-
Notifications
You must be signed in to change notification settings - Fork 39.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Port forwarding should be through iptables #15
Port forwarding should be through iptables #15
Comments
Why did we disable IP tables? |
We needed to disable the blanket NAT for all traffic out of the bridge and only nat for We either need to make Docker itself more flexible or start setting up the port forwarding in the kubelet. If we do it in the kubelet we could do something like:
If we want to adapt Docker, it might be enough to split the iptables flag into a flag for configuring the iptables for the bridge in general vs. configuring iptables for the incoming port mapping. |
I feel like a moron for not understanding the problem after that Aren't you on vacation? On Tue, Jun 24, 2014 at 6:21 AM, Joe Beda notifications@github.com wrote:
|
Joe is the expert on our config, but I think we needed to disable NAT to be Brendan
|
Quick clarification and then back to vacation :) We want traffic between containers to use the container API across nodes. Say we have But we don't support (yet?) the extra container IPs that we've provisioned talking to the internet directly. We don't map external IPs to the container IPs. So we solve that problem by having traffic that isn't to the internal network ( So we end up with 3 cases:
If this is still confusing let me know and I can find some time for a hangout to dive into the details. |
Docker issues that may be relevant to the iptables issue: |
Introduce pluggable strategies for build types
I think this is fixed, or at least soon. With my PR for true IP-per-pod, I am pretty sure we circumvent Docker's proxying entirely. |
Tim -- can you confirm that we use iptables when you specify a |
Ah, right, HostPorts. Yes, in case of HostPorts we do still get proxied through docker, it seems. |
I'm going to move this out of the 0.5 release, as I think that this is a P2 and thus not a blocker. |
Your call -- but this means that any |
@slintes suggests that it works without the |
@errordeveloper Your link is broken, correct link is weaveworks/weave#260 (comment) |
…gyGmbH/hyperkube-install Hyperkube install
Adding auth and token code.
print when podconfig is sent to main loop
Private registry unit test
Pass monitors addresses in a comma-separated list instead of trying one
…rap-race Avoid copying aggregated admin/edit/view roles during bootstrap
Enable kubelet's debug handlers
683ed1d (Brandon Philips, 27 minutes ago) release-1.3: features-1.3: make dlorenc the minikube assignee
update readme with current owners
remove jess from PST, thanks :)
fixing unit tests
HACK: Search for the right CRD cluster when watching with wildcards
…ckerfile Add entrypoint and copy kernel monitor config into docker image
As we've disabled docker managing IP tables we no longer get it setting up explicit port forwarding. Instead we are falling back on user mode proxying that is built into docker to do this port forwarding.
We should either build our networking mode into Docker proper or have the
kubelet
set up and maintain the IPTables forwarding rules we need.The text was updated successfully, but these errors were encountered: