Version: v1.10.4 Latest Latest

This package is not in the latest version of its module.

Go to latest
Published: Sep 1, 2021 License: Apache-2.0 Imports: 25 Imported by: 4



Package iptables manages iptables-related configuration for Cilium.



This section is empty.


This section is empty.


func InstallNoTrackRules added in v1.10.0

func InstallNoTrackRules(IP string, port uint16, ipv6 bool) error

InstallNoTrackRules is explicitly called when a pod has valid "io.cilium.no-track-port" annotation. When InstallNoConntrackIptRules flag is set, a super set of v4 NOTRACK rules will be automatically installed upon agent bootstrap (via function addNoTrackPodTrafficRules) and this function will be skipped. When InstallNoConntrackIptRules is not set, this function will be executed to install NOTRACK rules. The rules installed by this function is very specific, for now, the only user is node-local-dns pods.

func KernelHasNetfilter added in v1.6.4

func KernelHasNetfilter() bool

KernelHasNetfilter probes whether iptables related modules are present in the kernel and returns true if indeed the case, else false.

func RemoveNoTrackRules added in v1.10.0

func RemoveNoTrackRules(IP string, port uint16, ipv6 bool) error

See comments for InstallNoTrackRules.


type IptablesManager

type IptablesManager struct {
	// contains filtered or unexported fields

IptablesManager manages the iptables-related configuration for Cilium.

func (*IptablesManager) GetProxyPort added in v1.7.7

func (m *IptablesManager) GetProxyPort(name string) uint16

GetProxyPort finds a proxy port used for redirect 'name' installed earlier with InstallProxyRules. By convention "ingress" or "egress" is part of 'name' so it does not need to be specified explicitly. Returns 0 a TPROXY entry with 'name' can not be found.

func (*IptablesManager) Init

func (m *IptablesManager) Init()

Init initializes the iptables manager and checks for iptables kernel modules availability.

func (*IptablesManager) InstallProxyRules added in v1.6.0

func (m *IptablesManager) InstallProxyRules(proxyPort uint16, ingress bool, name string) error

func (*IptablesManager) InstallRules

func (m *IptablesManager) InstallRules(ifName string, firstInitialization, install bool) (err error)

InstallRules installs iptables rules for Cilium in specific use-cases (most specifically, interaction with kube-proxy).

func (*IptablesManager) SupportsOriginalSourceAddr added in v1.6.1

func (m *IptablesManager) SupportsOriginalSourceAddr() bool

SupportsOriginalSourceAddr tells if an L7 proxy can use POD's original source address and port in the upstream connection to allow the destination to properly derive the source security ID from the source IP address.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
t or T : Toggle theme light dark auto
y or Y : Canonical URL