From 971d0d6b29080f6e2cedc24740cdbb8a2ae0b034 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=98yvind=20Ingebrigtsen=20=C3=98vergaard?= Date: Thu, 19 Jan 2017 19:33:49 +0100 Subject: [PATCH] kube2iam: Don't quote .Values.host.interface; it breaks iptables wildcard support (#387) * .Values.host.interface shouldn't be quoted In some network configurations we have to handle traffic to the metadata api from multiple interfaces - typically the node side of a veth pair, where the other side lives inside a Pod's network namespace. We could use the wildcard functionality in iptables to do this, but setting `host.interface: veth+` in this chart doesn't work. This is because the parameter is quoted in the DaemonSet template and kube2iam ends up sending the parameter it receives on the command-line directly to `execvp("iptables", ...)`, which means that the parameter stays quoted all the way into the actual iptables rule. So you end up with a rule that looks like this: ```shell iptables -t nat -S PREROUTING | grep 169.254.169.254 -A PREROUTING -d 169.254.169.254/32 -i "veth+" -p tcp -m tcp --dport 80 -j DNAT --to-destination 10.0.0.1:8181 ``` this rule only matches an interface named exactly veth+ since the wildcard character apparently isn't expanded when the interface name is quoted. If we remove the quoting we can support iptables wildcards and I don't see why it shouldn't work for exact matching the interface name still. * Bump version --- stable/kube2iam/Chart.yaml | 2 +- stable/kube2iam/templates/daemonset.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/stable/kube2iam/Chart.yaml b/stable/kube2iam/Chart.yaml index befa9110c5..97ddb6990c 100644 --- a/stable/kube2iam/Chart.yaml +++ b/stable/kube2iam/Chart.yaml @@ -1,5 +1,5 @@ name: kube2iam -version: 0.1.0 +version: 0.1.1 description: Provide IAM credentials to containers running inside a kubernetes cluster based on annotations. keywords: - kube2iam diff --git a/stable/kube2iam/templates/daemonset.yaml b/stable/kube2iam/templates/daemonset.yaml index b998f6e49e..f8a152ee9a 100644 --- a/stable/kube2iam/templates/daemonset.yaml +++ b/stable/kube2iam/templates/daemonset.yaml @@ -25,7 +25,7 @@ spec: args: - --app-port={{ default 8181 .Values.containerPort }} - --iptables={{ default false .Values.host.iptables }} - - --host-interface={{ default "docker0" .Values.host.interface | quote }} + - --host-interface={{ default "docker0" .Values.host.interface }} {{- if .Values.host.iptables }} - --host-ip={{ default "$(HOST_IP)" .Values.host.ip }} {{- end }}