This repository has been archived by the owner on Mar 5, 2024. It is now read-only.
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Supports use of ! prefix for interface name (#54)
There are some CNI implementations that make use of multiple Elastic Network Interfaces and secondary IPs to assign pods ips directly from the VPC ranges. For example: https://github.com/aws/amazon-vpc-cni-k8s https://github.com/lyft/cni-ipvlan-vpc-k8s For kiam to function correctly, it is necessary to have an iptables rule that applies to all of the interfaces that pod traffic may come from. And since these interfaces may be added and removed on demand, it is necessary to have DNAT rules that will continue to work as interfaces come and go. iptables supports inverted matching for interface names which can be useful to include all but certain interfaces in rules. For example: iptables --append PREROUTING --protocol tcp \ --destination 169.254.169.254 --dport 80 \ \! -i loopback --jump DNAT --table nat \ --to-destination 10.100.100.3:8181 will apply the DNAT rule to all interfaces except the loopback. This change puts the "!" for inverting the interface before the name of the interface in the rules spec that inverted rules work as intended.
- Loading branch information