{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/62712","repository_url":"https://api.github.com/repos/kubernetes/kubernetes","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/62712/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/62712/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/62712/events","html_url":"https://github.com/kubernetes/kubernetes/pull/62712","id":314919302,"number":62712,"title":"fix ipvs firewall rules for loadbalancer type service","user":{"login":"Lion-Wei","id":28696384,"avatar_url":"https://avatars1.githubusercontent.com/u/28696384?v=4","gravatar_id":"","url":"https://api.github.com/users/Lion-Wei","html_url":"https://github.com/Lion-Wei","followers_url":"https://api.github.com/users/Lion-Wei/followers","following_url":"https://api.github.com/users/Lion-Wei/following{/other_user}","gists_url":"https://api.github.com/users/Lion-Wei/gists{/gist_id}","starred_url":"https://api.github.com/users/Lion-Wei/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Lion-Wei/subscriptions","organizations_url":"https://api.github.com/users/Lion-Wei/orgs","repos_url":"https://api.github.com/users/Lion-Wei/repos","events_url":"https://api.github.com/users/Lion-Wei/events{/privacy}","received_events_url":"https://api.github.com/users/Lion-Wei/received_events","type":"User","site_admin":false},"labels":[{"id":414883982,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/approved","name":"approved","color":"0ffa16","default":false},{"id":755527763,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/area/ipvs","name":"area/ipvs","color":"0052cc","default":false},{"id":477397086,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/cncf-cla:%20yes","name":"cncf-cla: yes","color":"bfe5bf","default":false},{"id":148225179,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/lgtm","name":"lgtm","color":"15dd18","default":false},{"id":349530249,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/release-note-none","name":"release-note-none","color":"c2e0c6","default":false},{"id":253450978,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/size/L","name":"size/L","color":"ee9900","default":false}],"state":"open","locked":false,"assignee":{"login":"m1093782566","id":4953962,"avatar_url":"https://avatars1.githubusercontent.com/u/4953962?v=4","gravatar_id":"","url":"https://api.github.com/users/m1093782566","html_url":"https://github.com/m1093782566","followers_url":"https://api.github.com/users/m1093782566/followers","following_url":"https://api.github.com/users/m1093782566/following{/other_user}","gists_url":"https://api.github.com/users/m1093782566/gists{/gist_id}","starred_url":"https://api.github.com/users/m1093782566/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/m1093782566/subscriptions","organizations_url":"https://api.github.com/users/m1093782566/orgs","repos_url":"https://api.github.com/users/m1093782566/repos","events_url":"https://api.github.com/users/m1093782566/events{/privacy}","received_events_url":"https://api.github.com/users/m1093782566/received_events","type":"User","site_admin":false},"assignees":[{"login":"m1093782566","id":4953962,"avatar_url":"https://avatars1.githubusercontent.com/u/4953962?v=4","gravatar_id":"","url":"https://api.github.com/users/m1093782566","html_url":"https://github.com/m1093782566","followers_url":"https://api.github.com/users/m1093782566/followers","following_url":"https://api.github.com/users/m1093782566/following{/other_user}","gists_url":"https://api.github.com/users/m1093782566/gists{/gist_id}","starred_url":"https://api.github.com/users/m1093782566/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/m1093782566/subscriptions","organizations_url":"https://api.github.com/users/m1093782566/orgs","repos_url":"https://api.github.com/users/m1093782566/repos","events_url":"https://api.github.com/users/m1093782566/events{/privacy}","received_events_url":"https://api.github.com/users/m1093782566/received_events","type