kubeovn / kube-ovn / 23181046861

23%

master: 23%

Build Type

Pull #6462

github

Committed by zbb88888

Commit Message

feat: add --disable-svc-iptables-rule flag to skip service-related iptables rules

In non-primary CNI scenarios (Cilium, Calico with kube-proxy IPVS),
kube-ovn's service-related iptables rules (MARK, REJECT, SNAT, NodePort)
are redundant and can interfere with the primary CNI's service handling.

Add a new --disable-svc-iptables-rule flag that, when enabled:
- Skips MARK 0x4000 and MASQUERADE rules for pod-to-service traffic
- Skips REJECT rules for unmatched service traffic
- Skips SNAT rules for service-to-pod traffic
- Skips NodePort MARK rules (0x80000 and 0x4000)
- Skips service ACCEPT rules in filter INPUT/FORWARD chains
- Cleans up any previously installed service rules

Signed-off-by: zbb88888 <jmdxjsjgcxy@gmail.com>

Pull Request Pull Request #6462: feat: add --disable-svc-iptables-rule flag to skip service-related iptables

Run Details

0 of 69 new or added lines in 2 files covered. (0.0%)

2 existing lines in 1 file now uncovered.

12887 of 54967 relevant lines covered (23.44%)

0.27 hits per line