Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Periodically verify that all required NodePortLocal iptables rules are present in the Node #2210

Closed
antoninbas opened this issue May 26, 2021 · 5 comments
Closed

Periodically verify that all required NodePortLocal iptables rules are present in the Node #2210

antoninbas opened this issue May 26, 2021 · 5 comments
Assignees
@edwardbadboy
Labels
area/proxy/nodeportlocal Issues or PRs related to the NodePortLocal feature good first issue Good for newcomers kind/design Categorizes issue or PR as related to design. lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale.

Comments

@antoninbas
Copy link
Contributor

Describe what you are trying to solve
This issue is similar to #628. In #1751, we added support to periodically sync-up iptables rules. However that PR didn't cover the NodePortLocal iptables rules (https://github.com/antrea-io/antrea/blob/main/pkg/agent/nodeportlocal/rules/iptable_rule.go), probably because PRs were merged at around the same time (v0.13.0 release).

Describe the solution you have in mind
We should add similar logic to periodically verify that all expected NodePortLocal iptables are present.

Describe how your solution impacts user flows
Nothing changes for the user, the Antrea NodePortLocal feature becomes more robust.

Describe the main design/architecture of your solution
There are 2 types of rules:

  • "static" rules used to link the OUTPUT and PREROUTING chains to the ANTREA-NODE-PORT-LOCAL chain in the nat table.
  • individual DNAT rules in the ANTREA-NODE-PORT-LOCAL chain for each (Pod, Port) tuple for which NodePortLocal is enabled

A new sync method can be added to

antrea/pkg/agent/nodeportlocal/k8s/npl_controller.go

Line 48 in 87c772d

type NPLController struct {

and invoked in a loop from a new goroutine. It can take care of installing both types of routes. Note that for the second type of rules (individual DNAT rules), all the information can be found in

antrea/pkg/agent/nodeportlocal/portcache/port_table.go

Lines 33 to 39 in 87c772d

type PortTable struct {
Table map[int]NodePortData
StartPort int
EndPort int
PodPortRules rules.PodPortRules
tableLock sync.RWMutex
}

Test plan
Add an integration test like in #1751 to validate that iptables rules deleted manually are restored automatically.
@antoninbas antoninbas added kind/design Categorizes issue or PR as related to design. area/proxy/nodeportlocal Issues or PRs related to the NodePortLocal feature good first issue Good for newcomers labels May 26, 2021
@github-actions
Copy link
Contributor

This issue is stale because it has been open 180 days with no activity. Remove stale label or comment, or this will be closed in 180 days

@github-actions github-actions bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Nov 23, 2021
@antoninbas antoninbas removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Nov 30, 2021
@edwardbadboy edwardbadboy self-assigned this Feb 9, 2022
NamanAg30 pushed a commit to NamanAg30/antrea that referenced this issue Mar 16, 2022
Periodic Syncing of npl iptable rules.
8543580 
The iptable rules can be deleted by mistake.This patch is used to call a function to ensure that the rules are restored automatically in such a situation.

Also integration test was added.

fixes antrea-io#2210
NamanAg30 pushed a commit to NamanAg30/antrea that referenced this issue Mar 18, 2022
@NamanAg30
Periodic Syncing of NPL iptables Rules
ca2bb4a 
The iptables rules can be deleted by mistake. This patch is used to
call a function to ensure that the rules are restored automatically
in such a situation.

Also integration test was added.

fixes antrea-io#2210
@NamanAg30 NamanAg30 mentioned this issue Mar 18, 2022
Closed
NamanAg30 pushed a commit to NamanAg30/antrea that referenced this issue Mar 25, 2022
@NamanAg30
Periodic Syncing of NPL iptables Rules
df8a6f0 
The iptables rules can be deleted by mistake. This patch is used to
call a function to ensure that the rules are restored automatically
in such a situation.

Also integration test was added. Some fake pod data was taken
and some initial iptables rules were added. Rules were deleted
 and we checked wheteher they were restored periodically.

fixes antrea-io#2210
NamanAg30 pushed a commit to NamanAg30/antrea that referenced this issue Mar 25, 2022
@NamanAg30
Periodic Syncing of NPL iptables Rules
ddd4457 
The iptables rules can be deleted by mistake. This patch is used to
call a function to ensure that the rules are restored automatically
in such a situation.

Also integration test was added.It adds some NPL iptables rules, and delete the
rules and check if the rules are recovered automatcally.

fixes antrea-io#2210
NamanAg30 pushed a commit to NamanAg30/antrea that referenced this issue Apr 1, 2022
@NamanAg30
Periodic Syncing of NPL iptables Rules
a5da6fd 
The iptables rules can be deleted by mistake. This patch is used to
call a function to ensure that the rules are restored automatically
in such a situation.

Also integration test was added.It adds some NPL iptables rules, and delete the
rules and check if the rules are recovered automatcally.

fixes antrea-io#2210
NamanAg30 pushed a commit to NamanAg30/antrea that referenced this issue Apr 13, 2022
@NamanAg30
Periodic Syncing of NPL iptables Rules
dcd057d 
The iptables rules can be deleted by mistake. This patch is used to
call a function to ensure that the rules are restored automatically
in such a situation.

Also integration test was added.It adds some NPL iptables rules, and delete the
rules and check if the rules are recovered automatcally.

fixes antrea-io#2210
NamanAg30 pushed a commit to NamanAg30/antrea that referenced this issue Apr 13, 2022
@NamanAg30
Periodic Syncing of NPL iptables Rules
a935177 
The iptables rules can be deleted by mistake. This patch is used to
call a function to ensure that the rules are restored automatically
in such a situation.

Also integration test was added.It adds some NPL iptables rules, and delete the
rules and check if the rules are recovered automatcally.

fixes antrea-io#2210
NamanAg30 pushed a commit to NamanAg30/antrea that referenced this issue Apr 29, 2022
@NamanAg30
Periodic Syncing of NPL iptables Rules
89bbcd4 
The iptables rules can be deleted by mistake. This patch is used to
call a function to ensure that the rules are restored automatically
in such a situation.

Also integration test was added.It adds some NPL iptables rules, and delete the
rules and check if the rules are recovered automatcally.

fixes antrea-io#2210
@github-actions
Copy link
Contributor

This issue is stale because it has been open 90 days with no activity. Remove stale label or comment, or this will be closed in 90 days

@github-actions github-actions bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label May 11, 2022
@github-actions github-actions bot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jul 28, 2022
@github-actions
Copy link
Contributor

This issue is stale because it has been open 90 days with no activity. Remove stale label or comment, or this will be closed in 90 days

@github-actions github-actions bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Oct 27, 2022
@antoninbas antoninbas removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Oct 27, 2022
@github-actions
Copy link
Contributor

This issue is stale because it has been open 90 days with no activity. Remove stale label or comment, or this will be closed in 90 days

@github-actions github-actions bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jan 26, 2023
@antoninbas antoninbas removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jan 26, 2023
@github-actions
Copy link
Contributor

This issue is stale because it has been open 90 days with no activity. Remove stale label or comment, or this will be closed in 90 days

@github-actions github-actions bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Apr 27, 2023
@github-actions github-actions bot closed this as not planned Won't fix, can't repro, duplicate, stale Jul 26, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@edwardbadboy edwardbadboy

Labels
area/proxy/nodeportlocal Issues or PRs related to the NodePortLocal feature good first issue Good for newcomers kind/design Categorizes issue or PR as related to design. lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale.
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Periodic Syncing of NPL iptables Rules NamanAg30/antrea
2 participants
@edwardbadboy @antoninbas