Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[WIP] Probe: Better mapping of NATted connections #3451

Draft
wants to merge 7 commits into
base: master
Choose a base branch
from
Draft

[WIP] Probe: Better mapping of NATted connections #3451

Changes from 1 commit
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
86bcb11
Add function to subtract an entry from an IDList
bboreham Nov 26, 2018
85df164
Stop special-casing the Docker bridge in Kubernetes mode
bboreham Nov 27, 2018
ceafa6c
Use flags to check for NAT in conntrack data
bboreham Nov 26, 2018
d22b65e
Better NAT mapping
bboreham Nov 26, 2018
39721d8
Fix up NAT mapper test
bboreham Nov 28, 2018
49fe4a6
Store modified 'from' node
bboreham Dec 24, 2018
31e8d8f
Clarified rules and made SRC and DST consistent
bboreham Jan 11, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 1 addition & 3 deletions prog/probe.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -266,9 +266,7 @@ func probeMain(flags probeFlags, targets []appclient.Target) {
}

if flags.dockerEnabled {
// Don't add the bridge in Kubernetes since container IPs are global and
// shouldn't be scoped
if flags.dockerBridge != "" && !flags.kubernetesEnabled {
if flags.dockerBridge != "" {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is an improvement for when we have "unmanaged" containers running on a k8s host. However, it will also result in

  1. spurious error messages when docker isn't running on a k8s host (as will happen by default on some future k8s releases)

  2. incorrect treatment of the docker bridge as local if it is in fact the bridge used by k8s

We could avoid the first one by only erroring when the bridge name has been specified on the command line (rather than left to the default 'docker0' value).

Is the 2nd problem real?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  1. I don't think it is practical to use the docker0 bridge as the Kubernetes bridge nowadays except on a single-node cluster.
    I think Flannel used to connect one machine's Docker bridge to another, but nowadays that is driven via CNI with its own bridge. And Docker's own overlay networking will create a different bridge for each network.

if err := report.AddLocalBridge(flags.dockerBridge); err != nil {
log.Errorf("Docker: problem with bridge %s: %v", flags.dockerBridge, err)
}
Expand Down