feat(linkerd-cni): add support for plain iptables commands #449
Conversation
Currently the `iptables-mode` for linkerd-cni admits the values `legacy` and `default`, which make the plugin use the `iptables-legacy[-save]` and `iptables-nft[-save]` commands respectively. This assumes those commands are available in the node environment, given that linkerd-cni is triggered by the kubelet. We have found that not to be the case for RHEL, where by default only `iptables[-save]` is available, which is equivalent to the `iptables-nft[-save]` command in other enviroments. To address this case, this change adds a new possible value `iptables-mode: default` that makes the plugin use the `iptables[-save]` commands. This has been tested successfully using RKE2 deployed in RHEL 8.10.
This goes along with linkerd/linkerd2-proxy-init#449, that adds a new value for the linkerd2-cni chart's `iptableMode` config. Only a doc change.
There was a problem hiding this comment.
Is the "default" mode actually the default? It looks like if the mode is unset, the default behavior is dependent on the value of FirewallBinPath, but if that's not set then we fail with an error?
My feeling is that we should not call this mode "default"--it's not the default behavior, and the default behavior can change in the future to a different mode! Is this more accurately called "infer?" Or should we explicitly call this "rhel"?
|
The |
|
"plain" sounds okay to me ¯_(ツ)_/¯ |
* feat(linkerd-cni): add support for plain iptables commands This goes along with linkerd/linkerd2-proxy-init#449, that adds a new value for the linkerd2-cni chart's `iptableMode` config. Only a doc change. * s/default/plain
Currently the
iptables-modefor linkerd-cni admits the valueslegacyandnft, which make the plugin use theiptables-legacy[-save]andiptables-nft[-save]commands respectively.This assumes those commands are available in the node environment, given that linkerd-cni is triggered by the kubelet.
We have found that not to be the case for RHEL, where by default only
iptables[-save]is available, which is equivalent to theiptables-nft[-save]command in other enviroments.To address this case, this change adds a new possible value
iptables-mode: defaultthat makes the plugin use theiptables[-save]commands.This has been tested successfully using RKE2 deployed in RHEL 8.10.