Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Minikube VM is missing a Netfilter xt_socket module required for Transparent Proxying (TPROXY) #3713

Closed
yskopets opened this issue Feb 17, 2019 · 4 comments
Closed

Minikube VM is missing a Netfilter xt_socket module required for Transparent Proxying (TPROXY) #3713

yskopets opened this issue Feb 17, 2019 · 4 comments
Labels
area/guest-vm General configuration issues with the minikube guest VM kind/feature Categorizes issue or PR as related to a new feature. priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release.
Milestone
v1.0.0

Comments

@yskopets
Copy link
Contributor

yskopets commented Feb 17, 2019 •
edited
Loading

Transparent Proxying (TPROXY) is a feature of Linux Kernel that is used by Service Meshes, such as Istio or Kong, to "intercept" traffic in a side car process.

According to Kernel documentation, Transparent Proxying requires 2 Netfilter modules to be present:

  1. NETFILTER_XT_TARGET_TPROXY
  2. NETFILTER_XT_MATCH_SOCKET

At the moment, Minikube VM comes only with NETFILTER_XT_TARGET_TPROXY module and is missing NETFILTER_XT_MATCH_SOCKET.

How to reproduce

  1. minikube ssh
  2. sudo iptables -t mangle -N TPROXY_ISSUE
  3. sudo iptables -t mangle -A TPROXY_ISSUE -p tcp -m socket -j RETURN

The last command will fail with an error message iptables: No chain/target/match by that name.

Reproducible on

v0.33.1
@yskopets
Copy link
Contributor Author

I've prepared a PR to fix it - #3712

@yskopets yskopets mentioned this issue Feb 17, 2019
Merged
@afbjorklund
Copy link
Collaborator

I think providing support for Istio is on the wish list, so if the kernel config change fixes that...

https://istio.io/docs/setup/kubernetes/

For some reason this setting was removed with the kernel upgrade, but doesn't say why ?

3c6a809#diff-d1db7663ff9bd132f85fefa0f4ebdc3aL187

@afbjorklund afbjorklund added the area/guest-vm General configuration issues with the minikube guest VM label Feb 17, 2019
@tstromberg tstromberg added the kind/feature Categorizes issue or PR as related to a new feature. label Feb 19, 2019
@afbjorklund
Copy link
Collaborator

We will add this to the next ISO build/release. Hopefully it doesn't break anything else.

@yskopets
Copy link
Contributor Author

Thank you!

@tstromberg tstromberg added the priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. label Feb 19, 2019
@afbjorklund afbjorklund added this to the v1.0.0-candidate milestone Feb 22, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
area/guest-vm General configuration issues with the minikube guest VM kind/feature Categorizes issue or PR as related to a new feature. priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release.
Projects
None yet
Milestone
v1.0.0
Development

No branches or pull requests
3 participants
@tstromberg @afbjorklund @yskopets