Merge pull request kosmos-io#288 from OrangeBao/fix_iptables

fix: cannot create iptable chain in some environment
OrangeBao · Nov 24, 2023 · e923865 · e923865
2 parents 99bf98a + f9c51a3
commit e923865
Show file tree

Hide file tree

Showing 2 changed files with 28 additions and 1 deletion.
diff --git a/deploy/clusterlink-agent.yaml b/deploy/clusterlink-agent.yaml
@@ -46,6 +46,12 @@ spec:
           - mountPath: /etc/clusterlink/kubeconfig
             name: proxy-config
             readOnly: true
+          - mountPath: /run/xtables.lock
+            name: iptableslock
+            readOnly: false
+          - mountPath: /lib/modules
+            name: lib-modules
+            readOnly: true
       terminationGracePeriodSeconds: 30
       securityContext:
         privileged: true
@@ -55,3 +61,12 @@ spec:
         configMap:
           defaultMode: 420
           name: proxy-config
+      - hostPath:
+          path: /run/xtables.lock
+          type: FileOrCreate
+        name: iptableslock
+      - name: lib-modules
+        hostPath:
+          path: /lib/modules
+
+
diff --git a/pkg/operator/clusterlink/agent/manifests.go b/pkg/operator/clusterlink/agent/manifests.go
@@ -56,13 +56,25 @@ spec:
         - mountPath: /etc/clusterlink
           name: proxy-config
           readOnly: true
+        - mountPath: /run/xtables.lock
+          name: iptableslock
+          readOnly: false
+        - mountPath: /lib/modules
+          name: lib-modules
+          readOnly: true
       terminationGracePeriodSeconds: 30
       hostNetwork: true
       volumes:
       - name: proxy-config
         secret:
           secretName: {{ .ProxyConfigMapName }}
-
+      - hostPath:
+          path: /run/xtables.lock
+          type: FileOrCreate
+        name: iptableslock
+      - name: lib-modules
+        hostPath:
+          path: /lib/modules
 `
 
 // DaemonSetReplace is a struct to help to concrete