Skip to content
This repository has been archived by the owner on Mar 5, 2024. It is now read-only.

Supports use of ! prefix for interface name #54

Merged
merged 2 commits into from
Apr 28, 2018

Commits on Apr 25, 2018

  1. Supports use of ! prefix for interface name

    There are some CNI implementations that make use of multiple
    Elastic Network Interfaces and secondary IPs to assign pods ips
    directly from the VPC ranges. For example:
    
        https://github.com/aws/amazon-vpc-cni-k8s
        https://github.com/lyft/cni-ipvlan-vpc-k8s
    
    For kiam to function correctly, it is necessary to have an iptables
    rule that applies to all of the interfaces that pod traffic may come
    from. And since these interfaces may be added and removed on demand,
    it is necessary to have DNAT rules that will continue to work as
    interfaces come and go.
    
    iptables supports inverted matching for interface names which can be
    useful to include all but certain interfaces in rules. For example:
    
        iptables --append PREROUTING --protocol tcp \
          --destination 169.254.169.254 --dport 80  \
          \! -i loopback   --jump DNAT  --table nat \
          --to-destination 10.100.100.3:8181
    
    will apply the DNAT rule to all interfaces except the loopback.
    
    This change puts the "!" for inverting the interface before the name
    of the interface in the rules spec that inverted rules work as
    intended.
    chris-h-phillips committed Apr 25, 2018
    Configuration menu
    Copy the full SHA
    f3ec4d9 View commit details
    Browse the repository at this point in the history

Commits on Apr 28, 2018

  1. Configuration menu
    Copy the full SHA
    36bc533 View commit details
    Browse the repository at this point in the history