scottk/kubernetes
1
0
Fork 0
mirror of https://github.com/optim-enterprises-bv/kubernetes.git synced 2025-11-03 19:58:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

Updating kube-proxy to trim space from loadBalancerSourceRanges

Browse Source 
Before this fix, a Service with a loadBalancerSourceRange value that
included a space would cause kube-proxy to crashloop. This updates
kube-proxy to trim any space from that field.
This commit is contained in:
Rob Scott
2020-08-19 12:30:49 -07:00
parent 544b74c2cb
commit c382c79f60
4 changed files with 60 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
pkg/proxy/iptables/proxier.go
View File

@@ -1183,9 +1183,10 @@ func (proxier *Proxier) syncProxyRules() {
allowFromNode := false
for _, src := range svcInfo.LoadBalancerSourceRanges() {
writeLine(proxier.natRules, append(args, "-s", src, "-j", string(chosenChain))...)
// ignore error because it has been validated
_, cidr, _ := net.ParseCIDR(src)
if cidr.Contains(proxier.nodeIP) {
_, cidr, err := net.ParseCIDR(src)
if err != nil {
klog.Errorf("Error parsing %s CIDR in LoadBalancerSourceRanges, dropping: %v", cidr, err)
} else if cidr.Contains(proxier.nodeIP) {
allowFromNode = true
}
}

4
pkg/proxy/iptables/proxier_test.go
View File

@@ -687,6 +687,10 @@ func TestLoadBalancer(t *testing.T) {
svc.Status.LoadBalancer.Ingress = []v1.LoadBalancerIngress{{
IP: svcLBIP,
}}
// Also ensure that invalid LoadBalancerSourceRanges will not result
// in a crash.
svc.Spec.ExternalIPs = []string{svcLBIP}
svc.Spec.LoadBalancerSourceRanges = []string{" 1.2.3.4/28"}
}),
)

10
pkg/proxy/service.go
View File

@@ -146,10 +146,14 @@ func (sct *ServiceChangeTracker) newBaseServiceInfo(port *v1.ServicePort, servic
topologyKeys: service.Spec.TopologyKeys,
}
loadBalancerSourceRanges := make([]string, len(service.Spec.LoadBalancerSourceRanges))
for i, sourceRange := range service.Spec.LoadBalancerSourceRanges {
loadBalancerSourceRanges[i] = strings.TrimSpace(sourceRange)
}
if sct.isIPv6Mode == nil {
info.externalIPs = make([]string, len(service.Spec.ExternalIPs))
info.loadBalancerSourceRanges = make([]string, len(service.Spec.LoadBalancerSourceRanges))
copy(info.loadBalancerSourceRanges, service.Spec.LoadBalancerSourceRanges)
info.loadBalancerSourceRanges = loadBalancerSourceRanges
copy(info.externalIPs, service.Spec.ExternalIPs)
// Deep-copy in case the service instance changes
info.loadBalancerStatus = *service.Status.LoadBalancer.DeepCopy()
@@ -162,7 +166,7 @@ func (sct *ServiceChangeTracker) newBaseServiceInfo(port *v1.ServicePort, servic
if len(incorrectIPs) > 0 {
utilproxy.LogAndEmitIncorrectIPVersionEvent(sct.recorder, "externalIPs", strings.Join(incorrectIPs, ","), service.Namespace, service.Name, service.UID)
}
info.loadBalancerSourceRanges, incorrectIPs = utilproxy.FilterIncorrectCIDRVersion(service.Spec.LoadBalancerSourceRanges, *sct.isIPv6Mode)
info.loadBalancerSourceRanges, incorrectIPs = utilproxy.FilterIncorrectCIDRVersion(loadBalancerSourceRanges, *sct.isIPv6Mode)
if len(incorrectIPs) > 0 {
utilproxy.LogAndEmitIncorrectIPVersionEvent(sct.recorder, "loadBalancerSourceRanges", strings.Join(incorrectIPs, ","), service.Namespace, service.Name, service.UID)
}

