Skip to content

Commit 77d9bdf

Browse files
XinShuYangXinShuYang
committed
Enable Windows ProxyAll by default
Enable windows proxyall feature by default because the kube-proxy userspace datapath has been removed since kubernetes 1.26. (kubernetes/kubernetes#112133) Signed-off-by: Shuyang Xin <[email protected]>
1 parent 7be2f83 commit 77d9bdf

File tree

10 files changed

+253
-170
lines changed

10 files changed

+253
-170
lines changed

‎build/yamls/antrea-windows-containerd.yml‎

Lines changed: 18 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,10 @@
11
apiVersion: v1
22
data:
33
Install-WindowsCNI-Containerd.ps1: |
4-
$ErrorActionPreference = "Stop";
4+
$ErrorActionPreference = "Stop";
55
mkdir -force c:/var/log/antrea
6-
76
$mountPath = $env:CONTAINER_SANDBOX_MOUNT_POINT
8-
$mountPath = ($mountPath.Replace('\', '/')).TrimEnd('/')
7+
$mountPath = ($mountPath.Replace('\', '/')).TrimEnd('/')
98
mkdir -force C:/var/run/secrets/kubernetes.io/serviceaccount
109
cp $mountPath/var/run/secrets/kubernetes.io/serviceaccount/ca.crt C:/var/run/secrets/kubernetes.io/serviceaccount
1110
cp $mountPath/var/run/secrets/kubernetes.io/serviceaccount/token C:/var/run/secrets/kubernetes.io/serviceaccount
@@ -15,7 +14,6 @@ data:
1514
cp $mountPath/etc/antrea/antrea-cni.conflist c:/etc/cni/net.d/10-antrea.conflist
1615
mkdir -force c:/k/antrea/bin
1716
cp $mountPath/k/antrea/bin/antctl.exe c:/k/antrea/bin/antctl.exe
18-
1917
Run-AntreaAgent-Containerd.ps1: |
2018
$ErrorActionPreference = "Stop"
2119
$mountPath = $env:CONTAINER_SANDBOX_MOUNT_POINT
@@ -25,7 +23,7 @@ kind: ConfigMap
2523
metadata:
2624
labels:
2725
app: antrea
28-
name: antrea-agent-windows-kht6m7hthm
26+
name: antrea-agent-windows-4d6m7hf65f
2927
namespace: kube-system
3028
---
3129
apiVersion: v1
@@ -41,7 +39,7 @@ data:
4139
# Enable EndpointSlice support in AntreaProxy. Don't enable this feature unless that EndpointSlice
4240
# API version v1beta1 is supported and set as enabled in Kubernetes. If AntreaProxy is not enabled,
4341
# this flag will not take effect.
44-
# EndpointSlice: false
42+
# EndpointSlice: true
4543
4644
# Enable NodePortLocal feature to make the Pods reachable externally through NodePort
4745
# NodePortLocal: true
@@ -157,7 +155,12 @@ data:
157155
# Therefore, running kube-proxy is no longer required. This requires the AntreaProxy feature to be enabled.
158156
# Note that this option is experimental. If kube-proxy is removed, option kubeAPIServerOverride must be used to access
159157
# apiserver directly.
160-
#proxyAll: false
158+
proxyAll: true
159+
# The value of the "service.kubernetes.io/service-proxy-name" label for AntreaProxy to match. If it is set,
160+
# then AntreaProxy will only handle Services with the label that equals the provided value. If it is not set,
161+
# then AntreaProxy will only handle Services without the "service.kubernetes.io/service-proxy-name" label,
162+
# but ignore Services with the label no matter what is the value.
163+
serviceProxyName: ""
161164
162165
nodePortLocal:
163166
# Enable NodePortLocal, a feature used to make Pods reachable using port forwarding on the host. To
@@ -187,7 +190,7 @@ kind: ConfigMap
187190
metadata:
188191
labels:
189192
app: antrea
190-
name: antrea-windows-config-89b7ch9t9b
193+
name: antrea-windows-config-cb2hmgg648
191194
namespace: kube-system
192195
---
193196
apiVersion: apps/v1
@@ -206,15 +209,11 @@ spec:
206209
template:
207210
metadata:
208211
annotations:
209-
"microsoft.com/hostprocess-inherit-user": "true"
212+
microsoft.com/hostprocess-inherit-user: "true"
210213
labels:
211214
app: antrea
212215
component: antrea-agent
213216
spec:
214-
securityContext:
215-
windowsOptions:
216-
runAsUserName: "NT AUTHORITY\\SYSTEM"
217-
hostProcess: true
218217
containers:
219218
- args:
220219
- -file
@@ -263,6 +262,10 @@ spec:
263262
nodeSelector:
264263
kubernetes.io/os: windows
265264
priorityClassName: system-node-critical
265+
securityContext:
266+
windowsOptions:
267+
hostProcess: true
268+
runAsUserName: NT AUTHORITY\SYSTEM
266269
serviceAccountName: antrea-agent
267270
tolerations:
268271
- key: CriticalAddonsOnly
@@ -271,11 +274,11 @@ spec:
271274
operator: Exists
272275
volumes:
273276
- configMap:
274-
name: antrea-windows-config-89b7ch9t9b
277+
name: antrea-windows-config-cb2hmgg648
275278
name: antrea-windows-config
276279
- configMap:
277280
defaultMode: 420
278-
name: antrea-agent-windows-kht6m7hthm
281+
name: antrea-agent-windows-4d6m7hf65f
279282
name: antrea-agent-windows
280283
- hostPath:
281284
path: /var/log/antrea/

