Skip to content

Commit

Permalink
fix: block wireserver port 32526 for non-host network pods (#4754)
Browse files Browse the repository at this point in the history 
Co-authored-by: anujmaheshwari1 <[email protected]>
  • Loading branch information
@anujmaheshwari1
anujmaheshwari1 and anujmaheshwari1 authored Aug 5, 2024
1 parent 0b30482 commit e2598a3
Show file tree
Hide file tree
Showing 240 changed files with 245 additions and 80 deletions.
3 changes: 2 additions & 1 deletion parts/linux/cloud-init/artifacts/block_wireserver.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -10,4 +10,5 @@
#
# Note: we should not block all traffic to 168.63.129.16. For example UDP traffic is still needed
# for DNS.
iptables -I FORWARD -d 168.63.129.16 -p tcp -m multiport --dports 80,32526 -j DROP
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 80 -j DROP
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 32526 -j DROP
3 changes: 3 additions & 0 deletions parts/linux/cloud-init/artifacts/cse_config.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -518,12 +518,15 @@ EOF
# for TCP protocol (which http uses)
#
# 168.63.129.16 contains protected settings that have priviledged info.
# HostGAPlugin (Host-GuestAgent-Plugin) is a web server process that runs on the physical host that serves the operational and diagnostic needs of the in-VM Guest Agent.
# IT listens on both port 80 and 32526 hence access is only needed for agent but not the containers.
#
# The host can still reach 168.63.129.16 because it goes through the OUTPUT chain, not FORWARD.
#
# Note: we should not block all traffic to 168.63.129.16. For example UDP traffic is still needed
# for DNS.
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 80 -j DROP
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 32526 -j DROP
EOF

# check if kubelet flags contain image-credential-provider-config and image-credential-provider-bin-dir
Expand Down
3 changes: 3 additions & 0 deletions parts/linux/cloud-init/nodecustomdata.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -392,12 +392,15 @@ write_files:
# for TCP protocol (which http uses)
#
# 168.63.129.16 contains protected settings that have priviledged info.
# HostGAPlugin (Host-GuestAgent-Plugin) is a web server process that runs on the physical host that serves the operational and diagnostic needs of the in-VM Guest Agent.
# IT listens on both port 80 and 32526 hence access is only needed for agent but not the containers.
#
# The host can still reach 168.63.129.16 because it goes through the OUTPUT chain, not FORWARD.
#
# Note: we should not block all traffic to 168.63.129.16. For example UDP traffic is still needed
# for DNS.
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 80 -j DROP
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 32526 -j DROP
- path: /etc/kubernetes/certs/ca.crt
permissions: "0600"
Expand Down
3 changes: 2 additions & 1 deletion pkg/agent/testdata/AKSUbuntu1604+Containerd/CustomData
View file

Large diffs are not rendered by default.

0 ...Ubuntu1604+TempDisk+Containerd/line315.sh → ...tdata/AKSUbuntu1604+Containerd/line315.sh
View file
File renamed without changes.
1 change: 1 addition & 0 deletions pkg/agent/testdata/AKSUbuntu1604+Containerd/line70.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -508,6 +508,7 @@ EOF
#
#
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 80 -j DROP
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 32526 -j DROP
EOF

if [[ $KUBELET_FLAGS == *"image-credential-provider-config"* && $KUBELET_FLAGS == *"image-credential-provider-bin-dir"* ]]; then
Expand Down
3 changes: 2 additions & 1 deletion pkg/agent/testdata/AKSUbuntu1604+CustomKubeletConfig+CustomLinuxOSConfig/CustomData
View file

Large diffs are not rendered by default.

0 ...AKSUbuntu1604+TempDiskExplicit/line315.sh → ...eletConfig+CustomLinuxOSConfig/line315.sh
View file
File renamed without changes.
1 change: 1 addition & 0 deletions pkg/agent/testdata/AKSUbuntu1604+CustomKubeletConfig+CustomLinuxOSConfig/line70.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -508,6 +508,7 @@ EOF
#
#
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 80 -j DROP
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 32526 -j DROP
EOF

if [[ $KUBELET_FLAGS == *"image-credential-provider-config"* && $KUBELET_FLAGS == *"image-credential-provider-bin-dir"* ]]; then
Expand Down
3 changes: 2 additions & 1 deletion pkg/agent/testdata/AKSUbuntu1604+CustomKubeletConfig+DynamicKubeletConfig/CustomData
View file

Large diffs are not rendered by default.

