diff --git a/go.mod b/go.mod index 4157a507b..4f04fd554 100644 --- a/go.mod +++ b/go.mod @@ -86,7 +86,7 @@ replace ( k8s.io/kube-scheduler => github.com/openshift/kubernetes/staging/src/k8s.io/kube-scheduler v0.0.0-20200924180536-c77dd9b79070 k8s.io/kubectl => github.com/openshift/kubernetes/staging/src/k8s.io/kubectl v0.0.0-20200924180536-c77dd9b79070 k8s.io/kubelet => github.com/openshift/kubernetes/staging/src/k8s.io/kubelet v0.0.0-20200924180536-c77dd9b79070 - k8s.io/kubernetes => github.com/openshift/kubernetes v0.0.0-20200924180536-c77dd9b79070 + k8s.io/kubernetes => github.com/openshift/kubernetes v1.19.0-alpha.0.0.20210302151112-05e619e27cf6 k8s.io/legacy-cloud-providers => github.com/openshift/kubernetes/staging/src/k8s.io/legacy-cloud-providers v0.0.0-20200924180536-c77dd9b79070 k8s.io/metrics => github.com/openshift/kubernetes/staging/src/k8s.io/metrics v0.0.0-20200924180536-c77dd9b79070 k8s.io/sample-apiserver => github.com/openshift/kubernetes/staging/src/k8s.io/sample-apiserver v0.0.0-20200924180536-c77dd9b79070 diff --git a/go.sum b/go.sum index c37821f35..a41d44e91 100644 --- a/go.sum +++ b/go.sum @@ -446,8 +446,8 @@ github.com/openshift/client-go v0.0.0-20200422192633-6f6c07fc2a70 h1:LvJxSt/lnLT github.com/openshift/client-go v0.0.0-20200422192633-6f6c07fc2a70/go.mod h1:HeCrq1LSOBgHAUpINH4IgBLkt2U/NBwE5sq4JJgcl2Y= github.com/openshift/golang-glog v0.0.0-20190322123450-3c92600d7533 h1:A5VovyRu3JFIPmC20HHrsOOny0PIdHuzDdNMULru48k= github.com/openshift/golang-glog v0.0.0-20190322123450-3c92600d7533/go.mod h1:3sa6LKKRDnR1xy4Kn8htvPwqIOVwXh8fIU3LRY22q3U= -github.com/openshift/kubernetes v0.0.0-20200924180536-c77dd9b79070 h1:8xP8anx0ib8cRHAYs9DJdN7rj4lUmOYFaJYGicT/fKo= -github.com/openshift/kubernetes v0.0.0-20200924180536-c77dd9b79070/go.mod h1:Efg82S+Ti02A/Mww53bxroc7IgzX2bgPsf6hT8gAs3M= +github.com/openshift/kubernetes v1.19.0-alpha.0.0.20210302151112-05e619e27cf6 h1:U2kFgbhCu5pgBaca7Ecm2TVEhHcYmFGkICITyQZ5cBk= +github.com/openshift/kubernetes v1.19.0-alpha.0.0.20210302151112-05e619e27cf6/go.mod h1:Efg82S+Ti02A/Mww53bxroc7IgzX2bgPsf6hT8gAs3M= github.com/openshift/kubernetes/staging/src/k8s.io/api v0.0.0-20200924180536-c77dd9b79070 h1:twp4f4xBdg4yTYWYHj9McT4pIk5gbj1/j5VHF8yx7XQ= github.com/openshift/kubernetes/staging/src/k8s.io/api v0.0.0-20200924180536-c77dd9b79070/go.mod h1:oMzWB6/RPBLYAObltLVSu5Ms1ZztBe7G8s1ni2rZY7w= github.com/openshift/kubernetes/staging/src/k8s.io/apiextensions-apiserver v0.0.0-20200924180536-c77dd9b79070/go.mod h1:BVIYewlEVCukQBRrZR3Kms8GdCsDQBsRIBCoy3rwzMk= diff --git a/vendor/k8s.io/kubernetes/pkg/proxy/iptables/proxier.go b/vendor/k8s.io/kubernetes/pkg/proxy/iptables/proxier.go index acabff676..dd7ce235e 100644 --- a/vendor/k8s.io/kubernetes/pkg/proxy/iptables/proxier.go +++ b/vendor/k8s.io/kubernetes/pkg/proxy/iptables/proxier.go @@ -375,16 +375,19 @@ type iptablesJumpChain struct { var iptablesJumpChains = []iptablesJumpChain{ {utiliptables.TableFilter, kubeExternalServicesChain, utiliptables.ChainInput, "kubernetes externally-visible service portals", []string{"-m", "conntrack", "--ctstate", "NEW"}}, + {utiliptables.TableFilter, kubeExternalServicesChain, utiliptables.ChainForward, "kubernetes externally-visible service