Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Correct docs for AWS_VPC_K8S_CNI_RANDOMIZESNAT #556

Merged
merged 1 commit into from
Aug 1, 2019
Merged

Correct docs for AWS_VPC_K8S_CNI_RANDOMIZESNAT #556

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -143,10 +143,10 @@ private subnet and connected to the internet through an AWS NAT Gateway or anoth
Type: String
Default: `hashrandom`
Valid Values: `hashrandom`, `prng`, `none`
Specifies weather the SNAT `iptables` rule should randomize the outgoing ports for connections\. When enabled (`hashrandom`)
the `--random` flag will be added to the SNAT `iptables` rule\. This should be used when `AWS_VPC_K8S_CNI_EXTERNALSNAT=true`.
To use pseudo random number generation rather than hash based (i.e. `--random-fully`) use `prng` for the environment variable.
For old versions of `iptables` that do not support `--random-fully` this option will fall back to `--random`.
Specifies weather the SNAT `iptables` rule should randomize the outgoing ports for connections\. This should be used when
`AWS_VPC_K8S_CNI_EXTERNALSNAT=false`. When enabled (`hashrandom`) the `--random` flag will be added to the SNAT `iptables`
rule\. To use pseudo random number generation rather than hash based (i.e. `--random-fully`) use `prng` for the environment
variable. For old versions of `iptables` that do not support `--random-fully` this option will fall back to `--random`.
Disable (`none`) this functionality if you rely on sequential port allocation for outgoing connections.

*Note*: Any options other than `none` will cause outbound connections to be assigned a source port that's not necessarily part of the ephemeral port range set at the OS level (/proc/sys/net/ipv4/ip_local_port_range). This is relevant for any customers that might have NACLs restricting traffic based on the port range found in ip_local_port_range
Expand Down