":"User","site_admin":false},{"login":"rramkumar1","id":20979322,"avatar_url":"https://avatars1.githubusercontent.com/u/20979322?v=4","gravatar_id":"","url":"https://api.github.com/users/rramkumar1","html_url":"https://github.com/rramkumar1","followers_url":"https://api.github.com/users/rramkumar1/followers","following_url":"https://api.github.com/users/rramkumar1/following{/other_user}","gists_url":"https://api.github.com/users/rramkumar1/gists{/gist_id}","starred_url":"https://api.github.com/users/rramkumar1/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rramkumar1/subscriptions","organizations_url":"https://api.github.com/users/rramkumar1/orgs","repos_url":"https://api.github.com/users/rramkumar1/repos","events_url":"https://api.github.com/users/rramkumar1/events{/privacy}","received_events_url":"https://api.github.com/users/rramkumar1/received_events","type":"User","site_admin":false}],"milestone":null,"comments":27,"created_at":"2018-04-17T06:15:05Z","updated_at":"2018-04-29T09:03:05Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/62712","html_url":"https://github.com/kubernetes/kubernetes/pull/62712","diff_url":"https://github.com/kubernetes/kubernetes/pull/62712.diff","patch_url":"https://github.com/kubernetes/kubernetes/pull/62712.patch"},"body":"\r\n**What this PR does / why we need it**:\r\nfix ipvs firewall rules for loadbalancer type service.\r\n\r\n**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:\r\nFixes #62638\r\n\r\n**Special notes for your reviewer**:\r\nThe original firewall rules for loadblancer type service with sourceRange may looks like:\r\n```\r\nChain KUBE-FIRE-WALL (1 references)\r\ntarget     prot opt source               destination\r\nACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            match-set KUBE-LB-INGRESS-LOCAL dst,dst\r\nKUBE-MARK-MASQ  all  --  0.0.0.0/0            0.0.0.0/0            /* mark MASQ for external traffic policy not local */\r\nACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            match-set KUBE-LOAD-BALANCER-SOURCE-CIDR dst,dst,src\r\nKUBE-MARK-DROP  all  --  0.0.0.0/0            0.0.0.0/0\r\n\r\nChain KUBE-SERVICES (2 references)\r\ntarget     prot opt source               destination\r\nKUBE-MARK-MASQ  all  -- !10.64.0.0/14         0.0.0.0/0            match-set KUBE-CLUSTER-IP dst,dst\r\nKUBE-FIRE-WALL  all  --  0.0.0.0/0            0.0.0.0/0            match-set KUBE-LOAD-BALANCER dst,dst\r\nKUBE-NODE-PORT  tcp  --  0.0.0.0/0            0.0.0.0/0            tcp match-set KUBE-NODE-PORT-TCP dst\r\n```\r\nWhich may result in other loadbalancer type service can't be access.\r\n\r\nIn this pr, rules of loadbalancer type service with sourceRange specified will be:\r\n```\r\nChain KUBE-FIRE-WALL (1 references)\r\ntarget     prot opt source               destination\r\nRETURN     all  --  0.0.0.0/0            0.0.0.0/0            match-set KUBE-LOAD-BALANCER-SOURCE-CIDR dst,dst,src\r\nKUBE-MARK-DROP  all  --  0.0.0.0/0            0.0.0.0/0\r\n\r\nChain KUBE-LOAD-BALANCER (1 references)\r\ntarget     prot opt source               destination\r\nKUBE-FIRE-WALL  all  --  0.0.0.0/0            0.0.0.0/0            match-set KUBE-LB-INGRESS dst,dst\r\nKUBE-MARK-MASQ  all  --  0.0.0.0/0            0.0.0.0/0            /* mark MASQ for external traffic policy not local */\r\n\r\n\r\nChain KUBE-SERVICES (2 references)\r\ntarget     prot opt source               destination\r\nKUBE-MARK-MASQ  all  -- !10.64.0.0/14         0.0.0.0/0            match-set KUBE-CLUSTER-IP dst,dst\r\nKUBE-LOAD-BALANCER  all  --  0.0.0.0/0            0.0.0.0/0            match-set KUBE-LOAD-BALANCER dst,dst\r\n```\r\n\r\n**Release