[release-1.5] istio-iptables: Replace socket match with conntrack match #281
Conversation
Some kernels, like COS on GKE, are configured without the 'xt_socket' kernel module that implements the 'socket' match in iptables rules. Replace the 'socket' match with a 'conntrack' state match that diverts all established and related packets to the local stack. Signed-off-by: Jarno Rajahalme <[email protected]>
|
All (the pull request submitter and all commit authors) CLAs are signed, but one or more commits were authored or co-authored by someone other than the pull request submitter. We need to confirm that all authors are ok with their commits being contributed to this project. Please have them confirm that by leaving a comment that contains only Note to project maintainer: There may be cases where the author cannot leave a comment, or the comment is not properly detected as consent. In those cases, you can manually confirm consent of the commit author(s), and set the ℹ️ Googlers: Go here for more info. |
googlebot
added
the
cla: no
istio-testing
added
the
size/XS
rlenglet
added
cla: yes
|
A Googler has manually verified that the CLAs look good. (Googler, please make sure the reason for overriding the CLA status is clearly documented in these comments.) ℹ️ Googlers: Go here for more info. |
|
/ok-to-test |
istio-testing
added
the
ok-to-test
This is an automated cherry-pick of #280