Nftables implementation #1881
Nftables implementation #1881
Conversation
thomasferrandiz
force-pushed
the
nftables-implementation
branch
8 times, most recently
from
cdf9f83 to
00863cb
Compare
thomasferrandiz
force-pushed
the
nftables-implementation
branch
2 times, most recently
from
601f55b to
fb437ca
Compare
thomasferrandiz
force-pushed
the
nftables-implementation
branch
from
fb437ca to
0b5f386
Compare
thomasferrandiz
force-pushed
the
nftables-implementation
branch
from
0b5f386 to
0e8ae59
Compare
pkg/trafficmngr/nftables/nftables.go
Outdated
| log.Infof("Changing default FORWARD chain policy to ACCEPT") | ||
| tx := nftm.nftv4.NewTransaction() | ||
|
|
||
| //TODO how to express that the default is drop? |
There was a problem hiding this comment.
Do we need to DROP by default? I think we can add a simple "drop" rule at the end of the chain. I saw that on the class the policy value is missing it should be something like this type filter hook forward priority -100; policy drop;
There was a problem hiding this comment.
I guess we don't need to drop by default. we just need to make sure that the flannel traffic is forwarded.
There was a problem hiding this comment.
Yes I was confused by the question. It shouldn't drop but it should continue the chain in case it's not matching the flannel subnet using the default configuration of the node.
There was a problem hiding this comment.
I think that's the default behavior so it should be fine as it is.
From the comment in flannel code, the forward rules seem needed for old versions of docker anyway.
thomasferrandiz
force-pushed
the
nftables-implementation
branch
from
e95551d to
6728b43
Compare
This PR allows flannel to use nftables natively instead of iptables. This is used essentially to masquerade traffic coming from the pods. The PR also fixes the clean-up mechanism in the iptables implementation.
thomasferrandiz
force-pushed
the
nftables-implementation
branch
from
6728b43 to
f244861
Compare
Description
Todos
Release Note