{"action":"opened","issue":{"url":"https://api.github.com/repos/coreos/flannel/issues/938","repository_url":"https://api.github.com/repos/coreos/flannel","labels_url":"https://api.github.com/repos/coreos/flannel/issues/938/labels{/name}","comments_url":"https://api.github.com/repos/coreos/flannel/issues/938/comments","events_url":"https://api.github.com/repos/coreos/flannel/issues/938/events","html_url":"https://github.com/coreos/flannel/issues/938","id":293465447,"number":938,"title":"Make the iptables FORWARD chain rule additions optional","user":{"login":"KashifSaadat","id":6972966,"avatar_url":"https://avatars0.githubusercontent.com/u/6972966?v=4","gravatar_id":"","url":"https://api.github.com/users/KashifSaadat","html_url":"https://github.com/KashifSaadat","followers_url":"https://api.github.com/users/KashifSaadat/followers","following_url":"https://api.github.com/users/KashifSaadat/following{/other_user}","gists_url":"https://api.github.com/users/KashifSaadat/gists{/gist_id}","starred_url":"https://api.github.com/users/KashifSaadat/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/KashifSaadat/subscriptions","organizations_url":"https://api.github.com/users/KashifSaadat/orgs","repos_url":"https://api.github.com/users/KashifSaadat/repos","events_url":"https://api.github.com/users/KashifSaadat/events{/privacy}","received_events_url":"https://api.github.com/users/KashifSaadat/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-02-01T09:49:26Z","updated_at":"2018-02-01T09:49:26Z","closed_at":null,"author_association":"NONE","body":"## Expected Behavior\r\n1. Configure the setting `FELIX_CHAININSERTMODE` to `append` in the canal manifest file\r\n2. Deploy to a node\r\n3. Inspect iptables: `iptables -nv -L FORWARD`\r\n4. I would expect only 1 rule to be inserted by calico (at the bottom of the chain, if you have inserted custom iptables rules). For example:\r\n```\r\nChain FORWARD (policy ACCEPT 0 packets, 0 bytes)\r\n pkts bytes target     prot opt in     out     source               destination\r\n    0     0 REJECT     tcp  --  cali+  *       0.0.0.0/0            169.254.169.254      tcp dpt:80 state NEW \r\n    0     0 cali-FORWARD  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:wUHhoiAYhphO9Mso */\r\n```\r\n\r\n## Current Behavior\r\nFlannel v0.9.1 includes a change to add 2 rules to the FORWARD chain (https://github.com/coreos/flannel/pull/872). When Calico is configured with `append` mode, the Calico rule is added to the bottom of the chain, resulting in the following rule order:\r\n```\r\nChain FORWARD (policy ACCEPT 0 packets, 0 bytes)\r\n pkts bytes target     prot opt in     out     source               destination\r\n    0     0 REJECT     tcp  --  cali+  *       0.0.0.0/0            169.254.169.254      tcp dpt:80 state NEW reject-with icmp-port-unreachable\r\n    0     0 ACCEPT     all  --  *      *       10.10.0.0/16         0.0.0.0/0\r\n    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            10.10.0.0/16\r\n    0     0 cali-FORWARD  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:wUHhoiAYhphO9Mso */\r\n```\r\n\r\nBecause of this, the `cali-FORWARD` rule is never hit and all traffic in/out is accepted by default. This means that k8s ingress/egress network policies will have no effect.\r\n\r\nYou won't encounter this issue if the chain insert mode isn't set to append (it is `insert` by default). Flannel will still add 2 rules to the forward chain, but they will never be hit because the calico rule is processed first.\r\n\r\n## Possible Solution\r\n\r\nOne suggestion would be to provide a flag to flannel such as `\"AddIPTablesForwardRules\": false`.\r\n\r\n## Context\r\n\r\nI'm performing these deployments using kops v1.8.0, and the relevant manifest file is located here: https://github.com/kubernetes/kops/blob/1.8.0/upup/models/cloudup/resources/addons/networking.projectcalico.org.canal/k8s-1.8.yaml.template\r\n\r\nI set `FELIX_CHAININSERTMODE` to `append` so that I can insert rules at the top of the `INPUT` and `FORWARD` chains to process specific global `REJECT` rules before the network policies take effect (preventing pods communicating with ETCD API, Kube API, AWS meta-data endpoint, etc).\r\n\r\n## Your Environment\r\n* Calico version: v2.6.2\r\n* Flannel version: v0.9.1 (the issue was introduced in this version)\r\n* Kops version: v1.8.0 (flannel has been downgraded to v0.9.0 for the previous functionality to continue working)\r\n* Operating System and version: CoreOS stable v1520.8.0\r\n\r\nCC @tomdee \r\n\r\nRelated issues:\r\n- https://github.com/projectcalico/canal/issues/115\r\n- https://github.com/kubernetes/kops/issues/4037"}}
{"actor":{"display_login":"KashifSaadat"}}