From a20735141c9b885972522ca43242b45b21084780 Mon Sep 17 00:00:00 2001 From: Laurent Bernaille Date: Tue, 12 Mar 2019 13:50:29 +0100 Subject: [PATCH] Add flag to enable strict ARP --- cmd/kube-proxy/app/server.go | 1 + cmd/kube-proxy/app/server_others.go | 1 + pkg/proxy/apis/config/types.go | 3 +++ .../v1alpha1/zz_generated.conversion.go | 2 ++ pkg/proxy/ipvs/proxier.go | 25 +++++++++++-------- pkg/proxy/ipvs/proxier_test.go | 1 + .../kube-proxy/config/v1alpha1/types.go | 3 +++ 7 files changed, 26 insertions(+), 10 deletions(-) diff --git a/cmd/kube-proxy/app/server.go b/cmd/kube-proxy/app/server.go index b30d9b3b74..86d94a06a1 100644 --- a/cmd/kube-proxy/app/server.go +++ b/cmd/kube-proxy/app/server.go @@ -166,6 +166,7 @@ func (o *Options) AddFlags(fs *pflag.FlagSet) { fs.DurationVar(&o.config.IPVS.SyncPeriod.Duration, "ipvs-sync-period", o.config.IPVS.SyncPeriod.Duration, "The maximum interval of how often ipvs rules are refreshed (e.g. '5s', '1m', '2h22m'). Must be greater than 0.") fs.DurationVar(&o.config.IPVS.MinSyncPeriod.Duration, "ipvs-min-sync-period", o.config.IPVS.MinSyncPeriod.Duration, "The minimum interval of how often the ipvs rules can be refreshed as endpoints and services change (e.g. '5s', '1m', '2h22m').") fs.StringSliceVar(&o.config.IPVS.ExcludeCIDRs, "ipvs-exclude-cidrs", o.config.IPVS.ExcludeCIDRs, "A comma-separated list of CIDR's which the ipvs proxier should not touch when cleaning up IPVS rules.") + fs.BoolVar(&o.config.IPVS.StrictARP, "ipvs-strict-arp", o.config.IPVS.StrictARP, "Enable strict ARP by setting arp_ignore to 1 and arp_announce to 2") fs.DurationVar(&o.config.ConfigSyncPeriod.Duration, "config-sync-period", o.config.ConfigSyncPeriod.Duration, "How often configuration from the apiserver is refreshed. Must be greater than 0.") fs.BoolVar(&o.config.IPTables.MasqueradeAll, "masquerade-all", o.config.IPTables.MasqueradeAll, "If using the pure iptables proxy, SNAT all traffic sent via Service cluster IPs (this not commonly needed)") fs.StringVar(&o.config.ClusterCIDR, "cluster-cidr", o.config.ClusterCIDR, "The CIDR range of pods in the cluster. When configured, traffic sent to a Service cluster IP from outside this range will be masqueraded and traffic sent from pods to an external LoadBalancer IP will be directed to the respective cluster IP instead") diff --git a/cmd/kube-proxy/app/server_others.go b/cmd/kube-proxy/app/server_others.go index a92c1492f5..d8bd8614e7 100644 --- a/cmd/kube-proxy/app/server_others.go +++ b/cmd/kube-proxy/app/server_others.go @@ -196,6 +196,7 @@ func newProxyServer( config.IPVS.SyncPeriod.Duration, config.IPVS.MinSyncPeriod.Duration, config.IPVS.ExcludeCIDRs, + config.IPVS.StrictARP, config.IPTables.MasqueradeAll, int(*config.IPTables.MasqueradeBit), config.ClusterCIDR, diff --git a/pkg/proxy/apis/config/types.go b/pkg/proxy/apis/config/types.go index a9d0b88493..30ca9de393 100644 --- a/pkg/proxy/apis/config/types.go +++ b/pkg/proxy/apis/config/types.go @@ -55,6 +55,9 @@ type KubeProxyIPVSConfiguration struct { // excludeCIDRs is a list of CIDR's which the ipvs proxier should not touch // when cleaning up ipvs services. ExcludeCIDRs []string + // strict ARP configure arp_ignore and arp_announce to avoid answering ARP queries + // from kube-ipvs0 interface + StrictARP bool } // KubeProxyConntrackConfiguration contains conntrack settings for diff --git a/pkg/proxy/apis/config/v1alpha1/zz_generated.conversion.go b/pkg/proxy/apis/config/v1alpha1/zz_generated.conversion.go index c360ab20af..502fa11221 100644 --- a/pkg/proxy/apis/config/v1alpha1/zz_generated.conversion.go +++ b/pkg/proxy/apis/config/v1alpha1/zz_generated.conversion.go @@ -226,6 +226,7 @@ func autoConvert_v1alpha1_KubeProxyIPVSConfiguration_To_config_KubeProxyIPVSConf out.MinSyncPeriod = in.MinSyncPeriod out.Scheduler = in.Scheduler out.ExcludeCIDRs = *(*[]string)(unsafe.Pointer(&in.ExcludeCIDRs)) + out.StrictARP = in.StrictARP return nil } @@ -239,6 +240,7 @@ func autoConvert_config_KubeProxyIPVSConfiguration_To_v1alpha1_KubeProxyIPVSConf out.MinSyncPeriod = in.MinSyncPeriod out.Scheduler = in.Scheduler out.ExcludeCIDRs = *(*[]string)(unsafe.Pointer(&in.ExcludeCIDRs)) + out.StrictARP = in.StrictARP return nil } diff --git a/pkg/proxy/ipvs/proxier.go b/pkg/proxy/ipvs/proxier.go index aa42fa73b8..c8c8563e65 100644 --- a/pkg/proxy/ipvs/proxier.go +++ b/pkg/proxy/ipvs/proxier.go @@ -194,7 +194,9 @@ type Proxier struct { syncPeriod time.Duration minSyncPeriod time.Duration // Values are CIDR's to exclude when cleaning up IPVS rules. - excludeCIDRs []string + excludeCIDRs []string + // Set to true to set sysctls arp_ignore and arp_announce + strictARP bool iptables utiliptables.Interface ipvs utilipvs.Interface ipset utilipset.Interface @@ -285,6 +287,7 @@ func NewProxier(ipt utiliptables.Interface, syncPeriod time.Duration, minSyncPeriod time.Duration, excludeCIDRs []string, + strictARP bool, masqueradeAll bool, masqueradeBit int, clusterCIDR string, @@ -344,17 +347,19 @@ func NewProxier(ipt utiliptables.Interface, } } - // Set the arp_ignore sysctl we need for - if val, _ := sysctl.GetSysctl(sysctlArpIgnore); val != 1 { - if err := sysctl.SetSysctl(sysctlArpIgnore, 1); err != nil { - return nil, fmt.Errorf("can't set sysctl %s: %v", sysctlArpIgnore, err) + if strictARP { + // Set the arp_ignore sysctl we need for + if val, _ := sysctl.GetSysctl(sysctlArpIgnore); val != 1 { + if err := sysctl.SetSysctl(sysctlArpIgnore, 1); err != nil { + return nil, fmt.Errorf("can't set sysctl %s: %v", sysctlArpIgnore, err) + } } - } - // Set the arp_announce sysctl we need for - if val, _ := sysctl.GetSysctl(sysctlArpAnnounce); val != 2 { - if err := sysctl.SetSysctl(sysctlArpAnnounce, 2); err != nil { - return nil, fmt.Errorf("can't set sysctl %s: %v", sysctlArpAnnounce, err) + // Set the arp_announce sysctl we need for + if val, _ := sysctl.GetSysctl(sysctlArpAnnounce); val != 2 { + if err := sysctl.SetSysctl(sysctlArpAnnounce, 2); err != nil { + return nil, fmt.Errorf("can't set sysctl %s: %v", sysctlArpAnnounce, err) + } } } diff --git a/pkg/proxy/ipvs/proxier_test.go b/pkg/proxy/ipvs/proxier_test.go index fe0da92359..3862124d47 100644 --- a/pkg/proxy/ipvs/proxier_test.go +++ b/pkg/proxy/ipvs/proxier_test.go @@ -155,6 +155,7 @@ func NewFakeProxier(ipt utiliptables.Interface, ipvs utilipvs.Interface, ipset u ipvs: ipvs, ipset: ipset, clusterCIDR: "10.0.0.0/24", + strictARP: false, hostname: testHostname, portsMap: make(map[utilproxy.LocalPort]utilproxy.Closeable), portMapper: &fakePortOpener{[]*utilproxy.LocalPort{}}, diff --git a/staging/src/k8s.io/kube-proxy/config/v1alpha1/types.go b/staging/src/k8s.io/kube-proxy/config/v1alpha1/types.go index b266a5c3d7..78b6a0e012 100644 --- a/staging/src/k8s.io/kube-proxy/config/v1alpha1/types.go +++ b/staging/src/k8s.io/kube-proxy/config/v1alpha1/types.go @@ -51,6 +51,9 @@ type KubeProxyIPVSConfiguration struct { // excludeCIDRs is a list of CIDR's which the ipvs proxier should not touch // when cleaning up ipvs services. ExcludeCIDRs []string `json:"excludeCIDRs"` + // strict ARP configure arp_ignore and arp_announce to avoid answering ARP queries + // from kube-ipvs0 interface + StrictARP bool `json:"strictARP"` } // KubeProxyConntrackConfiguration contains conntrack settings for