‎build/yamls/antrea-windows.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -142,7 +142,7 @@ data:
142142
# Therefore, running kube-proxy is no longer required. This requires the AntreaProxy feature to be enabled.
143143
# Note that this option is experimental. If kube-proxy is removed, option kubeAPIServerOverride must be used to access
144144
# apiserver directly.
145-
#proxyAll: false
145+
proxyAll: true
146146
# The value of the "service.kubernetes.io/service-proxy-name" label for AntreaProxy to match. If it is set,
147147
# then AntreaProxy will only handle Services with the label that equals the provided value. If it is not set,
148148
# then AntreaProxy will only handle Services without the "service.kubernetes.io/service-proxy-name" label,
@@ -177,7 +177,7 @@ kind: ConfigMap
177177
metadata:
178178
labels:
179179
app: antrea
180-
name: antrea-windows-config-hc82tmf96f
180+
name: antrea-windows-config-cb2hmgg648
181181
namespace: kube-system
182182
---
183183
apiVersion: apps/v1
@@ -265,7 +265,7 @@ spec:
265265
operator: Exists
266266
volumes:
267267
- configMap:
268-
name: antrea-windows-config-hc82tmf96f
268+
name: antrea-windows-config-cb2hmgg648
269269
name: antrea-windows-config
270270
- configMap:
271271
defaultMode: 420

‎build/yamls/windows/base/conf/antrea-agent.conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -124,7 +124,7 @@ antreaProxy:
124124
# Therefore, running kube-proxy is no longer required. This requires the AntreaProxy feature to be enabled.
125125
# Note that this option is experimental. If kube-proxy is removed, option kubeAPIServerOverride must be used to access
126126
# apiserver directly.
127-
#proxyAll: false
127+
proxyAll: true
128128
# The value of the "service.kubernetes.io/service-proxy-name" label for AntreaProxy to match. If it is set,
129129
# then AntreaProxy will only handle Services with the label that equals the provided value. If it is not set,
130130
# then AntreaProxy will only handle Services without the "service.kubernetes.io/service-proxy-name" label,

‎build/yamls/windows/containerd/agent-containerd.yml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@ metadata:
44
labels:
55
component: antrea-agent
66
name: antrea-agent-windows
7-
namespace: kube-system
87
spec:
98
selector:
109
matchLabels:

‎ci/jenkins/test.sh‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -252,7 +252,7 @@ function collect_windows_network_info_and_logs {
252252