0 ...a/AKSUbuntu1604+TempDiskToggle/line315.sh → ...letConfig+DynamicKubeletConfig/line315.sh
View file
File renamed without changes.
1 change: 1 addition & 0 deletions pkg/agent/testdata/AKSUbuntu1604+CustomKubeletConfig+DynamicKubeletConfig/line70.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -508,6 +508,7 @@ EOF
#
#
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 80 -j DROP
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 32526 -j DROP
EOF

if [[ $KUBELET_FLAGS == *"image-credential-provider-config"* && $KUBELET_FLAGS == *"image-credential-provider-bin-dir"* ]]; then
Expand Down
3 changes: 2 additions & 1 deletion pkg/agent/testdata/AKSUbuntu1604+Disable1804SystemdResolved=false/CustomData
View file

Large diffs are not rendered by default.

0 ...tdata/AKSUbuntu1604+Containerd/line314.sh → ...sable1804SystemdResolved=false/line315.sh
View file
File renamed without changes.
1 change: 1 addition & 0 deletions pkg/agent/testdata/AKSUbuntu1604+Disable1804SystemdResolved=false/line70.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -508,6 +508,7 @@ EOF
#
#
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 80 -j DROP
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 32526 -j DROP
EOF

if [[ $KUBELET_FLAGS == *"image-credential-provider-config"* && $KUBELET_FLAGS == *"image-credential-provider-bin-dir"* ]]; then
Expand Down
3 changes: 2 additions & 1 deletion pkg/agent/testdata/AKSUbuntu1604+Disable1804SystemdResolved=true/CustomData
View file

Large diffs are not rendered by default.

0 ...eletConfig+CustomLinuxOSConfig/line314.sh → ...isable1804SystemdResolved=true/line315.sh
View file
File renamed without changes.
1 change: 1 addition & 0 deletions pkg/agent/testdata/AKSUbuntu1604+Disable1804SystemdResolved=true/line70.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -508,6 +508,7 @@ EOF
#
#
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 80 -j DROP
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 32526 -j DROP
EOF

if [[ $KUBELET_FLAGS == *"image-credential-provider-config"* && $KUBELET_FLAGS == *"image-credential-provider-bin-dir"* ]]; then
Expand Down
3 changes: 2 additions & 1 deletion pkg/agent/testdata/AKSUbuntu1604+Docker/CustomData
View file

Large diffs are not rendered by default.

0 ...letConfig+DynamicKubeletConfig/line314.sh → .../testdata/AKSUbuntu1604+Docker/line315.sh
View file
File renamed without changes.
1 change: 1 addition & 0 deletions pkg/agent/testdata/AKSUbuntu1604+Docker/line70.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -508,6 +508,7 @@ EOF
#
#
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 80 -j DROP
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 32526 -j DROP
EOF

if [[ $KUBELET_FLAGS == *"image-credential-provider-config"* && $KUBELET_FLAGS == *"image-credential-provider-bin-dir"* ]]; then
Expand Down
3 changes: 2 additions & 1 deletion pkg/agent/testdata/AKSUbuntu1604+DynamicKubeletConfig/CustomData
View file

Large diffs are not rendered by default.

0 ...sable1804SystemdResolved=false/line314.sh → ...buntu1604+DynamicKubeletConfig/line315.sh
View file
File renamed without changes.
1 change: 1 addition & 0 deletions pkg/agent/testdata/AKSUbuntu1604+DynamicKubeletConfig/line70.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -508,6 +508,7 @@ EOF
#
#
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 80 -j DROP
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 32526 -j DROP
EOF

if [[ $KUBELET_FLAGS == *"image-credential-provider-config"* && $KUBELET_FLAGS == *"image-credential-provider-bin-dir"* ]]; then
Expand Down
3 changes: 2 additions & 1 deletion pkg/agent/testdata/AKSUbuntu1604+EnablePrivateClusterHostsConfigAgent/CustomData
View file

Large diffs are not rendered by default.

0 ...isable1804SystemdResolved=true/line314.sh → ...PrivateClusterHostsConfigAgent/line314.sh
View file
File renamed without changes.
1 change: 1 addition & 0 deletions pkg/agent/testdata/AKSUbuntu1604+EnablePrivateClusterHostsConfigAgent/line70.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -508,6 +508,7 @@ EOF
#
#
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 80 -j DROP
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 32526 -j DROP
EOF

if [[ $KUBELET_FLAGS == *"image-credential-provider-config"* && $KUBELET_FLAGS == *"image-credential-provider-bin-dir"* ]]; then
Expand Down
3 changes: 2 additions & 1 deletion pkg/agent/testdata/AKSUbuntu1604+GPUDedicatedVHD/CustomData
View file

Large diffs are not rendered by default.

