iptables

package
v1.7.12 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Dec 28, 2017 License: Apache-2.0 Imports: 31 Imported by: 0

Documentation

Index

Constants

View Source
const (

	// the mark-for-masquerade chain
	KubeMarkMasqChain utiliptables.Chain = "KUBE-MARK-MASQ"

	// the mark-for-drop chain
	KubeMarkDropChain utiliptables.Chain = "KUBE-MARK-DROP"
)

Variables

View Source
var (
	SyncProxyRulesLatency = prometheus.NewHistogram(
		prometheus.HistogramOpts{
			Subsystem: kubeProxySubsystem,
			Name:      "sync_proxy_rules_latency_microseconds",
			Help:      "SyncProxyRules latency",
			Buckets:   prometheus.ExponentialBuckets(1000, 2, 15),
		},
	)
)

Functions

func CanUseIPTablesProxier added in v1.4.0

func CanUseIPTablesProxier(iptver IPTablesVersioner, kcompat KernelCompatTester) (bool, error)

CanUseIPTablesProxier returns true if we should use the iptables Proxier instead of the "classic" userspace Proxier. This is determined by checking the iptables version and for the existence of kernel features. It may return an error if it fails to get the iptables version without error, in which case it will also return false.

func CleanupLeftovers

func CleanupLeftovers(ipt utiliptables.Interface) (encounteredError bool)

CleanupLeftovers removes all iptables rules and chains created by the Proxier It returns true if an error was encountered. Errors are logged.

func RegisterMetrics added in v1.7.0

func RegisterMetrics()

Types

type IPTablesVersioner added in v1.4.0

type IPTablesVersioner interface {
	// returns "X.Y.Z"
	GetVersion() (string, error)
}

IPTablesVersioner can query the current iptables version.

type KernelCompatTester added in v1.2.0

type KernelCompatTester interface {
	IsCompatible() error
}

KernelCompatTester tests whether the required kernel capabilities are present to run the iptables proxier.

type LinuxKernelCompatTester added in v1.2.0

type LinuxKernelCompatTester struct{}

func (LinuxKernelCompatTester) IsCompatible added in v1.2.0

func (lkct LinuxKernelCompatTester) IsCompatible() error

type Proxier

type Proxier struct {
	// contains filtered or unexported fields
}

Proxier is an iptables based proxy for connections between a localhost:lport and services that provide the actual backends.

func NewProxier

func NewProxier(ipt utiliptables.Interface,
	sysctl utilsysctl.Interface,
	exec utilexec.Interface,
	syncPeriod time.Duration,
	minSyncPeriod time.Duration,
	masqueradeAll bool,
	masqueradeBit int,
	clusterCIDR string,
	hostname string,
	nodeIP net.IP,
	recorder record.EventRecorder,
	healthzServer healthcheck.HealthzUpdater,
) (*Proxier, error)

NewProxier returns a new Proxier given an iptables Interface instance. Because of the iptables logic, it is assumed that there is only a single Proxier active on a machine. An error will be returned if iptables fails to update or acquire the initial lock. Once a proxier is created, it will keep iptables up to date in the background and will not terminate if a particular iptables call fails.

func (*Proxier) OnEndpointsAdd added in v1.7.0

func (proxier *Proxier) OnEndpointsAdd(endpoints *api.Endpoints)

func (*Proxier) OnEndpointsDelete added in v1.7.0

func (proxier *Proxier) OnEndpointsDelete(endpoints *api.Endpoints)

func (*Proxier) OnEndpointsSynced added in v1.7.0

func (proxier *Proxier) OnEndpointsSynced()

func (*Proxier) OnEndpointsUpdate

func (proxier *Proxier) OnEndpointsUpdate(oldEndpoints, endpoints *api.Endpoints)

func (*Proxier) OnServiceAdd added in v1.7.0

func (proxier *Proxier) OnServiceAdd(service *api.Service)

func (*Proxier) OnServiceDelete added in v1.7.0

func (proxier *Proxier) OnServiceDelete(service *api.Service)

func (*Proxier) OnServiceSynced added in v1.7.0

func (proxier *Proxier) OnServiceSynced()

func (*Proxier) OnServiceUpdate

func (proxier *Proxier) OnServiceUpdate(oldService, service *api.Service)

func (*Proxier) Sync

func (proxier *Proxier) Sync()

Sync is called to synchronize the proxier state to iptables as soon as possible.

func (*Proxier) SyncLoop

func (proxier *Proxier) SyncLoop()

SyncLoop runs periodic work. This is expected to run as a goroutine or as the main loop of the app. It does not return.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL