513cebe7b7
* Add Virtual Kubelet provider for VIC Initial virtual kubelet provider for VMware VIC. This provider currently handles creating and starting of a pod VM via the VIC portlayer and persona server. Image store handling via the VIC persona server. This provider currently requires the feature/wolfpack branch of VIC. * Added pod stop and delete. Also added node capacity. Added the ability to stop and delete pod VMs via VIC. Also retrieve node capacity information from the VCH. * Cleanup and readme file Some file clean up and added a Readme.md markdown file for the VIC provider. * Cleaned up errors, added function comments, moved operation code 1. Cleaned up error handling. Set standard for creating errors. 2. Added method prototype comments for all interface functions. 3. Moved PodCreator, PodStarter, PodStopper, and PodDeleter to a new folder. * Add mocking code and unit tests for podcache, podcreator, and podstarter Used the unit test framework used in VIC to handle assertions in the provider's unit test. Mocking code generated using OSS project mockery, which is compatible with the testify assertion framework. * Vendored packages for the VIC provider Requires feature/wolfpack branch of VIC and a few specific commit sha of projects used within VIC. * Implementation of POD Stopper and Deleter unit tests (#4) * Updated files for initial PR
99 lines
3.1 KiB
Bash
Executable File
99 lines
3.1 KiB
Bash
Executable File
#!/bin/sh
|
|
|
|
# Begin /etc/systemd/scripts/iptables
|
|
|
|
# Insert connection-tracking modules
|
|
# (not needed if built into the kernel)
|
|
modprobe nf_conntrack
|
|
modprobe xt_LOG
|
|
|
|
# Enable IP forwarding
|
|
echo 1 > /proc/sys/net/ipv4/ip_forward
|
|
|
|
# Enable broadcast echo Protection
|
|
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
|
|
|
|
# Disable Source Routed Packets
|
|
echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route
|
|
echo 0 > /proc/sys/net/ipv4/conf/default/accept_source_route
|
|
|
|
# Enable TCP SYN Cookie Protection
|
|
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
|
|
|
|
# Disable ICMP Redirect Acceptance
|
|
echo 0 > /proc/sys/net/ipv4/conf/default/accept_redirects
|
|
|
|
# Do not send Redirect Messages
|
|
echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects
|
|
echo 0 > /proc/sys/net/ipv4/conf/default/send_redirects
|
|
|
|
# Drop Spoofed Packets coming in on an interface, where responses
|
|
# would result in the reply going out a different interface.
|
|
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
|
|
echo 1 > /proc/sys/net/ipv4/conf/default/rp_filter
|
|
|
|
# be verbose on dynamic ip-addresses (not needed in case of static IP)
|
|
echo 2 > /proc/sys/net/ipv4/ip_dynaddr
|
|
|
|
# disable Explicit Congestion Notification
|
|
# too many routers are still ignorant
|
|
echo 0 > /proc/sys/net/ipv4/tcp_ecn
|
|
|
|
# add a routing table for traffic from bridge that is not destined
|
|
# for a local address
|
|
echo 201 bridge.out >> /etc/iproute2/rt_tables
|
|
ip rule add fwmark 1 table bridge.out
|
|
|
|
# blow away any existing rules with iptables-restore
|
|
iptables-restore <<RULES
|
|
*mangle
|
|
:PREROUTING ACCEPT [0:0]
|
|
:INPUT ACCEPT [0:0]
|
|
:FORWARD ACCEPT [0:0]
|
|
:OUTPUT ACCEPT [0:0]
|
|
:POSTROUTING ACCEPT [0:0]
|
|
-A PREROUTING -i bridge -m addrtype ! --dst-type LOCAL -j MARK --set-xmark 0x1/0xffffffff
|
|
COMMIT
|
|
*nat
|
|
:PREROUTING ACCEPT [0:0]
|
|
:INPUT ACCEPT [0:0]
|
|
:OUTPUT ACCEPT [0:0]
|
|
:POSTROUTING ACCEPT [0:0]
|
|
:VIC - [0:0]
|
|
-A PREROUTING -m addrtype --dst-type LOCAL -j VIC
|
|
-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j VIC
|
|
-A POSTROUTING ! -o bridge -j MASQUERADE
|
|
COMMIT
|
|
*filter
|
|
:INPUT DROP [0:0]
|
|
:FORWARD DROP [0:0]
|
|
:OUTPUT ACCEPT [0:0]
|
|
:VIC - [0:0]
|
|
-A INPUT -i lo -j ACCEPT
|
|
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
|
-A INPUT -m conntrack --ctstate INVALID -j DROP
|
|
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
|
|
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
|
|
-A INPUT -p udp -m udp --dport 68 -j ACCEPT
|
|
-A INPUT -p tcp -m tcp --dport 2375 -j ACCEPT
|
|
-A INPUT -p tcp -m tcp --dport 2376 -j ACCEPT
|
|
-A INPUT -p tcp -m tcp --dport 2377 -j ACCEPT
|
|
-A INPUT -p tcp -m tcp --dport 2378 -j ACCEPT
|
|
-A INPUT -p tcp -m tcp --dport 2380 -j ACCEPT
|
|
|
|
-A INPUT -p tcp -m tcp --dport 6062 -j ACCEPT
|
|
-A INPUT -p tcp -m tcp --dport 6063 -j ACCEPT
|
|
|
|
-A INPUT -i bridge -p udp -m udp --dport 53 -j ACCEPT
|
|
-A INPUT -i bridge -p tcp -m tcp --dport 53 -j ACCEPT
|
|
-A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
|
|
-A INPUT -p tcp -j REJECT --reject-with tcp-reset
|
|
-A INPUT -j REJECT --reject-with icmp-proto-unreachable
|
|
-A FORWARD -o bridge -j VIC
|
|
-A FORWARD -o bridge -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
|
|
|
-A VIC -i bridge -o bridge -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
|
-A VIC -i bridge -o bridge -j REJECT --reject-with icmp-port-unreachable
|
|
COMMIT
|
|
RULES
|