62
pkg/proxy/service_test.go
View File

@@ -413,28 +413,56 @@ func TestServiceToServiceMap(t *testing.T) {
},
isIPv6Mode: &trueVal,
},
{
desc: "service with extra space in LoadBalancerSourceRanges",
service: &v1.Service{
ObjectMeta: metav1.ObjectMeta{
Name: "extra-space",
Namespace: "test",
},
Spec: v1.ServiceSpec{
ClusterIP: testClusterIPv4,
LoadBalancerSourceRanges: []string{" 10.1.2.0/28"},
Ports: []v1.ServicePort{
{
Name: "testPort",
Port: int32(12345),
Protocol: v1.ProtocolTCP,
},
},
},
},
expected: map[ServicePortName]*BaseServiceInfo{
makeServicePortName("test", "extra-space", "testPort", v1.ProtocolTCP): makeTestServiceInfo(testClusterIPv4, 12345, "TCP", 0, func(info *BaseServiceInfo) {
info.loadBalancerSourceRanges = []string{"10.1.2.0/28"}
}),
},
isIPv6Mode: &falseVal,
},
}
for _, tc := range testCases {
svcTracker.isIPv6Mode = tc.isIPv6Mode
// outputs
newServices := svcTracker.serviceToServiceMap(tc.service)
t.Run(tc.desc, func(t *testing.T) {
svcTracker.isIPv6Mode = tc.isIPv6Mode
// outputs
newServices := svcTracker.serviceToServiceMap(tc.service)
if len(newServices) != len(tc.expected) {
t.Errorf("[%s] expected %d new, got %d: %v", tc.desc, len(tc.expected), len(newServices), spew.Sdump(newServices))
}
for svcKey, expectedInfo := range tc.expected {
svcInfo, _ := newServices[svcKey].(*BaseServiceInfo)
if !svcInfo.clusterIP.Equal(expectedInfo.clusterIP) ||
svcInfo.port != expectedInfo.port ||
svcInfo.protocol != expectedInfo.protocol ||
svcInfo.healthCheckNodePort != expectedInfo.healthCheckNodePort ||
!sets.NewString(svcInfo.externalIPs...).Equal(sets.NewString(expectedInfo.externalIPs...)) ||
!sets.NewString(svcInfo.loadBalancerSourceRanges...).Equal(sets.NewString(expectedInfo.loadBalancerSourceRanges...)) ||
!reflect.DeepEqual(svcInfo.loadBalancerStatus, expectedInfo.loadBalancerStatus) {
t.Errorf("[%s] expected new[%v]to be %v, got %v", tc.desc, svcKey, expectedInfo, *svcInfo)
if len(newServices) != len(tc.expected) {
t.Errorf("expected %d new, got %d: %v", len(tc.expected), len(newServices), spew.Sdump(newServices))
}
}
for svcKey, expectedInfo := range tc.expected {
svcInfo, _ := newServices[svcKey].(*BaseServiceInfo)
if !svcInfo.clusterIP.Equal(expectedInfo.clusterIP) ||
svcInfo.port != expectedInfo.port ||
svcInfo.protocol != expectedInfo.protocol ||
svcInfo.healthCheckNodePort != expectedInfo.healthCheckNodePort ||
!sets.NewString(svcInfo.externalIPs...).Equal(sets.NewString(expectedInfo.externalIPs...)) ||
!sets.NewString(svcInfo.loadBalancerSourceRanges...).Equal(sets.NewString(expectedInfo.loadBalancerSourceRanges...)) ||
!reflect.DeepEqual(svcInfo.loadBalancerStatus, expectedInfo.loadBalancerStatus) {
t.Errorf("expected new[%v]to be %v, got %v", svcKey, expectedInfo, *svcInfo)
}
}
})
}
}