Commits on Feb 11, 2022

1. Use iptables-wrapper in Antrea container …

   Instead of iptables directly.
   Antrea uses a Ubuntu 20.04 base container image, for which the default iptables
   mode is "legacy". This may not match the iptables mode for the Node OS, which in
   turn can create issues:
    * Other K8s components (kubelet, kube-proxy) will create rules using the
      default iptables mode for the Node. Assumptions about evaluation order
      between these rules and the Antrea rules may break.
    * The required kernel module for the "legacy" mode (ip_tables) may not be
      available on the Node.
   
   The iptables-wrapper is meant to address these issues:
   https://github.com/kubernetes-sigs/iptables-wrappers. We install it in the
   Antrea container image. The first time Antrea invokes iptables, the wrapper will
   determine the underlying iptables mode (for the Node OS) and adjust the iptables
   symlinks in the container.
   
   Fixes antrea-io#3243
   Fixes antrea-io#3274
   
   Signed-off-by: Antonin Bas <abas@vmware.com>

   

   antoninbas committed Feb 11, 2022
   Configuration menu

   • View commit details
   • Copy full SHA for 4008941
   • Browse repository at this point

   Copy the full SHA

   4008941 View commit details

   Browse the repository at this point in the history