pass cluster-cidr to proxy

[ozdanborne]

When using Calico networking, connections to nodeports only succeed if the pod backing the nodeport service is running on the host being hit. So requests are not forwarded to other nodes if the pod is running there.

This PR resolves the issue by passing Cluster CIDR to kube-proxy, which implements the nececssary iptables rules.

I'm guessing this is not an issue in openshift_sdn because it implements the necessary iptables rules itself, but this is not standard in kubernetes networking plugins.

I'm open to feedback, specifically on if this can be moved out of "extraArgs" and acceptped as a first class param in origin-node.

[papr-bot]

Can one of the admins verify this patch?
I understand the following commands:

• bot, add author to whitelist
• bot, test pull request
• bot, test pull request once

[ozdanborne]

@sdodson I just finished testing this on v3.9 (now that the systemd-logind issue was resolved). Can I get an ok-to-test?

[vrutkovs]

bot, test pull request

[vrutkovs]

/ok-to-test

[vrutkovs]

This breaks Atomic tests:

AnsibleUndefinedVariable: 'openshift_use_calico' is undefined

[ozdanborne]

@vrutkovs I defaulted it to false if not defined. PTAL

I believe @HackToHell confirmed this fixed the issue for him as well

[vrutkovs]

/lgtm
/approve

[openshift-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ozdanborne, vrutkovs

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [vrutkovs]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[vrutkovs]

/retest

[openshift-ci-robot]

@ozdanborne: The following tests failed, say /retest to rerun them all:

Test name	Commit	Details	Rerun command
ci/openshift-jenkins/system-containers	682852a	link	/test system-containers
ci/openshift-jenkins/gcp	59eede9	link	/test gcp

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[sdodson]

/skip
gcp job is a flake.