Only run connection-rejecting rules on new connections #60306
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
k8s-ci-robot
added
release-note
k8s-ci-robot
added
the
cncf-cla: yes
danwinship
force-pushed
the
proxier-connstate-new
branch
from
3b0f847 to
2259416
Compare
|
/assign @dcbw |
thockin
reviewed
Feb 23, 2018
| {utiliptables.TableNAT, kubeServicesChain, utiliptables.ChainPrerouting, "kubernetes service portals"}, | ||
| {utiliptables.TableNAT, kubePostroutingChain, utiliptables.ChainPostrouting, "kubernetes postrouting rules"}, | ||
| {utiliptables.TableFilter, kubeForwardChain, utiliptables.ChainForward, "kubernetes forwarding rules"}, | ||
| {utiliptables.TableFilter, kubeExternalServicesChain, utiliptables.ChainInput, "kubernetes externally-visible service portals", []string{"-m", "conntrack", "--ctstate", "NEW"}}, |
There was a problem hiding this comment.
worth making a var for this slice?
|
/lgtm |
k8s-ci-robot
added
the
lgtm
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: danwinship, thockin The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
the
approved
|
also /lgtm |
|
/test all [submit-queue is verifying that this PR is safe to merge] |
|
/retest Review the full test history for this PR. Silence the bot with an |
|
/test all [submit-queue is verifying that this PR is safe to merge] |
|
/retest Review the full test history for this PR. Silence the bot with an |
|
/test all [submit-queue is verifying that this PR is safe to merge] |
|
/retest
…On Sat, Feb 24, 2018, 3:44 PM k8s-ci-robot ***@***.***> wrote:
@danwinship <https://github.com/danwinship>: The following test *failed*,
say /retest to rerun them all:
Test name Commit Details Rerun command
pull-kubernetes-unit 2259416
<2259416>
link
<https://k8s-gubernator.appspot.com/build/kubernetes-jenkins/pr-logs/pull/60306/pull-kubernetes-unit/82538/> /test
pull-kubernetes-unit
Full PR test history <https://k8s-gubernator.appspot.com/pr/60306>. Your
PR dashboard <https://k8s-gubernator.appspot.com/pr/danwinship>. Please
help us cut down on flakes by linking to
<https://git.k8s.io/community/contributors/devel/flaky-tests.md#filing-issues-for-flaky-tests>
an open issue
<https://github.com/kubernetes/kubernetes/issues?q=is:issue+is:open> when
you hit one in your PR.
Instructions for interacting with me using PR comments are available here
<https://git.k8s.io/community/contributors/devel/pull-requests.md>. If
you have questions or suggestions related to my behavior, please file an
issue against the kubernetes/test-infra
<https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:>
repository. I understand the commands that are listed here
<https://go.k8s.io/bot-commands>.
—
You are receiving this because you were assigned.
Reply to this email directly, view it on GitHub
<#60306 (comment)>,
or mute the thread
<https://github.com/notifications/unsubscribe-auth/AFVgVBb5ZKUTbXUms7KviyeIOItzkX6Aks5tYJ7egaJpZM4SQ6CB>
.
|
|
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions here. |
openshift-merge-robot
added a commit
to openshift/origin
that referenced
this pull request
Feb 27, 2018
Automatic merge from submit-queue (batch tested with PRs 18754, 18761). kube-proxy iptables performance fixes Pull in multiple upstream iptables fixes to improve performance in "very large clusters" (ie, Online). Includes kubernetes/kubernetes#57336, kubernetes/kubernetes#56164, kubernetes/kubernetes#57461, and kubernetes/kubernetes#60306. Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1514174
openshift-publish-robot
pushed a commit
to openshift/kubernetes
that referenced
this pull request
Feb 27, 2018
…-fixes Automatic merge from submit-queue (batch tested with PRs 18754, 18761). kube-proxy iptables performance fixes Pull in multiple upstream iptables fixes to improve performance in "very large clusters" (ie, Online). Includes kubernetes#57336, kubernetes#56164, kubernetes#57461, and kubernetes#60306. Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1514174 Origin-commit: e2e14cb4fe6a6789936da736d627ae96ca822116
openshift-publish-robot
pushed a commit
to openshift/kubernetes
that referenced
this pull request
Mar 5, 2018
…-fixes Automatic merge from submit-queue (batch tested with PRs 18754, 18761). kube-proxy iptables performance fixes Pull in multiple upstream iptables fixes to improve performance in "very large clusters" (ie, Online). Includes kubernetes#57336, kubernetes#56164, kubernetes#57461, and kubernetes#60306. Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1514174 Origin-commit: e2e14cb4fe6a6789936da736d627ae96ca822116
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Kube-proxy has two iptables chains full of rules to reject incoming connections to services that don't have any endpoints. Currently these rules get tested against all incoming packets, but that's unnecessary; if a connection to a given service has already been established, then we can't have been rejecting connections to that service. By only checking the first packet in each new connection, we can get rid of a lot of unnecessary checks on incoming traffic.
Fixes #56842
Release note: