nftables support #20
nftables support #20
Conversation
Oats87
force-pushed
the
nft-autodetect
branch
6 times, most recently
from
7e9c59b
to
8cd14cf
Compare
…related links and binaries to bin/aux, create second set of tar balls only containing xtables/iptables binaries and links, add Drone CI with Dapper
| if [ "${lsb_dist}" = "redhatenterpriseserver" ]; then | ||
| # Set it to redhat, it will be changed to centos below anyways | ||
| lsb_dist='redhat' | ||
| fi |
There was a problem hiding this comment.
Does the centos | redhat*) case catch too much without this alias?
| fi | ||
| ;; | ||
|
|
||
| # We are running an operating system we don't know, default to nf_tables. |
There was a problem hiding this comment.
Not to make this more complicated than it needs to be, but is it worth it when encountering an unknown OS $ID to fallback to $ID_LIKE if it is present in /etc/os-release? Likely such is more appropriate as a future improvement.
There was a problem hiding this comment.
As an example, k3OS /etc/os-release:
NAME="k3OS"
VERSION="k3OS v0.10.2"
ID=k3os
ID_LIKE=alpine
PRETTY_NAME="k3OS v0.10.2"
VERSION_ID="v0.10.2"
HOME_URL="https://k3os.io/"
SUPPORT_URL="https://k3os.io/"
BUG_REPORT_URL="https://github.com/rancher/k3os/issues"
ISO_URL="https://github.com/rancher/k3os/releases/download/v0.10.2/k3os-amd64.iso"Granted, we aren't handling alpine either ...
|
|
||
| } | ||
|
|
||
| if [ ! -z "$IPTABLES_MODE" ]; then |
There was a problem hiding this comment.
| if [ ! -z "$IPTABLES_MODE" ]; then | |
| if [ -n "$IPTABLES_MODE" ]; then |
| #!/bin/sh | ||
|
|
||
| # Copyright 2019 The Kubernetes Authors. | ||
| # Copyright 2020 Rancher Labs |
There was a problem hiding this comment.
Which parts of this are our contributions?
| @@ -4,7 +4,7 @@ | |||
| # | |||
| ################################################################################ | |||
|
|
|||
| IPTABLES_VERSION = 1.8.4 | |||
| IPTABLES_VERSION = 1.8.3 | |||
There was a problem hiding this comment.
Given that we are intentionally downgrading iptables does it make sense to leave a comment here as to why? Link to a known issue maybe?
|
No need to separate into two prs now, but i agree this is good advice for the future. |
|
Now that this is merged, will https://rancher.com/docs/k3s/latest/en/advanced/#enabling-legacy-iptables-on-raspbian-buster become irrelevant in the next release? |
|
@c-x-berger There is a little bit of further work to be done (namely on k3s and within the install script) but yes, in a future release (with these changes incorporated) Debian buster will be able to operate in either mode. With the changes that are implemented here, K3s will use whatever mode you have chosen with |
|
Also resolves: k3s-io/k3s#1959 |
Add iptables-detect scripts
Revert iptables to 1.8.3
Move iptables and related binaries/links to bin/aux instead of bin in order to help facilitate preferring iptables on the host rather than iptables from
k3s-rootCreate a second tar ball that only contains xtables/iptables binaries and links
k3s-io/k3s#1812