Change:
Related to . As a safety mesure, it could be very useful to actually include a flag to proxy to MASQUERADE everything (acting very close to a userspace proxy). I think it's not very hard to do and a very good way to diagnose or even fallback in case of problem (I'm thinking about vxlan cases). Something like "--snat-clients" or "--snat-pods" could be appropriate.
/cc
Looking at the current code: It looks like we SNAT almost everything already now? Would adding a set-mark rule (behind the flag of course) at line 548 be sufficient? Deprecated Public IPs, Loadbalancer IPs, and NodePorts all appear to be marked for SNAT already (also endpoint loopback traffic).
I think that is the flag, yeah. , Benjamin Elder wrote:
Ok, I'll push out a PR for that in a moment. I should be able to take care of that and the cleanup flag (PR out but needs some more work) today. On Aug 20, 2015 2:12 PM, "Tim Hockin" wrote:

Discussion:
ForceUserspaceProxy bool SyncPeriod          time.Duration nodeRef             *api.ObjectReference // Reference to this node. <ins> MasqueradeAll       bool </ins> } // NewProxyServer creates a new ProxyServer object with default parameters

fs.StringVar(&s.HostnameOverride, "hostname-override", s.HostnameOverride, "If non-empty, will use this string as identification instead of the actual hostname.") fs.BoolVar(&s.ForceUserspaceProxy, "legacy-userspace-proxy", true, "Use the legacy userspace proxy (instead of the pure iptables proxy).") fs.DurationVar(&s.SyncPeriod, "iptables-sync-period", 5*time.Second, "How often iptables rules are refreshed (e.g. '5s', '1m', '2h22m').  Must be greater than 0.") <ins> fs.BoolVar(&s.MasqueradeAll, "masquerade-all", false, "If using the pure iptables proxy, SNAT everything") </ins> } // Run runs the specified ProxyServer.  This should never exit.

glog.V(2).Info("Using iptables Proxier.") execer := exec.New() <del> proxierIptables, err := iptables.NewProxier(utiliptables.New(execer, protocol), execer, s.SyncPeriod) </del> <ins> proxierIptables, err := iptables.NewProxier(utiliptables.New(execer, protocol), execer, s.SyncPeriod, s.MasqueradeAll) </ins> if err != nil { glog.Fatalf("Unable to create proxier: %v", err) }

low-diskspace-threshold-mb manifest-url manifest-url-header <ins> masquerade-all </ins> master-service-namespace max-concurrency max-connection-bytes-per-sec

iptables                    utiliptables.Interface haveReceivedServiceUpdate   bool // true once we've seen an OnServiceUpdate event haveReceivedEndpointsUpdate bool // true once we've seen an OnEndpointsUpdate event <ins> MasqueradeAll               bool </ins> } // Proxier implements ProxyProvider

// An error will be returned if iptables fails to update or acquire the initial lock. // Once a proxier is created, it will keep iptables up to date in the background and // will not terminate if a particular iptables call fails. <del> func NewProxier(ipt utiliptables.Interface, exec utilexec.Interface, syncPeriod time.Duration) (*Proxier, error) { </del> <ins> func NewProxier(ipt utiliptables.Interface, exec utilexec.Interface, syncPeriod time.Duration, MasqueradeAll bool) (*Proxier, error) { </ins> // Set the route_localnet sysctl we need for if err := setSysctl(sysctlRouteLocalnet, 1); err != nil {

tearDownUserspaceIptables(ipt) return &Proxier{ <del> serviceMap: make(map[proxy.ServicePortName]*serviceInfo), syncPeriod: syncPeriod, iptables:   ipt, </del> <ins> serviceMap:    make(map[proxy.ServicePortName]*serviceInfo), syncPeriod:    syncPeriod, iptables:      ipt, MasqueradeAll: MasqueradeAll, </ins> }, nil }

activeChains[svcChain] = true // Capture the clusterIP. <del> writeLine(rulesLines, </del> <ins> args := []string{ </ins> "-A", string(iptablesServicesChain), "-m", "comment", "--comment", fmt.Sprintf(""%s cluster IP"", name.String()), "-m", protocol, "-p", protocol, "-d", fmt.Sprintf("%s/32", info.clusterIP.String()), "--dport", fmt.Sprintf("%d", info.port), <del> "-j", string(svcChain)) </del> <ins> } if proxier.MasqueradeAll { writeLine(rulesLines, append(args, "-j", "MARK", "--set-xmark", fmt.Sprintf("%s/0xffffffff", iptablesMasqueradeMark))...) } writeLine(rulesLines, append(args, "-j", string(svcChain))...) </ins> // Capture externalIPs. for _, externalIP := range info.deprecatedPublicIPs {