Automated cherry pick of #3276: Use iptables-wrapper in Antrea container #3311
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Instead of iptables directly. Antrea uses a Ubuntu 20.04 base container image, for which the default iptables mode is "legacy". This may not match the iptables mode for the Node OS, which in turn can create issues: * Other K8s components (kubelet, kube-proxy) will create rules using the default iptables mode for the Node. Assumptions about evaluation order between these rules and the Antrea rules may break. * The required kernel module for the "legacy" mode (ip_tables) may not be available on the Node. The iptables-wrapper is meant to address these issues: https://github.com/kubernetes-sigs/iptables-wrappers. We install it in the Antrea container image. The first time Antrea invokes iptables, the wrapper will determine the underlying iptables mode (for the Node OS) and adjust the iptables symlinks in the container. Fixes antrea-io#3243 Fixes antrea-io#3274 Signed-off-by: Antonin Bas <abas@vmware.com>
antoninbas
added
the
kind/cherry-pick
Codecov Report
@@ Coverage Diff @@
## release-1.2 #3311 +/- ##
===============================================
- Coverage 60.58% 56.07% -4.51%
===============================================
Files 285 285
Lines 22397 22397
===============================================
- Hits 13569 12559 -1010
- Misses 7379 8492 +1113
+ Partials 1449 1346 -103
Flags with carried forward coverage won't be shown. Click here to find out more.
|
|
/test-all |
tnqn
approved these changes
Feb 14, 2022
|
Unrelated failures in e2e tests: |
antoninbas
deleted the
automated-cherry-pick-of-#3276-upstream-release-1.2
branch
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Cherry pick of #3276 on release-1.2.
#3276: Use iptables-wrapper in Antrea container
For details on the cherry pick process, see the cherry pick requests page.