mirror of
https://github.com/k3s-io/k3s.git
synced 2024-06-07 19:41:36 +00:00
a952d5c32a
The Linux kernel is inconsistent about how devconf is configured for new network namespaces between ipv4 and ipv6. The behavior can also be controlled via net.core.devconf_inherit_init_net in Linux 5.1+ so make sure to enable forwarding on all and default for both ipv6 and ipv4. This issue first came up testing on a yocto kernel that had this patch: ipv4: net namespace does not inherit network configurations [0] https://www.kernel.org/doc/html/latest/admin-guide/sysctl/net.html#devconf-inherit-init-net [1] https://lkml.org/lkml/2014/7/29/119 Signed-off-by: Brennan Ashton <brennana@jfrog.com>
43 lines
1.3 KiB
Go
43 lines
1.3 KiB
Go
package syssetup
|
|
|
|
import (
|
|
"io/ioutil"
|
|
"os"
|
|
"os/exec"
|
|
|
|
"github.com/sirupsen/logrus"
|
|
)
|
|
|
|
func loadKernelModule(moduleName string) {
|
|
if _, err := os.Stat("/sys/module/" + moduleName); err == nil {
|
|
logrus.Infof("module %s was already loaded", moduleName)
|
|
return
|
|
}
|
|
|
|
if err := exec.Command("modprobe", moduleName).Run(); err != nil {
|
|
logrus.Warnf("failed to start %s module", moduleName)
|
|
}
|
|
}
|
|
|
|
func enableSystemControl(file string) {
|
|
if err := ioutil.WriteFile(file, []byte("1"), 0640); err != nil {
|
|
logrus.Warnf("failed to write value 1 at %s: %v", file, err)
|
|
}
|
|
}
|
|
|
|
func Configure() {
|
|
loadKernelModule("overlay")
|
|
loadKernelModule("nf_conntrack")
|
|
loadKernelModule("br_netfilter")
|
|
|
|
// Kernel is inconsistent about how devconf is configured for
|
|
// new network namespaces between ipv4 and ipv6. Make sure to
|
|
// enable forwarding on all and default for both ipv4 and ipv8.
|
|
enableSystemControl("/proc/sys/net/ipv4/conf/all/forwarding")
|
|
enableSystemControl("/proc/sys/net/ipv4/conf/default/forwarding")
|
|
enableSystemControl("/proc/sys/net/ipv6/conf/all/forwarding")
|
|
enableSystemControl("/proc/sys/net/ipv6/conf/default/forwarding")
|
|
enableSystemControl("/proc/sys/net/bridge/bridge-nf-call-iptables")
|
|
enableSystemControl("/proc/sys/net/bridge/bridge-nf-call-ip6tables")
|
|
}
|