mirror of
https://github.com/helm/charts.git
synced 2026-08-23 22:37:45 +00:00
kube2iam: Don't quote .Values.host.interface; it breaks iptables wildcard support (#387)
* .Values.host.interface shouldn't be quoted
In some network configurations we have to handle traffic to the metadata api
from multiple interfaces - typically the node side of a veth pair, where the
other side lives inside a Pod's network namespace. We could use the wildcard
functionality in iptables to do this, but setting `host.interface: veth+` in
this chart doesn't work.
This is because the parameter is quoted in the DaemonSet template and kube2iam
ends up sending the parameter it receives on the command-line directly to
`execvp("iptables", ...)`, which means that the parameter stays quoted all the
way into the actual iptables rule. So you end up with a rule that looks like
this:
```shell
iptables -t nat -S PREROUTING | grep 169.254.169.254
-A PREROUTING -d 169.254.169.254/32 -i "veth+" -p tcp -m tcp --dport 80 -j DNAT --to-destination 10.0.0.1:8181
```
this rule only matches an interface named exactly veth+ since the wildcard
character apparently isn't expanded when the interface name is quoted. If we
remove the quoting we can support iptables wildcards and I don't see why it
shouldn't work for exact matching the interface name still.
* Bump version
This commit is contained in:
committed by
Vic Iglesias
parent
0d6b898f79
commit
971d0d6b29
@@ -1,5 +1,5 @@
|
||||
name: kube2iam
|
||||
version: 0.1.0
|
||||
version: 0.1.1
|
||||
description: Provide IAM credentials to containers running inside a kubernetes cluster based on annotations.
|
||||
keywords:
|
||||
- kube2iam
|
||||
|
||||
@@ -25,7 +25,7 @@ spec:
|
||||
args:
|
||||
- --app-port={{ default 8181 .Values.containerPort }}
|
||||
- --iptables={{ default false .Values.host.iptables }}
|
||||
- --host-interface={{ default "docker0" .Values.host.interface | quote }}
|
||||
- --host-interface={{ default "docker0" .Values.host.interface }}
|
||||
{{- if .Values.host.iptables }}
|
||||
- --host-ip={{ default "$(HOST_IP)" .Values.host.ip }}
|
||||
{{- end }}
|
||||
|
||||
Reference in New Issue
Block a user