iptables as soon as possible.

func (*Proxier) SyncLoop

func (proxier *Proxier) SyncLoop()

SyncLoop runs periodic work. This is expected to run as a goroutine or as the main loop of the app. It does not return.

type Versioner

type Versioner interface {
	// returns "X.Y.Z"
	GetVersion() (string, error)
}

Versioner can query the current iptables version.