253253
function wait_for_antrea_windows_pods_ready {
254254
kubectl apply -f "${WORKDIR}/antrea.yml"
255-
if [[ "${PROXY_ALL}" == false ]]; then
255+
if [[ "${PROXY_ALL}" == false && ${TESTCASE} =~ "windows-e2e" ]]; then
256256
kubectl apply -f "${WORKDIR}/kube-proxy-${WINDOWS_YAML_SUFFIX}.yml"
257257
fi
258258
kubectl apply -f "${WORKDIR}/antrea-${WINDOWS_YAML_SUFFIX}.yml"
@@ -261,7 +261,7 @@ function wait_for_antrea_windows_pods_ready {
261261
kubectl rollout status deployment.apps/antrea-controller -n kube-system
262262
kubectl rollout status daemonset/antrea-agent -n kube-system
263263
kubectl rollout status daemonset.apps/antrea-agent-windows -n kube-system
264-
if [[ "${PROXY_ALL}" == false ]]; then
264+
if [[ "${PROXY_ALL}" == false && ${TESTCASE} =~ "windows-e2e" ]]; then
265265
kubectl rollout status daemonset/kube-proxy-windows -n kube-system
266266
fi
267267
kubectl get nodes -o wide --no-headers=true | awk -v role="$CONTROL_PLANE_NODE_ROLE" '$3 !~ role && $1 ~ /win/ {print $6}' | while read IP; do
@@ -372,13 +372,14 @@ function deliver_antrea_windows {
372372
# Enable verbose log for troubleshooting.
373373
sed -i "s/--v=0/--v=4/g" build/yamls/antrea.yml build/yamls/antrea-windows.yml
374374

375-
if [[ "${PROXY_ALL}" == true ]]; then
375+
if [[ "${PROXY_ALL}" == false && ${TESTCASE} =~ "windows-e2e" ]]; then
376+
sed -i "s|.*proxyAll: true| proxyAll: false|g" build/yamls/antrea.yml build/yamls/antrea-windows.yml
377+
else
376378
echo "====== Updating yaml files to enable proxyAll ======"
377379
KUBERNETES_SVC_EP_IP=$(kubectl get endpoints kubernetes -o jsonpath='{.subsets[0].addresses[0].ip}')
378380
KUBERNETES_SVC_EP_PORT=$(kubectl get endpoints kubernetes -o jsonpath='{.subsets[0].ports[0].port}')
379381
KUBERNETES_SVC_EP_ADDR="${KUBERNETES_SVC_EP_IP}:${KUBERNETES_SVC_EP_PORT}"
380382
sed -i "s|.*kubeAPIServerOverride: \"\"| kubeAPIServerOverride: \"${KUBERNETES_SVC_EP_ADDR}\"|g" build/yamls/antrea.yml build/yamls/antrea-windows.yml
381-
sed -i "s|.*proxyAll: false| proxyAll: true|g" build/yamls/antrea.yml build/yamls/antrea-windows.yml
382383
fi
383384

384385
cp -f build/yamls/*.yml $WORKDIR
@@ -493,6 +494,10 @@ function deliver_antrea_windows_containerd {
493494
# Enable verbose log for troubleshooting.
494495
sed -i "s/--v=0/--v=4/g" build/yamls/antrea.yml build/yamls/antrea-windows-containerd.yml
495496

497+
echo "====== Updating yaml files to enable proxyAll ======"
498+
KUBE_API_SERVER=$(kubectl --kubeconfig=$KubeConfigFile config view -o jsonpath='{.clusters[0].cluster.server}')
499+
sed -i "s|.*kubeAPIServerOverride: \"\"| kubeAPIServerOverride: \"${KUBE_API_SERVER}\"|g" build/yamls/antrea.yml build/yamls/antrea-windows-containerd.yml
500+
496501
cp -f build/yamls/*.yml $WORKDIR
497502
docker save -o antrea-ubuntu.tar antrea/antrea-ubuntu:latest
498503

0 commit comments

Comments
 (0)