Dan Williams 6248939e11 Push responsibility for bridge-nf-call-iptables to kubelet network plugins ...

bridge-nf-call-iptables appears to only be relevant when the containers are
attached to a Linux bridge, which is usually the case with default Kubernetes
setups, docker, and flannel.  That ensures that the container traffic is
actually subject to the iptables rules since it traverses a Linux bridge
and bridged traffic is only subject to iptables when bridge-nf-call-iptables=1.

But with other networking solutions (like openshift-sdn) that don't use Linux
bridges, bridge-nf-call-iptables may not be not relevant, because iptables is
invoked at other points not involving a Linux bridge.

The decision to set bridge-nf-call-iptables should be influenced by networking
plugins, so push the responsiblity out to them.  If no network plugin is
specified, fall back to the existing bridge-nf-call-iptables=1 behavior.

2016-02-23 09:34:59 -06:00

..

config

Rewritte util.* -> wait.* wherever reasonable

2016-02-07 12:02:20 +01:00

iptables

Push responsibility for bridge-nf-call-iptables to kubelet network plugins

2016-02-23 09:34:59 -06:00

userspace

Merge pull request #20496 from matthewdupre/masquerade-config

2016-02-08 10:49:20 -08:00

doc.go

Make copyright ownership statement generic

2015-05-01 17:49:56 -04:00

types.go

Make kube-proxy resync its rules on firewalld restart

2015-09-15 11:17:40 -04:00