0 .../testdata/AKSUbuntu1604+Docker/line314.sh → .../AKSUbuntu1604+GPUDedicatedVHD/line322.sh
View file
File renamed without changes.
1 change: 1 addition & 0 deletions pkg/agent/testdata/AKSUbuntu1604+GPUDedicatedVHD/line70.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -508,6 +508,7 @@ EOF
#
#
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 80 -j DROP
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 32526 -j DROP
EOF

if [[ $KUBELET_FLAGS == *"image-credential-provider-config"* && $KUBELET_FLAGS == *"image-credential-provider-bin-dir"* ]]; then
Expand Down
3 changes: 2 additions & 1 deletion pkg/agent/testdata/AKSUbuntu1604+K8S115/CustomData
View file

Large diffs are not rendered by default.

0 ...buntu1604+DynamicKubeletConfig/line314.sh → .../testdata/AKSUbuntu1604+K8S115/line315.sh
View file
File renamed without changes.
1 change: 1 addition & 0 deletions pkg/agent/testdata/AKSUbuntu1604+K8S115/line70.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -508,6 +508,7 @@ EOF
#
#
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 80 -j DROP
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 32526 -j DROP
EOF

if [[ $KUBELET_FLAGS == *"image-credential-provider-config"* && $KUBELET_FLAGS == *"image-credential-provider-bin-dir"* ]]; then
Expand Down
3 changes: 2 additions & 1 deletion pkg/agent/testdata/AKSUbuntu1604+K8S117/CustomData
View file

Large diffs are not rendered by default.

0 .../testdata/AKSUbuntu1604+K8S115/line314.sh → .../testdata/AKSUbuntu1604+K8S117/line314.sh
View file
File renamed without changes.
1 change: 1 addition & 0 deletions pkg/agent/testdata/AKSUbuntu1604+K8S117/line70.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -508,6 +508,7 @@ EOF
#
#
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 80 -j DROP
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 32526 -j DROP
EOF

if [[ $KUBELET_FLAGS == *"image-credential-provider-config"* && $KUBELET_FLAGS == *"image-credential-provider-bin-dir"* ]]; then
Expand Down
3 changes: 2 additions & 1 deletion pkg/agent/testdata/AKSUbuntu1604+K8S118/CustomData
View file

Large diffs are not rendered by default.

0 ...KSUbuntu1604+KubeletConfigFile/line314.sh → .../testdata/AKSUbuntu1604+K8S118/line314.sh
View file
File renamed without changes.
1 change: 1 addition & 0 deletions pkg/agent/testdata/AKSUbuntu1604+K8S118/line70.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -508,6 +508,7 @@ EOF
#
#
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 80 -j DROP
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 32526 -j DROP
EOF

if [[ $KUBELET_FLAGS == *"image-credential-provider-config"* && $KUBELET_FLAGS == *"image-credential-provider-bin-dir"* ]]; then
Expand Down
3 changes: 2 additions & 1 deletion pkg/agent/testdata/AKSUbuntu1604+KubeletConfigFile/CustomData
View file

Large diffs are not rendered by default.

0 ...PrivateClusterHostsConfigAgent/line313.sh → ...KSUbuntu1604+KubeletConfigFile/line315.sh
View file
File renamed without changes.
1 change: 1 addition & 0 deletions pkg/agent/testdata/AKSUbuntu1604+KubeletConfigFile/line70.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -508,6 +508,7 @@ EOF
#
#
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 80 -j DROP
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 32526 -j DROP
EOF

if [[ $KUBELET_FLAGS == *"image-credential-provider-config"* && $KUBELET_FLAGS == *"image-credential-provider-bin-dir"* ]]; then
Expand Down
3 changes: 2 additions & 1 deletion pkg/agent/testdata/AKSUbuntu1604+OSKubeletDisk/CustomData
View file

Large diffs are not rendered by default.

0 .../AKSUbuntu1604+GPUDedicatedVHD/line321.sh → ...ta/AKSUbuntu1604+OSKubeletDisk/line315.sh
View file
File renamed without changes.
1 change: 1 addition & 0 deletions pkg/agent/testdata/AKSUbuntu1604+OSKubeletDisk/line70.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -508,6 +508,7 @@ EOF
#
#
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 80 -j DROP
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 32526 -j DROP
EOF

if [[ $KUBELET_FLAGS == *"image-credential-provider-config"* && $KUBELET_FLAGS == *"image-credential-provider-bin-dir"* ]]; then
Expand Down
3 changes: 2 additions & 1 deletion pkg/agent/testdata/AKSUbuntu1604+TempDisk+Containerd/CustomData
View file

Large diffs are not rendered by default.