portals", []string{"-m", "conntrack", "--ctstate", "NEW"}}, {utiliptables.TableFilter, kubeServicesChain, utiliptables.ChainForward, "kubernetes service portals", []string{"-m", "conntrack", "--ctstate", "NEW"}}, {utiliptables.TableFilter, kubeServicesChain, utiliptables.ChainOutput, "kubernetes service portals", []string{"-m", "conntrack", "--ctstate", "NEW"}}, - {utiliptables.TableFilter, kubeServicesChain, utiliptables.ChainInput, "kubernetes service portals", []string{"-m", "conntrack", "--ctstate", "NEW"}}, {utiliptables.TableFilter, kubeForwardChain, utiliptables.ChainForward, "kubernetes forwarding rules", nil}, {utiliptables.TableNAT, kubeServicesChain, utiliptables.ChainOutput, "kubernetes service portals", nil}, {utiliptables.TableNAT, kubeServicesChain, utiliptables.ChainPrerouting, "kubernetes service portals", nil}, {utiliptables.TableNAT, kubePostroutingChain, utiliptables.ChainPostrouting, "kubernetes postrouting rules", nil}, } -var iptablesCleanupOnlyChains = []iptablesJumpChain{} +var iptablesCleanupOnlyChains = []iptablesJumpChain{ + // Present in kube 1.13 - 1.19. Removed by #95252 in favor of adding reject rules for incoming/forwarding packets to kubeExternalServicesChain + {utiliptables.TableFilter, kubeServicesChain, utiliptables.ChainInput, "kubernetes service portals", []string{"-m", "conntrack", "--ctstate", "NEW"}}, +} // CleanupLeftovers removes all iptables rules and chains created by the Proxier // It returns true if an error was encountered. Errors are logged. @@ -983,6 +986,20 @@ func (proxier *Proxier) syncProxyRules() { hasEndpoints = len(allEndpoints) > 0 } + // Prefer local endpoint for the DNS service. + // Fixes . + // TODO: Delete this if-block once internal traffic policy is + // implemented and the DNS operator is updated to use it. + if svcNameString == "openshift-dns/dns-default:dns" { + for _, ep := range allEndpoints { + if ep.GetIsLocal() { + klog.V(4).Infof("Found a local endpoint %q for service %q; preferring the local endpoint and ignoring %d other endpoints", ep.String(), svcNameString, len(allEndpoints) - 1) + allEndpoints = []proxy.Endpoint{ep} + break + } + } + } + svcChain := svcInfo.servicePortChainName if hasEndpoints { // Create the per-service chain, retaining counters if possible. @@ -1181,7 +1198,7 @@ func (proxier *Proxier) syncProxyRules() { } else { // No endpoints. writeLine(proxier.filterRules, - "-A", string(kubeServicesChain), + "-A", string(kubeExternalServicesChain), "-m", "comment", "--comment", fmt.Sprintf(`"%s has no endpoints"`, svcNameString), "-m", protocol, "-p", protocol, "-d", utilproxy.ToCIDR(net.ParseIP(ingress)), diff --git a/vendor/modules.txt b/vendor/modules.txt index ad05b6bfe..070f51c09 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -842,7 +842,7 @@ k8s.io/kubectl/pkg/util/openapi/validation k8s.io/kubectl/pkg/util/templates k8s.io/kubectl/pkg/util/term k8s.io/kubectl/pkg/validation -# k8s.io/kubernetes v1.18.6 => github.com/openshift/kubernetes v0.0.0-20200924180536-c77dd9b79070 +# k8s.io/kubernetes v1.18.6 => github.com/openshift/kubernetes v1.19.0-alpha.0.0.20210302151112-05e619e27cf6 k8s.io/kubernetes/cmd/kube-proxy k8s.io/kubernetes/cmd/kube-proxy/app k8s.io/kubernetes/pkg/api/legacyscheme