func ensureKubeHostportChains(iptables utiliptables.Interface, natInterfaceName string) error {
	klog.V(4).Info("Ensuring kubelet hostport chains")
	// Ensure kubeHostportChain
	if _, err := iptables.EnsureChain(utiliptables.TableNAT, kubeHostportsChain); err != nil {
		return fmt.Errorf("failed to ensure that %s chain %s exists: %v", utiliptables.TableNAT, kubeHostportsChain, err)
	}
	tableChainsNeedJumpServices := []struct {
		table utiliptables.Table
		chain utiliptables.Chain
	}{
		{utiliptables.TableNAT, utiliptables.ChainOutput},
		{utiliptables.TableNAT, utiliptables.ChainPrerouting},
	}
	args := []string{"-m", "comment", "--comment", "kube hostport portals",
		"-m", "addrtype", "--dst-type", "LOCAL",
		"-j", string(kubeHostportsChain)}
	for _, tc := range tableChainsNeedJumpServices {
		// KUBE-HOSTPORTS chain needs to be appended to the system chains.
		// This ensures KUBE-SERVICES chain gets processed first.
		// Since rules in KUBE-HOSTPORTS chain matches broader cases, allow the more specific rules to be processed first.
		if _, err := iptables.EnsureRule(utiliptables.Append, tc.table, tc.chain, args...); err != nil {
			return fmt.Errorf("failed to ensure that %s chain %s jumps to %s: %v", tc.table, tc.chain, kubeHostportsChain, err)
		}
	}
	if natInterfaceName != "" && natInterfaceName != "lo" {
		// Need to SNAT traffic from localhost
		localhost := "127.0.0.0/8"
		if iptables.IsIPv6() {
			localhost = "::1/128"
		}
		args = []string{"-m", "comment", "--comment", "SNAT for localhost access to hostports", "-o", natInterfaceName, "-s", localhost, "-j", "MASQUERADE"}
		if _, err := iptables.EnsureRule(utiliptables.Append, utiliptables.TableNAT, utiliptables.ChainPostrouting, args...); err != nil {
			return fmt.Errorf("failed to ensure that %s chain %s jumps to MASQUERADE: %v", utiliptables.TableNAT, utiliptables.ChainPostrouting, err)
		}
	}
	return nil
}
// ensureKubeHostportChains ensures the KUBE-HOSTPORTS chain is setup correctly
ensureKubeHostportChains ensures the KUBE-HOSTPORTS chain is setup correctly
// ensureKubeHostportChains ensures the KUBE - HOSTPORTS chain is setup correctly
func ensureKubeHostportChains(iptables utiliptables.Interface, natInterfaceName string) error {
	klog.V(4).Info("Ensuring kubelet hostport chains")
	if _, err := iptables.EnsureChain(utiliptables.TableNAT, kubeHostportsChain); err != nil {
		return fmt.Errorf("failed to ensure that %s chain %s exists: %v", utiliptables.TableNAT, kubeHostportsChain, err)
	}
	tableChainsNeedJumpServices := []struct {
		table utiliptables.Table
		chain utiliptables.Chain
	}{
		{utiliptables.TableNAT, utiliptables.ChainOutput},
		{utiliptables.TableNAT, utiliptables.ChainPrerouting},
	}
	args := []string{"-m", "comment", "--comment", "kube hostport portals",
		"-m", "addrtype", "--dst-type", "LOCAL",
		"-j", string(kubeHostportsChain)}
	for _, tc := range tableChainsNeedJumpServices {
		if _, err := iptables.EnsureRule(utiliptables.Append, tc.table, tc.chain, args...); err != nil {
			return fmt.Errorf("failed to ensure that %s chain %s jumps to %s: %v", tc.table, tc.chain, kubeHostportsChain, err)
		}
	}
	if natInterfaceName != "" && natInterfaceName != "lo" {
		localhost := "127.0.0.0/8"
		if iptables.IsIPv6() {
			localhost = "::1/128"
		}
		args = []string{"-m", "comment", "--comment", "SNAT for localhost access to hostports", "-o", natInterfaceName, "-s", localhost, "-j", "MASQUERADE"}
		if _, err := iptables.EnsureRule(utiliptables.Append, utiliptables.TableNAT, utiliptables.ChainPostrouting, args...); err != nil {
			return fmt.Errorf("failed to ensure that %s chain %s jumps to MASQUERADE: %v", utiliptables.TableNAT, utiliptables.ChainPostrouting, err)
		}
	}
	return nil
}
func ensureKubeHostportChains ( iptables utiliptables . Interface , natInterfaceName string ) error { klog . V ( 4 ) . Info ( " " ) if _ , err := iptables . EnsureChain ( utiliptables . TableNAT , kubeHostportsChain ) ; err != nil { return fmt . Errorf ( " " , utiliptables . TableNAT , kubeHostportsChain , err ) } tableChainsNeedJumpServices := [ ] struct { table utiliptables . Table chain utiliptables . Chain } { { utiliptables . TableNAT , utiliptables . ChainOutput } , { utiliptables . TableNAT , utiliptables . ChainPrerouting } , } args := [ ] string { " " , " " , " " , " " , " " , " " , " " , " " , " " , string ( kubeHostportsChain ) } for _ , tc := range tableChainsNeedJumpServices { if _ , err := iptables . EnsureRule ( utiliptables . Append , tc . table , tc . chain , args ... ) ; err != nil { return fmt . Errorf ( " " , tc . table , tc . chain , kubeHostportsChain , err ) } } if natInterfaceName != " " && natInterfaceName != " " { localhost := " " if iptables . IsIPv6 ( ) { localhost = " " } args = [ ] string { " " , " " , " " , " " , " " , natInterfaceName , " " , localhost , " " , " " } if _ , err := iptables . EnsureRule ( utiliptables . Append , utiliptables . TableNAT , utiliptables . ChainPostrouting , args ... ) ; err != nil { return fmt . Errorf ( " " , utiliptables . TableNAT , utiliptables . ChainPostrouting , err ) } } return nil }
ensureKubeHostportChains ensures the KUBE-HOSTPORTS chain is setup correctly
ensureKubeHostportChains ensures the KUBE - HOSTPORTS chain is setup correctly
// Ensure kubeHostportChain // KUBE-HOSTPORTS chain needs to be appended to the system chains. // This ensures KUBE-SERVICES chain gets processed first. // Since rules in KUBE-HOSTPORTS chain matches broader cases, allow the more specific rules to be processed first. // Need to SNAT traffic from localhost