From 4b30d97d4e040626b476c687e23ede34fee00cc7 Mon Sep 17 00:00:00 2001 From: Murali Reddy Date: Tue, 10 Dec 2019 12:51:00 +0530 Subject: [PATCH 1/3] update alpine base image to 3.10 that has iptables ver 1.8.3 --- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile b/Makefile index 8bcbfabc..9e08a023 100644 --- a/Makefile +++ b/Makefile @@ -25,7 +25,7 @@ ifeq ($(ARCH),amd64) WEAVEEXEC_DOCKER_ARCH?=x86_64 # The name of the alpine baseimage to use as the base for weave images - ALPINE_BASEIMAGE?=alpine:3.8 + ALPINE_BASEIMAGE?=alpine:3.10 # The extension for the made images # Specifying none means for example weaveworks/weave:latest From 4f48670345239e4dc7201f8b336aad414a35d7dd Mon Sep 17 00:00:00 2001 From: Murali Reddy Date: Fri, 13 Dec 2019 06:12:29 +0530 Subject: [PATCH 2/3] set iptables backend to use if specified explicitly or auto-detect --- prog/weave-kube/launch.sh | 30 ++++++++++++++++++++++++++++++ prog/weave-npc/launch.sh | 30 ++++++++++++++++++++++++++++++ 2 files changed, 60 insertions(+) diff --git a/prog/weave-kube/launch.sh b/prog/weave-kube/launch.sh index b838c3ef..143208fe 100755 --- a/prog/weave-kube/launch.sh +++ b/prog/weave-kube/launch.sh @@ -6,6 +6,34 @@ modprobe_safe() { modprobe $1 || echo "Ignore the error if \"$1\" is built-in in the kernel" >&2 } +# Setup iptables backend to be legacy or nftable +setup_iptables_backend() { + if [ -n "${IPTABLES_BACKEND}" ]; then + mode=$IPTABLES_BACKEND + else + # auto-detect if iptables backend mode to use if not specified explicitly + num_legacy_lines=$( (iptables-legacy-save || true) 2>/dev/null | grep '^-' | wc -l) + num_nft_lines=$( (iptables-nft-save || true) 2>/dev/null | grep '^-' | wc -l) + if [ "${num_legacy_lines}" -ge 10 ]; then + mode="legacy" + else + if [ "${num_legacy_lines}" -ge "${num_nft_lines}" ]; then + mode="legacy" + else + mode="nft" + fi + fi + fi + if [ $mode = "nft" ]; then + rm /sbin/iptables + rm /sbin/iptables-save + rm /sbin/iptables-restore + ln /sbin/iptables-nft /sbin/iptables + ln /sbin/iptables-nft-save /sbin/iptables-save + ln /sbin/iptables-nft-restore /sbin/iptables-restore + fi +} + # Check whether xt_set actually exists xt_set_exists() { # Clean everything up in advance, in case there's leftovers @@ -24,6 +52,8 @@ xt_set_exists() { [ -z "$NOT_EXIST" ] || (echo "\"xt_set\" does not exist" >&2 && return 1) } +setup_iptables_backend + # Default if not supplied - same as weave net default IPALLOC_RANGE=${IPALLOC_RANGE:-10.32.0.0/12} HTTP_ADDR=${WEAVE_HTTP_ADDR:-127.0.0.1:6784} diff --git a/prog/weave-npc/launch.sh b/prog/weave-npc/launch.sh index 776ddd84..104eeb11 100755 --- a/prog/weave-npc/launch.sh +++ b/prog/weave-npc/launch.sh @@ -2,5 +2,35 @@ set -e +# Setup iptables backend to be legacy or nftable +setup_iptables_backend() { + if [ -n "${IPTABLES_BACKEND}" ]; then + mode=$IPTABLES_BACKEND + else + # auto-detect if iptables backend mode to use if not specified explicitly + num_legacy_lines=$( (iptables-legacy-save || true) 2>/dev/null | grep '^-' | wc -l) + num_nft_lines=$( (iptables-nft-save || true) 2>/dev/null | grep '^-' | wc -l) + if [ "${num_legacy_lines}" -ge 10 ]; then + mode="legacy" + else + if [ "${num_legacy_lines}" -ge "${num_nft_lines}" ]; then + mode="legacy" + else + mode="nft" + fi + fi + fi + if [ $mode = "nft" ]; then + rm /sbin/iptables + rm /sbin/iptables-save + rm /sbin/iptables-restore + ln /sbin/iptables-nft /sbin/iptables + ln /sbin/iptables-nft-save /sbin/iptables-save + ln /sbin/iptables-nft-restore /sbin/iptables-restore + fi +} + +setup_iptables_backend + # Start weave-npc with any flags specified in $EXTRA_ARGS as well as any flags passed to this container (for backwards compatibility) exec /usr/bin/weave-npc $EXTRA_ARGS $@ From 83024b946f231b1888e101c485ffcad0ece812d6 Mon Sep 17 00:00:00 2001 From: Murali Reddy Date: Wed, 8 Jan 2020 15:43:04 +0530 Subject: [PATCH 3/3] use softlinks to link iptables to backend specific commands and update docs --- prog/weave-kube/launch.sh | 6 +++--- prog/weave-npc/launch.sh | 6 +++--- site/kubernetes/kube-addon.md | 1 + 3 files changed, 7 insertions(+), 6 deletions(-) diff --git a/prog/weave-kube/launch.sh b/prog/weave-kube/launch.sh index 143208fe..0de63126 100755 --- a/prog/weave-kube/launch.sh +++ b/prog/weave-kube/launch.sh @@ -28,9 +28,9 @@ setup_iptables_backend() { rm /sbin/iptables rm /sbin/iptables-save rm /sbin/iptables-restore - ln /sbin/iptables-nft /sbin/iptables - ln /sbin/iptables-nft-save /sbin/iptables-save - ln /sbin/iptables-nft-restore /sbin/iptables-restore + ln -s /sbin/iptables-nft /sbin/iptables + ln -s /sbin/iptables-nft-save /sbin/iptables-save + ln -s /sbin/iptables-nft-restore /sbin/iptables-restore fi } diff --git a/prog/weave-npc/launch.sh b/prog/weave-npc/launch.sh index 104eeb11..baf8491e 100755 --- a/prog/weave-npc/launch.sh +++ b/prog/weave-npc/launch.sh @@ -24,9 +24,9 @@ setup_iptables_backend() { rm /sbin/iptables rm /sbin/iptables-save rm /sbin/iptables-restore - ln /sbin/iptables-nft /sbin/iptables - ln /sbin/iptables-nft-save /sbin/iptables-save - ln /sbin/iptables-nft-restore /sbin/iptables-restore + ln -s /sbin/iptables-nft /sbin/iptables + ln -s /sbin/iptables-nft-save /sbin/iptables-save + ln -s /sbin/iptables-nft-restore /sbin/iptables-restore fi } diff --git a/site/kubernetes/kube-addon.md b/site/kubernetes/kube-addon.md index 73fc836e..bbf3b58e 100644 --- a/site/kubernetes/kube-addon.md +++ b/site/kubernetes/kube-addon.md @@ -406,6 +406,7 @@ The list of variables you can set is: * `NO_MASQ_LOCAL` - set to 1 to preserve the client source IP address when accessing Service annotated with `service.spec.externalTrafficPolicy=Local`. The feature works only with Weave IPAM (default). +* `IPTABLES_BACKEND` - set to `nft` to use `nftables` backend for `iptables` (default is `iptables`) Example: ```