Skip to content

Commit

Permalink
Extract iptables binary staging to iptablesutils
Browse files Browse the repository at this point in the history
CPLB potentially will need to create some iptables rules for its
userspace proxy, hence this code should be in iptablesutils rather than
pkg/worker/kubelet.

Signed-off-by: Juan-Luis de Sousa-Valadas Castaño <[email protected]>
  • Loading branch information
juanluisvaladas committed Oct 11, 2024
1 parent 280cbed commit be3872c
Show file tree
Hide file tree
Showing 4 changed files with 63 additions and 44 deletions.
54 changes: 54 additions & 0 deletions internal/pkg/iptablesutils/iptables.go
Original file line number Diff line number Diff line change
Expand Up @@ -20,10 +20,14 @@ import (
"bufio"
"errors"
"fmt"
"os"
"os/exec"
"path/filepath"
"runtime"
"strings"

"github.com/k0sproject/k0s/pkg/assets"
"github.com/k0sproject/k0s/pkg/constant"
"github.com/sirupsen/logrus"
)

Expand All @@ -32,6 +36,56 @@ const (
ModeLegacy = "legacy"
)

// ExtractIPTablesBinaries extracts the iptables binaries from the k0s binary and makes the symlinks
// to the backend detected by DetectHostIPTablesMode.
// ExtractIPTablesBinaries only works on linux, if called in another OS it will return an error.
func ExtractIPTablesBinaries(k0sBinDir string, iptablesMode string) (error, string) {
cmds := []string{"xtables-legacy-multi", "xtables-nft-multi"}
for _, cmd := range cmds {
err := assets.Stage(k0sBinDir, cmd, constant.BinDirMode)
if err != nil {
return err, ""
}
}
if iptablesMode == "" || iptablesMode == "auto" {
var err error
iptablesMode, err = DetectHostIPTablesMode(k0sBinDir)
if err != nil {
if kernelMajorVersion() < 5 {
iptablesMode = ModeLegacy
} else {
iptablesMode = ModeNFT
}
logrus.WithError(err).Infof("Failed to detect iptables mode, using iptables-%s by default", iptablesMode)
}
}
logrus.Infof("using iptables-%s", iptablesMode)
oldpath := fmt.Sprintf("xtables-%s-multi", iptablesMode)
for _, symlink := range []string{"iptables", "iptables-save", "iptables-restore", "ip6tables", "ip6tables-save", "ip6tables-restore"} {
symlinkPath := filepath.Join(k0sBinDir, symlink)

// remove if it exist and ignore error if it doesn't
_ = os.Remove(symlinkPath)

err := os.Symlink(oldpath, symlinkPath)
if err != nil {
return fmt.Errorf("failed to create symlink %s: %w", symlink, err), ""
}
}

return nil, iptablesMode
}
func kernelMajorVersion() byte {
if runtime.GOOS != "linux" {
return 0
}
data, err := os.ReadFile("/proc/sys/kernel/osrelease")
if err != nil {
return 0
}
return data[0] - '0'
}

// DetectHostIPTablesMode figure out whether iptables-legacy or iptables-nft is in use on the host.
// Follows the same logic as kube-proxy/kube-route.
// See: https://github.com/kubernetes-sigs/iptables-wrappers/blob/master/iptables-wrapper-installer.sh
Expand Down
3 changes: 1 addition & 2 deletions pkg/component/worker/kernelsetup.go
Original file line number Diff line number Diff line change
Expand Up @@ -19,5 +19,4 @@ limitations under the License.
package worker

// KernelSetup comment
func KernelSetup() {}
func KernelMajorVersion() byte { return 0 }
func KernelSetup() {}
9 changes: 0 additions & 9 deletions pkg/component/worker/kernelsetup_linux.go
Original file line number Diff line number Diff line change
Expand Up @@ -80,12 +80,3 @@ func KernelSetup() {
enableSysCtl("net/bridge/bridge-nf-call-iptables")
enableSysCtl("net/bridge/bridge-nf-call-ip6tables")
}

// KernelMajorVersion returns the major version number of the running kernel
func KernelMajorVersion() byte {
data, err := os.ReadFile("/proc/sys/kernel/osrelease")
if err != nil {
return 0
}
return data[0] - '0'
}
41 changes: 8 additions & 33 deletions pkg/component/worker/kubelet.go
Original file line number Diff line number Diff line change
Expand Up @@ -81,46 +81,21 @@ type kubeletConfig struct {

// Init extracts the needed binaries
func (k *Kubelet) Init(_ context.Context) error {
cmds := []string{"kubelet", "xtables-legacy-multi", "xtables-nft-multi"}

if runtime.GOOS == "windows" {
cmds = []string{"kubelet.exe"}
}

for _, cmd := range cmds {
err := assets.Stage(k.K0sVars.BinDir, cmd, constant.BinDirMode)
if err != nil {
return err
}
err := assets.Stage(k.K0sVars.BinDir, "kubelet.exe", constant.BinDirMode)
return err
}

if runtime.GOOS == "linux" {
iptablesMode := k.IPTablesMode
if iptablesMode == "" || iptablesMode == "auto" {
var err error
iptablesMode, err = iptablesutils.DetectHostIPTablesMode(k.K0sVars.BinDir)
if err != nil {
if KernelMajorVersion() < 5 {
iptablesMode = iptablesutils.ModeLegacy
} else {
iptablesMode = iptablesutils.ModeNFT
}
logrus.WithError(err).Infof("Failed to detect iptables mode, using iptables-%s by default", iptablesMode)
}
if err := assets.Stage(k.K0sVars.BinDir, "kubelet", constant.BinDirMode); err != nil {
return err
}
logrus.Infof("using iptables-%s", iptablesMode)
oldpath := fmt.Sprintf("xtables-%s-multi", iptablesMode)
for _, symlink := range []string{"iptables", "iptables-save", "iptables-restore", "ip6tables", "ip6tables-save", "ip6tables-restore"} {
symlinkPath := filepath.Join(k.K0sVars.BinDir, symlink)

// remove if it exist and ignore error if it doesn't
_ = os.Remove(symlinkPath)

err := os.Symlink(oldpath, symlinkPath)
if err != nil {
return fmt.Errorf("failed to create symlink %s: %w", symlink, err)
}
err, iptablesMode := iptablesutils.ExtractIPTablesBinaries(k.K0sVars.BinDir, k.IPTablesMode)
if err != nil {
return err
}
k.IPTablesMode = iptablesMode
}

k.dataDir = filepath.Join(k.K0sVars.DataDir, "kubelet")
Expand Down

0 comments on commit be3872c

Please sign in to comment.