Change:
Loopback addresses (127.0.0.0/8, ::1/128) can't be used by services in proxy-mode=ipvs it makes sense to dismiss those early, add RETURN rule to KUBE-NODE-PORT,KUBE-SERVICES No response <details</details25 <details</detailsnone <details</details<details</details<details</details<details</details
/sig network
As mentioned in , this is not a bug since the nodeport and ephemeral ranges overlap.
/kind cleanup /kind remove-bug
The label(s) cannot be applied, because the repository doesn't have them. <detailsIn response to : /kind cleanup /kind remove-bug </details
/remove-kind bug
The title of this issue should be changed to something like; Which would indicate that this is not a bug fix but an improvement. Also remove the invalid use-case in the description and add references to comments in like I think to dismiss nodePort connects to localhost early for proxy-mode=ipvs is an improvement, and in the majority of systems traffic to localhost is more common than traffic to nodePorts so this change will also improve overall performance. This is not a fix for overlapping ephemeral and nodePort ranges! So if the title and description is not updated the correct triage is to close this issue as it violates the non overlapping rule for ephemeral/nodeport ranges, please see
/area ipvs
Ok, i will change issue title and descripiton
/triage accepted

Discussion:
// according to proxier.ipsetList information and the ipset match relationship that `ipsetWithIptablesChain` specified. // some ipset(kubeClusterIPSet for example) have particular match rules and iptables jump relation should be sync separately. func (proxier *Proxier) writeIptablesRules() { <ins> // Dismiss connects to localhost early in the service chain loAddr := "127.0.0.0/8" if proxier.ipFamily == v1.IPv6Protocol { loAddr = "::1/128" } proxier.natRules.Write("-A", string(kubeServicesChain), "-s", loAddr, "-j", "RETURN") </ins> // We are creating those slices ones here to avoid memory reallocations // in every loop. Note that reuse the memory, instead of doing: //   slice = <some new slice>

JumpChain: "ACCEPT", MatchSet: kubeHealthCheckNodePortSet, }}, string(kubeServicesChain): {{ <ins> JumpChain: "RETURN", SourceAddress: "127.0.0.0/8", }, { </ins> JumpChain: string(kubeMarkMasqChain), MatchSet: kubeClusterIPSet, }, { JumpChain: string(kubeNodePortChain), MatchSet: "",

// Check iptables chain and rules epIpt := netlinktest.ExpectedIptablesChain{ string(kubeServicesChain): {{ <ins> JumpChain: "RETURN", SourceAddress: "127.0.0.0/8", }, { </ins> JumpChain: string(kubeMarkMasqChain), MatchSet: kubeClusterIPSet, }, { JumpChain: string(kubeNodePortChain), MatchSet: "",

// Check iptables chain and rules epIpt := netlinktest.ExpectedIptablesChain{ string(kubeServicesChain): { <ins> {JumpChain: "RETURN", SourceAddress: "127.0.0.0/8"}, </ins> {JumpChain: string(kubeLoadBalancerChain), MatchSet: kubeLoadBalancerSet}, {JumpChain: string(kubeMarkMasqChain), MatchSet: kubeClusterIPSet}, {JumpChain: string(kubeMarkMasqChain), MatchSet: kubeExternalIPSet},

// Check iptables chain and rules epIpt := netlinktest.ExpectedIptablesChain{ string(kubeServicesChain): {{ <ins> JumpChain: "RETURN", SourceAddress: "127.0.0.0/8", }, { </ins> JumpChain: string(kubeLoadBalancerChain), MatchSet: kubeLoadBalancerSet, }, { JumpChain: string(kubeMarkMasqChain), MatchSet: kubeClusterIPSet,

} } } <ins> func TestDismissLocalhostRuleExist(t *testing.T) { tests := []struct { name     string ipFamily v1.IPFamily src      string }{ { name:     "ipv4 rule", ipFamily: v1.IPv4Protocol, src:      "127.0.0.0/8", }, { name:     "ipv6 rule", ipFamily: v1.IPv6Protocol, src:      "::1/128", }, } for _, test := range tests { t.Run(test.name, func(t *testing.T) { ipt := iptablestest.NewFake() if test.ipFamily == v1.IPv6Protocol { ipt = iptablestest.NewIPv6Fake() } ipvs := ipvstest.NewFake() ipset := ipsettest.NewFake(testIPSetVersion) fp := NewFakeProxier(ipt, ipvs, ipset, nil, nil, test.ipFamily) fp.syncProxyRules() rules := getRules(ipt, kubeServicesChain) if len(rules) <= 0 { t.Errorf("skip loop back ip in kubeservice chain not exist") return } if !rules[0].Jump.Matches("RETURN") || !rules[0].SourceAddress.Matches(test.src) { t.Errorf("rules not match, expect jump: %s, got: %s; expect source address: %s, got: %s", "RETURN", rules[0].Jump.String(), test.src, rules[0].SourceAddress.String()) } }) } } </ins>

// ExpectedIptablesRule is the expected iptables rules with jump chain and match ipset name type ExpectedIptablesRule struct { <del> JumpChain string MatchSet  string </del> <ins> SourceAddress string JumpChain     string MatchSet      string </ins> } // ExpectedIPSet is the expected ipset with set name and entries name