It's not clear what you are asking for. If you just want to add/remove iptables rules, you can run in the host net namespace and do that (just like kube-proxy does). If you want us to add specific hooks that you can attach to, I'd need to hear a lot more justification - iptables rules have a cost, andnot every installation can use them...
On Fri, May 27, 2016 at 9:14 AM, Matt Hughes <[email protected]> wrote: > Is it possible or on the roadmap to have a pod drive the host's firewall > settings? I'm talking here about stock k8s, not GCE. > > My particular use case is I have some pods that need to set DSCP markings > (MANGLE table) on their outgoing traffic. Right now, my only solution is to > modify iptables on every node in the cluster. I can limit by destination > port and other settings but if I were running a truly open cluster, I really > wouldn't want to do this. IMO, whether or not to apply those markings > should really be driven by the POD/RCS/Deployment definition. Kubeproxy > already owns so much of iptables manipulation; it could make very specific > rules only marking traffic coming out of a particular pod IP and dynamically > add/remove these rules when a pod is created/destroyed. > > -- > You received this message because you are subscribed to the Google Groups > "Containers at Google" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > To post to this group, send email to [email protected]. > Visit this group at https://groups.google.com/group/google-containers. > For more options, visit https://groups.google.com/d/optout. -- You received this message because you are subscribed to the Google Groups "Containers at Google" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. Visit this group at https://groups.google.com/group/google-containers. For more options, visit https://groups.google.com/d/optout.
