Add arg min-port=1024 to dnsmasq container in kube-dns

[nr17]

Do not use ports less than that given as source for outbound DNS queries. Dnsmasq picks random ports as source for outbound queries: when this option is given, the ports used will always to larger than that specified. Useful for systems behind firewalls.

More information: Kubernetes kube-dns uses dnsmasq version 2.78 (http://www.thekelleys.org.uk/dnsmasq/dnsmasq-2.78.tar.xz), which doesn't set the default min_port to 1024 (probably a bug). Later versions of dnsmasq have fixed this issue and don't need explicit min-port command-line argument.

[k8s-ci-robot]

Hi @nr17. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[nr17]

/assign @andrewsykim

[fejta-bot]

Unknown CLA label state. Rechecking for CLA labels.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/check-cla

[nr17]

@andrewsykim Any feedback for me?

[nr17]

@justinsb @mikesplain can you please provide some comments on this pr.

[andrewsykim]

/ok-to-test

If later versions of dnsmasq started to default --min-port=1024 then lgtm. @nr17 do you know which version of dnsmaq added this default?

[nr17]

/ok-to-test

If later versions of dnsmasq started to default --min-port=1024 then lgtm. @nr17 do you know which version of dnsmaq added this default?

They fixed it in version 2.79 with this change:

• baf553d Default min-port to 1024 to avoid reserved ports. (1 year, 5 months ago)

[nr17]

/ok-to-test
If later versions of dnsmasq started to default --min-port=1024 then lgtm. @nr17 do you know which version of dnsmaq added this default?

They fixed it in version 2.79 with this change:

• baf553d Default min-port to 1024 to avoid reserved ports. (1 year, 5 months ago)

Their changelog doesn’t mention it explictly. I had to do a git log to find it.
http://www.thekelleys.org.uk/dnsmasq/CHANGELOG

git clone git://thekelleys.org.uk/dnsmasq.git
dnsmasq (master) $ git log --graph --pretty=format:"%C(green)%h%Creset%C(red)%d%Creset %s %C(bold blue)<%an>%Creset %C(green)(%cr)" --abbrev-commit | grep min-port

• baf553d Default min-port to 1024 to avoid reserved ports. (1 year, 5 months ago)
  dnsmasq (master) $

You can verify the version in which it was fixed by examining the git log using : git log --graph --pretty=format:"%C(green)%h%Creset%C(red)%d%Creset %s %C(bold blue)<%an>%Creset %C(green)(%cr)" --abbrev-commit

[andrewsykim]

Thanks for verifying @nr17.

/lgtm
/assign @justinsb

[justinsb]

Thanks @nr17 and sorry for the delay... it's a tricky one to figure out, but worst case this matches the default that will be set when we (eventually) update dnsmasq! I'm not entirely sure how you found it :-)

/approve
/lgtm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: justinsb, nr17

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [justinsb]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[rifelpet]

/test pull-kops-bazel-test
/test pull-kops-verify-gomod

[rifelpet]

@nr17 can you update these manifest hashes with their new values according to the failed pull-kops-bazel-test job's output?

[nr17]

/test pull-kops-bazel-test

[nr17]

@rifelpet I changed the manifest hashes in upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/simple/manifest.yaml but the tests still fail.
I see that the hashes are present in upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/kopeio-vxlan/manifest.yaml, upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/weave/manifest.yaml and upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/cilium/manifest.yaml as well.
Need to change all ?

[rifelpet]

@nr17 ah yes you'll probably need to update them all. I believe the hack/update-expected.sh script will update them for you too.

[nr17]

@justinsb can I get the final approval for this. I corrected the manifest hashes for the updated yamls.

[andrewsykim]

/lgtm