note**:\r\n```release-note\r\nNONE\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/385236724","html_url":"https://github.com/kubernetes/kubernetes/pull/62712#issuecomment-385236724","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/62712","id":385236724,"user":{"login":"k8s-ci-robot","id":20407524,"avatar_url":"https://avatars0.githubusercontent.com/u/20407524?v=4","gravatar_id":"","url":"https://api.github.com/users/k8s-ci-robot","html_url":"https://github.com/k8s-ci-robot","followers_url":"https://api.github.com/users/k8s-ci-robot/followers","following_url":"https://api.github.com/users/k8s-ci-robot/following{/other_user}","gists_url":"https://api.github.com/users/k8s-ci-robot/gists{/gist_id}","starred_url":"https://api.github.com/users/k8s-ci-robot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/k8s-ci-robot/subscriptions","organizations_url":"https://api.github.com/users/k8s-ci-robot/orgs","repos_url":"https://api.github.com/users/k8s-ci-robot/repos","events_url":"https://api.github.com/users/k8s-ci-robot/events{/privacy}","received_events_url":"https://api.github.com/users/k8s-ci-robot/received_events","type":"User","site_admin":false},"created_at":"2018-04-29T09:03:05Z","updated_at":"2018-04-29T09:03:05Z","author_association":"COLLABORATOR","body":"@Lion-Wei: The following tests **failed**, say `/retest` to rerun them all:\n\nTest name | Commit | Details | Rerun command\n--- | --- | --- | ---\npull-kubernetes-typecheck | edb91773b6e7a40795ac379becf31cbec0961ed7 | [link](https://k8s-gubernator.appspot.com/build/kubernetes-jenkins/pr-logs/pull/62712/pull-kubernetes-typecheck/7684/) | `/test pull-kubernetes-typecheck`\npull-kubernetes-integration | edb91773b6e7a40795ac379becf31cbec0961ed7 | [link](https://k8s-gubernator.appspot.com/build/kubernetes-jenkins/pr-logs/pull/62712/pull-kubernetes-integration/9069/) | `/test pull-kubernetes-integration`\npull-kubernetes-node-e2e | edb91773b6e7a40795ac379becf31cbec0961ed7 | [link](https://k8s-gubernator.appspot.com/build/kubernetes-jenkins/pr-logs/pull/62712/pull-kubernetes-node-e2e/86766/) | `/test pull-kubernetes-node-e2e`\npull-kubernetes-verify | edb91773b6e7a40795ac379becf31cbec0961ed7 | [link](https://k8s-gubernator.appspot.com/build/kubernetes-jenkins/pr-logs/pull/62712/pull-kubernetes-verify/88600/) | `/test pull-kubernetes-verify`\npull-kubernetes-bazel-build | edb91773b6e7a40795ac379becf31cbec0961ed7 | [link](https://k8s-gubernator.appspot.com/build/kubernetes-jenkins/pr-logs/pull/62712/pull-kubernetes-bazel-build/40376/) | `/test pull-kubernetes-bazel-build`\npull-kubernetes-e2e-gce-device-plugin-gpu | edb91773b6e7a40795ac379becf31cbec0961ed7 | [link](https://k8s-gubernator.appspot.com/build/kubernetes-jenkins/pr-logs/pull/62712/pull-kubernetes-e2e-gce-device-plugin-gpu/29778/) | `/test pull-kubernetes-e2e-gce-device-plugin-gpu`\npull-kubernetes-e2e-kops-aws | edb91773b6e7a40795ac379becf31cbec0961ed7 | [link](https://k8s-gubernator.appspot.com/build/kubernetes-jenkins/pr-logs/pull/62712/pull-kubernetes-e2e-kops-aws/86458/) | `/test pull-kubernetes-e2e-kops-aws`\npull-kubernetes-bazel-test | edb91773b6e7a40795ac379becf31cbec0961ed7 | [link](https://k8s-gubernator.appspot.com/build/kubernetes-jenkins/pr-logs/pull/62712/pull-kubernetes-bazel-test/42620/) | `/test pull-kubernetes-bazel-test`\npull-kubernetes-e2e-gce | edb91773b6e7a40795ac379becf31cbec0961ed7 | [link](https://k8s-gubernator.appspot.com/build/kubernetes-jenkins/pr-logs/pull/62712/pull-kubernetes-e2e-gce/33140/) | `/test pull-kubernetes-e2e-gce`\npull-kubernetes-kubemark-e2e-gce | edb91773b6e7a40795ac379becf31cbec0961ed7 | [link](https://k8s-gubernator.appspot.com/build/kubernetes-jenkins/pr-logs/pull/62712/pull-kubernetes-kubemark-e2e-gce/88393/) | `/test pull-kubernetes-kubemark-e2e-gce`\n\n[Full PR test history](https://k8s-gubernator.appspot.com/pr/62712). [Your PR dashboard](https://k8s-gubernator.appspot.com/pr/Lion-Wei). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes/kubernetes/issues?q=is:issue+is:open) when you hit one in your PR.\n\n<details>\n\nInstructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/devel/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).\n</details>\n<!-- test report -->"}}
{"actor":{"display_login":"k8s-ci-robot"}}