kube2iam: Don't quote .Values.host.interface; it breaks iptables wildcard support (#387)

* .Values.host.interface shouldn't be quoted

In some network configurations we have to handle traffic to the metadata api
from multiple interfaces - typically the node side of a veth pair, where the
other side lives inside a Pod's network namespace.  We could use the wildcard
functionality in iptables to do this, but setting `host.interface: veth+` in
this chart doesn't work.

This is because the parameter is quoted in the DaemonSet template and kube2iam
ends up sending the parameter it receives on the command-line directly to
`execvp("iptables", ...)`, which means that the parameter stays quoted all the
way into the actual iptables rule. So you end up with a rule that looks like
this:

```shell
iptables -t nat -S PREROUTING | grep 169.254.169.254
-A PREROUTING -d 169.254.169.254/32 -i "veth+" -p tcp -m tcp --dport 80 -j DNAT --to-destination 10.0.0.1:8181
```

this rule only matches an interface named exactly veth+ since the wildcard
character apparently isn't expanded when the interface name is quoted. If we
remove the quoting we can support iptables wildcards and I don't see why it
shouldn't work for exact matching the interface name still.

* Bump version
This commit is contained in:
Øyvind Ingebrigtsen Øvergaard
2017-01-19 10:33:49 -08:00
committed by Vic Iglesias
parent 0d6b898f79
commit 971d0d6b29
2 changed files with 2 additions and 2 deletions
+1 -1
View File
@@ -1,5 +1,5 @@
name: kube2iam
version: 0.1.0
version: 0.1.1
description: Provide IAM credentials to containers running inside a kubernetes cluster based on annotations.
keywords:
- kube2iam
+1 -1
View File
@@ -25,7 +25,7 @@ spec:
args:
- --app-port={{ default 8181 .Values.containerPort }}
- --iptables={{ default false .Values.host.iptables }}
- --host-interface={{ default "docker0" .Values.host.interface | quote }}
- --host-interface={{ default "docker0" .Values.host.interface }}
{{- if .Values.host.iptables }}
- --host-ip={{ default "$(HOST_IP)" .Values.host.ip }}
{{- end }}