[
https://issues.apache.org/jira/browse/MESOS-9031?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16530135#comment-16530135
]
Kirill Plyashkevich commented on MESOS-9031:
--------------------------------------------
[~qianzhang],
{quote}So there are two service nodes (i.e., two Mesos tasks) join the bridge
network mesos-cni0 on the same Mesos agent host, and both of the two services
nodes have port mapping enabled, but they cannot communicate with the Mesos
agent host IP & mapped port between each other, right?{quote}
yes, that's correct
{quote}
So you think the timeout issue is not caused by rule #1 in the chain CNI-XXX
set by the bridge plugin? But one of your proposed solution is not to add that
rule.
{quote}
that was my initial assumption, and deeper investigation shows that my proposal
#1 is not actually a solution here.
the timeout is caused by missing snat/masquerade, which is not happening.
`cni/portmap` has proper implementation with snat/masquerade. so, if
`mesos-cni-port-mapper` does smth alike and do the snat/masquerade, issue will
be solved.
that said, IMHO, solutions #2 (with adding logic alike `cni/portmap` and #3 are
the only left.
> Mesos CNI portmap plugins' iptables rules doesn't allow connections via host
> ip and port from the same bridge container network
> -------------------------------------------------------------------------------------------------------------------------------
>
> Key: MESOS-9031
> URL: https://issues.apache.org/jira/browse/MESOS-9031
> Project: Mesos
> Issue Type: Bug
> Components: cni, containerization
> Affects Versions: 1.6.0
> Reporter: Kirill Plyashkevich
> Priority: Major
>
> using `mesos-cni-port-mapper` with folllowing config:
> {noformat}
> {
> "name" : "dcos",
> "type" : "mesos-cni-port-mapper",
> "excludeDevices" : [],
> "chain": "MESOS-CNI0-PORT-MAPPER",
> "delegate": {
> "type": "bridge",
> "bridge": "mesos-cni0",
> "isGateway": true,
> "ipMasq": true,
> "hairpinMode": true,
> "ipam": {
> "type": "host-local",
> "ranges": [
> [{"subnet": "172.26.0.0/16"}]
> ],
> "routes": [
> {"dst": "0.0.0.0/0"}
> ]
> }
> }
> }
> {noformat}
> - 2 services running on the same mesos-slave using unified containerizer in
> different tasks and communicating via host ip and host port
> - connection timeouts due to iptables rules per container CNI-XXX chain
> - actually timeouts are caused by
> {noformat}
> Chain CNI-XXX (1 references)
> num target prot opt source destination
> 1 ACCEPT all -- anywhere 172.26.0.0/16 /* name:
> "dcos" id: "YYYY" */
> 2 MASQUERADE all -- anywhere !base-address.mcast.net/4 /*
> name: "dcos" id: "YYYY" */
> {noformat}
> rule #1 is executed and no masquerading happens.
> there are multiple solutions:
> - simpliest and fastest one is not to add that ACCEPT
> - perhaps, there's a better change in iptables rules that can fix it
> - proper one (imho) is to finally implement cni spec 0.3.x in order to be
> able to use chaining of plugins and use cni's `bridge` and `portmap` plugins
> in chain (and get rid of mesos-cni-port-mapper completely eventually).
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
