Change:
<!-- This form is for bug reports and feature requests ONLY! If you're looking for help check and the . If the matter is security related, please disclose it privately via --Is this a BUG REPORT or FEATURE REQUEST?: /kind bug What happened: I'm using a proxy-pod to forward both and privileged ports to an service using the following configuration: However, when I start this service, it somehow highjacks the ports for other host IPs as well. I have a legacy nginx-proxy running on the same server, inside docker bound on specific non-conflicting IPs, but as soon as I start the pod above, it breaks SSL termination of the existing nginx proxy (outputing the "Fake ingress certificate"). Existing docker-compose: Name Command State Ports
nginxproxy nginx -g daemon off; Up 5.135.123.160:443-443/tcp,5.135.123.162:443-443/tcp, 5.135.123.160:80-80/tcp,5.135.123.162:80-80/tcp nginxproxydockergen /bin/sh -c /usr/local/bin/ ... Up nginxproxyletsencrypt /bin/bash /app/entrypoint. ... Up [...] Server certificate: subject: start date: Jun 11 21:55:37 2018 GMT expire date: Sep 9 21:55:37 2018 GMT subjectAltName: host "" matched cert's "" issuer: C=US; O=Let's Encrypt; CN=Let's Encrypt Authority X3 SSL certificate verify ok. $ dig [...] ;; ANSWER SECTION: 3599 IN CNAME ns349683- ns349683- 3599 IN A 5.135.123.160 [...] SSL certificate problem: unable to get local issuer certificate [...] -----END CERTIFICATE----- subject=/O=Acme Co/CN=Kubernetes Ingress Controller Fake Certificate issuer=/O=Acme Co/CN=Kubernetes Ingress Controller Fake Certificate $ kubectl version Client Version: version.Info{Major:"1", Minor:"10", GitVersion:"v1.10.3", GitCommit:"", GitTreeState:"clean", BuildDate:"2018-05-21T09:17:39Z", GoVersion:"go1.9.3", Compiler:"gc", Platform:"darwin/amd64"} Server Version: version.Info{Major:"1", Minor:"11", GitVersion:"v1.11.0", GitCommit:"", GitTreeState:"clean", BuildDate:"2018-06-27T20:08:34Z", GoVersion:"go1.10.2", Compiler:"gc", Platform:"linux/amd64"} Bare metal setup via kubeadm cat /etc/os-release NAME="Ubuntu" VERSION="16.04.4 LTS (Xenial Xerus)" ID=ubuntu IDLIKE=debian PRETTYNAME="Ubuntu 16.04.4 LTS" VERSIONID="16.04" HOMEURL="" SUPPORTURL="" BUGREPORTURL="" VERSIONCODENAME=xenial UBUNTUCODENAME=xenial Linux fr-3eaa 4.15.0-23-generic ~16.04.1-Ubuntu SMP Fri May 25 04:50:20 UTC 2018 x8664 x8664 x8664 GNU/Linux kubeadm version: &version.Info{Major:"1", Minor:"11", GitVersion:"v1.11.0", GitCommit:"", GitTreeState:"clean", BuildDate:"2018-06-27T20:14:41Z", GoVersion:"go1.10.2", Compiler:"gc", Platform:"linux/amd64"} kubectl apply -f Docker version 18.03.1-ce, build
/sig network
hostPort would just change the iptables in the node by docker. could do you tell us the iptables rules in nat table? iptables -t nat -nvL
I've flushed/dropped all iptables then reboot and again to make sure I had a clean state. Here is the iptables snapshots along the setup: Can confirm that SSL breaks for other IPs as soon as I start the pod proxy (last step). Looks like the culprit is . Destination should be and not . : Does work if I manually patch the IPtables rules: Which gives: Is there a way to automate this kind of patching to make sure the rules are not reverted by kubernetes? Thanks for the kind help :)
Thx for the reply about the iptable rules. According to the describe from u, I guess the cni plugin u used dont use the pod's data clearly. Maybe in the cni flannel,The flannel just change the rule by the hostport. And it think all the ip packets in the host must do the dnat and snat. I think flannel dont catch the hostip in the pod's yaml.
Hi mgcrea. Maybe i know why this happen. Maybe It is not the flannel's problem. I will try to fix this. /assign liucimin
GitHub didn't allow me to assign the following users: liucimin. Note that only and repo collaborators can be assigned. <detailsIn response to : Hi mgcrea. Maybe i know why this happen. Maybe It is not the flannel's problem. I will try to fix this. /assign liucimin Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
Issues go stale after 90d of inactivity. Mark the issue as fresh with . Stale issues rot after an additional 30d of inactivity and eventually close. If this issue is safe to close now please do so with . Send feedback to sig-testing, kubernetes/test-infra and/or . /lifecycle stale
Stale issues rot after 30d of inactivity. Mark the issue as fresh with . Rotten issues close after an additional 30d of inactivity. If this issue is safe to close now please do so with . Send feedback to sig-testing, kubernetes/test-infra and/or . /lifecycle rotten
any update on this? Did you ever find out the root cause? /remove-lifecycle rotten
Yes,I have push a pr in k8s.
v1.11.5 also the problem. Has Version 1.12 been fixed? thanks.
The pr is not merge yet. So the problem is also in v1.12 and v1.13

Discussion:
ContainerPort *int32 // Port number on the host. HostPort *int32 <ins> // Host ip to expose. HostIP string </ins> } // CheckpointData is a sample example structure to be used in test cases for checkpointing

port80 := int32(80) port443 := int32(443) proto := protocol("tcp") <ins> ip1234 := "1.2.3.4" </ins> portMappings := []*PortMapping{ { &proto, &port80, &port80, <ins> ip1234, </ins> }, { &proto, &port443, &port443, <ins> ip1234, </ins> }, } checkpoint1 := newFakeCheckpointV1("check1", portMappings, true)

ContainerPort *int32 `json:"container_port,omitempty"` // Port number on the host. HostPort *int32 `json:"host_port,omitempty"` <ins> // Host ip to expose. HostIP string `json:"host_ip,omitempty"` </ins> } // CheckpointData contains all types of data that can be stored in the checkpoint.

HostPort:      &pm.HostPort, ContainerPort: &pm.ContainerPort, Protocol:      &proto, <ins> HostIP:        pm.HostIp, </ins> }) } if config.GetLinux().GetSecurityContext().GetNamespaceOptions().GetNetwork() == runtimeapi.NamespaceMode_NODE {

HostPort:      *pm.HostPort, ContainerPort: *pm.ContainerPort, Protocol:      proto, <ins> HostIP:        pm.HostIP, </ins> }) } return portMappings, nil