0 .../testdata/AKSUbuntu1604+K8S117/line313.sh → ...Ubuntu1604+TempDisk+Containerd/line316.sh
View file
File renamed without changes.
1 change: 1 addition & 0 deletions pkg/agent/testdata/AKSUbuntu1604+TempDisk+Containerd/line70.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -508,6 +508,7 @@ EOF
#
#
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 80 -j DROP
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 32526 -j DROP
EOF

if [[ $KUBELET_FLAGS == *"image-credential-provider-config"* && $KUBELET_FLAGS == *"image-credential-provider-bin-dir"* ]]; then
Expand Down
3 changes: 2 additions & 1 deletion pkg/agent/testdata/AKSUbuntu1604+TempDiskExplicit/CustomData
View file

Large diffs are not rendered by default.

0 .../testdata/AKSUbuntu1604+K8S118/line313.sh → ...AKSUbuntu1604+TempDiskExplicit/line316.sh
View file
File renamed without changes.
1 change: 1 addition & 0 deletions pkg/agent/testdata/AKSUbuntu1604+TempDiskExplicit/line70.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -508,6 +508,7 @@ EOF
#
#
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 80 -j DROP
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 32526 -j DROP
EOF

if [[ $KUBELET_FLAGS == *"image-credential-provider-config"* && $KUBELET_FLAGS == *"image-credential-provider-bin-dir"* ]]; then
Expand Down
3 changes: 2 additions & 1 deletion pkg/agent/testdata/AKSUbuntu1604+TempDiskToggle/CustomData
View file

Large diffs are not rendered by default.

0 ...ta/AKSUbuntu1604+OSKubeletDisk/line314.sh → ...a/AKSUbuntu1604+TempDiskToggle/line316.sh
View file
File renamed without changes.
1 change: 1 addition & 0 deletions pkg/agent/testdata/AKSUbuntu1604+TempDiskToggle/line70.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -508,6 +508,7 @@ EOF
#
#
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 80 -j DROP
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 32526 -j DROP
EOF

if [[ $KUBELET_FLAGS == *"image-credential-provider-config"* && $KUBELET_FLAGS == *"image-credential-provider-bin-dir"* ]]; then
Expand Down
3 changes: 2 additions & 1 deletion pkg/agent/testdata/AKSUbuntu1804+ArtifactStreaming/CustomData
View file

Large diffs are not rendered by default.

0 ...d+NoCustomKubeImageandBinaries/line314.sh → ...KSUbuntu1804+ArtifactStreaming/line314.sh
View file
File renamed without changes.
1 change: 1 addition & 0 deletions pkg/agent/testdata/AKSUbuntu1804+ArtifactStreaming/line70.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -508,6 +508,7 @@ EOF
#
#
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 80 -j DROP
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 32526 -j DROP
EOF

if [[ $KUBELET_FLAGS == *"image-credential-provider-config"* && $KUBELET_FLAGS == *"image-credential-provider-bin-dir"* ]]; then
Expand Down
3 changes: 2 additions & 1 deletion pkg/agent/testdata/AKSUbuntu1804+Containerd++GPU+runcshimv2/CustomData
View file

Large diffs are not rendered by default.

0 ...untu1804+Containerd+NSeriesSku/line321.sh → ...804+Containerd++GPU+runcshimv2/line321.sh
View file
File renamed without changes.
1 change: 1 addition & 0 deletions pkg/agent/testdata/AKSUbuntu1804+Containerd++GPU+runcshimv2/line70.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -508,6 +508,7 @@ EOF
#
#
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 80 -j DROP
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 32526 -j DROP
EOF

if [[ $KUBELET_FLAGS == *"image-credential-provider-config"* && $KUBELET_FLAGS == *"image-credential-provider-bin-dir"* ]]; then
Expand Down
3 changes: 2 additions & 1 deletion pkg/agent/testdata/AKSUbuntu1804+Containerd+Certsd/CustomData
View file

Large diffs are not rendered by default.

