Sign inSign up

zevenet/kube-nftlb

By zevenet

•Updated almost 6 years ago

Kubernetes Daemonset able to communicate with APIServer. It makes rules in nftables through nftlb.

Image
0

1.6K

zevenet/kube-nftlb repository overview

kube-nftlb is a Kubernetes Daemonset able to communicate the Kubernetes API Server, based on a Debian Buster image with nftlb⁠ installed.

It can request information from the API Server such as new, updated or deleted Services/Endpoints, and make rules in nftables accordingly.

⁠Features 🌟

  • ✅ nftables backend, the new packet classification framework that replaces the existing {ip,ip6,arp,eb}_tables infrastructure.
  • ✅ Support for Services and Endpoints.
  • ✅ Annotations can be used to configure Services.
  • ✅ Functional and performance tests.
  • ⏹ (Coming soon) Support for Network Policies.

⁠Prerequisites 📋

  • Docker
  • Minikube
  • kubectl
  • nftables
  • libnftnl11
  • conntrack

Also, you can run debian_tools_installer.sh as root after a fresh Debian Buster install.

root@debian:kube-nftlb# ./debian_tools_installer.sh

⁠Installation 🔧

# Clone the project
user@debian:~# git clone https://github.com/zevenet/kube-nftlb

# Change directory
user@debian:~# cd kube-nftlb

⁠Deployment 🚀

The cluster needs to apply some settings, and they are inside yaml/. coredns will be able to resolve external hostnames and kube-nftlb will be deployed after running this command:

root@debian:kube-nftlb# kubectl apply -f yaml

⁠Host settings ⚙

We have to remove the chains that kubernetes configures by default. To achieve this we have to stop the kubelet service, add a variable to the configuration file and reactivate the service. Follow the following commands:

# Stop kubelet
root@debian:~# systemctl stop kubelet.service

# Disable iptables rules
root@debian:~# echo "makeIPTablesUtilChains: false" >> /var/lib/kubelet/config.yaml

# Empty tables (don't forget to backup your ruleset)
root@debian:~# nft flush table ip nat
root@debian:~# nft flush table ip filter
root@debian:~# nft delete table ip mangle

# Start kubelet
root@debian:~# systemctl start kubelet.service

If everything has gone well, the kubelet service will not create those tables again. Now you will have to apply some commands to recover the connection with your deployments:

# Add chains to filter table
root@debian:~# nft add chain ip filter POSTROUTING
root@debian:~# nft add chain ip filter INPUT '{ type filter hook input priority filter; policy accept; }'
root@debian:~# nft add chain ip filter FORWARD '{ type filter hook forward priority filter; policy accept; }'
root@debian:~# nft add chain ip filter OUTPUT '{ type filter hook output priority filter; policy accept; }'

# Add chains and rules to nat table
root@debian:~# nft add chain ip nat PREROUTING '{ type nat hook prerouting priority dstnat; policy accept; }'
root@debian:~# nft add chain ip nat POSTROUTING '{ type nat hook postrouting priority srcnat; policy accept; }'
root@debian:~# nft add rule ip nat POSTROUTING oifname != "docker0" ip saddr 172.17.0.0/16 counter masquerade
root@debian:~# nft add chain ip nat INPUT '{ type nat hook input priority 100; policy accept; }'
root@debian:~# nft add chain ip nat OUTPUT '{ type nat hook output priority -100; policy accept; }'

Tag summary

Content type

Image

Digest

Size

63.3 MB

Last updated

almost 6 years ago

docker pull zevenet/kube-nftlb