iptables: use the same mode with kube-proxy #2758
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What type of this PR
Which issue(s) this PR fixes:
Backport #2535 to release-1.11.
WHAT
🤖 Generated by Copilot at 3688ab3
This pull request adds support for both legacy and nft iptables modes in the kube-ovn project. It replaces the
github.com/coreos/go-iptables
library with a forked versiongithub.aaakk.us.kg/kubeovn/go-iptables
that can detect and handle both modes. It also updates the iptables rules and chains in thepkg/daemon/controller_linux.go
andpkg/daemon/gateway_linux.go
files to work with the correct iptables mode.🤖 Generated by Copilot at 3688ab3
HOW
🤖 Generated by Copilot at 3688ab3
github.com/coreos/go-iptables/iptables
withgithub.aaakk.us.kg/kubeovn/go-iptables/iptables
to support both legacy and nft iptables modes (link, link, link, link)iptablesObsolete
field toControllerRuntime
struct to store iptables handles for the obsolete mode (link)createIptablesRule
andupdateIptablesChain
functions to takeiptables.IPTables
instance as parameter instead of protocol string (link, link)ipt
parameter instead of iptables map from controller to create, insert, list, and delete iptables rules and chains (link, link, link, link, link, link)setIptables
function (link)ipt
to store iptables handle for the current mode and renameabandonedRules
toobsoleteRules
insetIptables
function (link, link)cleanObsoleteIptablesRules
function to delete obsolete rules and chains from the obsolete mode insetIptables
function (link)deleteLegacySnatRules
function todeleteObsoleteSnatRules
and useipt
parameter instead of iptables map from controller to delete obsolete snat rules (link, link)