0 ...tomCloud+ootcredentialprovider/line314.sh → ...KSUbuntu1804+Containerd+Certsd/line314.sh
View file
File renamed without changes.
1 change: 1 addition & 0 deletions pkg/agent/testdata/AKSUbuntu1804+Containerd+Certsd/line70.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -508,6 +508,7 @@ EOF
#
#
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 80 -j DROP
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 32526 -j DROP
EOF

if [[ $KUBELET_FLAGS == *"image-credential-provider-config"* && $KUBELET_FLAGS == *"image-credential-provider-bin-dir"* ]]; then
Expand Down
3 changes: 2 additions & 1 deletion pkg/agent/testdata/AKSUbuntu1804+Containerd+ContainerdVersion/CustomData
View file

Large diffs are not rendered by default.

0 ...data/AKSUbuntu2204+CustomCloud/line314.sh → ...4+Containerd+ContainerdVersion/line314.sh
View file
File renamed without changes.
1 change: 1 addition & 0 deletions pkg/agent/testdata/AKSUbuntu1804+Containerd+ContainerdVersion/line70.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -508,6 +508,7 @@ EOF
#
#
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 80 -j DROP
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 32526 -j DROP
EOF

if [[ $KUBELET_FLAGS == *"image-credential-provider-config"* && $KUBELET_FLAGS == *"image-credential-provider-bin-dir"* ]]; then
Expand Down
3 changes: 2 additions & 1 deletion pkg/agent/testdata/AKSUbuntu1804+Containerd+IPAddress+FQDN/CustomData
View file

Large diffs are not rendered by default.

0 pkg/agent/testdata/RawUbuntu/line314.sh → ...1804+Containerd+IPAddress+FQDN/line314.sh
View file
File renamed without changes.
1 change: 1 addition & 0 deletions pkg/agent/testdata/AKSUbuntu1804+Containerd+IPAddress+FQDN/line70.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -508,6 +508,7 @@ EOF
#
#
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 80 -j DROP
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 32526 -j DROP
EOF

if [[ $KUBELET_FLAGS == *"image-credential-provider-config"* && $KUBELET_FLAGS == *"image-credential-provider-bin-dir"* ]]; then
Expand Down
3 changes: 2 additions & 1 deletion pkg/agent/testdata/AKSUbuntu1804+Containerd+IPMasqAgent/CustomData
View file

Large diffs are not rendered by default.

0 ...KSUbuntu1804+ArtifactStreaming/line313.sh → ...ntu1804+Containerd+IPMasqAgent/line314.sh
View file
File renamed without changes.
1 change: 1 addition & 0 deletions pkg/agent/testdata/AKSUbuntu1804+Containerd+IPMasqAgent/line70.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -508,6 +508,7 @@ EOF
#
#
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 80 -j DROP
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 32526 -j DROP
EOF

if [[ $KUBELET_FLAGS == *"image-credential-provider-config"* && $KUBELET_FLAGS == *"image-credential-provider-bin-dir"* ]]; then
Expand Down
3 changes: 2 additions & 1 deletion pkg/agent/testdata/AKSUbuntu1804+Containerd+Kubenet+Calico/CustomData
View file

Large diffs are not rendered by default.

0 ...804+Containerd++GPU+runcshimv2/line320.sh → ...1804+Containerd+Kubenet+Calico/line314.sh
View file
File renamed without changes.
1 change: 1 addition & 0 deletions pkg/agent/testdata/AKSUbuntu1804+Containerd+Kubenet+Calico/line70.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -508,6 +508,7 @@ EOF
#
#
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 80 -j DROP
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 32526 -j DROP
EOF

if [[ $KUBELET_FLAGS == *"image-credential-provider-config"* && $KUBELET_FLAGS == *"image-credential-provider-bin-dir"* ]]; then
Expand Down
3 changes: 2 additions & 1 deletion pkg/agent/testdata/AKSUbuntu1804+Containerd+Kubenet+FIPSEnabled/CustomData
View file

Large diffs are not rendered by default.

0 ...KSUbuntu1804+Containerd+Certsd/line313.sh → ...Containerd+Kubenet+FIPSEnabled/line314.sh
View file
File renamed without changes.
1 change: 1 addition & 0 deletions pkg/agent/testdata/AKSUbuntu1804+Containerd+Kubenet+FIPSEnabled/line70.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -508,6 +508,7 @@ EOF
#
#
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 80 -j DROP
iptables -I FORWARD -d 168.63.129.16 -p tcp --dport 32526 -j DROP
EOF

if [[ $KUBELET_FLAGS == *"image-credential-provider-config"* && $KUBELET_FLAGS == *"image-credential-provider-bin-dir"* ]]; then
Expand Down
Loading

0 comments on commit e2598a3

Please sign in to comment.