Extract iptables binary staging to iptablesutils

CPLB potentially will need to create some iptables rules for its
userspace proxy, hence this code should be in iptablesutils rather than
pkg/worker/kubelet.

Signed-off-by: Juan-Luis de Sousa-Valadas Castaño <[email protected]>

internal/pkg/iptablesutils/iptables.go

@@ -20,10 +20,14 @@ import (
 	"bufio"
 	"errors"
 	"fmt"
+	"os"
 	"os/exec"
 	"path/filepath"
+	"runtime"
 	"strings"
 
+	"github.com/k0sproject/k0s/pkg/assets"
+	"github.com/k0sproject/k0s/pkg/constant"
 	"github.com/sirupsen/logrus"
 )
 
@@ -32,6 +36,60 @@ const (
 	ModeLegacy = "legacy"
 )
 
+// ExtractIPTablesBinaries extracts the iptables binaries from the k0s binary and makes the symlinks
+// to the backend detected by DetectHostIPTablesMode.
+// ExtractIPTablesBinaries only works on linux, if called in another OS it will return an error.
+func ExtractIPTablesBinaries(k0sBinDir string, iptablesMode string) (error, string) {
+	if runtime.GOOS != "linux" {
+		return fmt.Errorf("iptables extraction is only supported on linux"), ""
+	}
+
+	cmds := []string{"kubelet", "xtables-legacy-multi", "xtables-nft-multi"}
+	for _, cmd := range cmds {
+		err := assets.Stage(k0sBinDir, cmd, constant.BinDirMode)
+		if err != nil {
+			return err, ""
+		}
+	}
+	if iptablesMode == "" || iptablesMode == "auto" {
+		var err error
+		iptablesMode, err = DetectHostIPTablesMode(k0sBinDir)
+		if err != nil {
+			if kernelMajorVersion() < 5 {
+				iptablesMode = ModeLegacy
+			} else {
+				iptablesMode = ModeNFT
+			}
+			logrus.WithError(err).Infof("Failed to detect iptables mode, using iptables-%s by default", iptablesMode)
+		}
+	}
+	logrus.Infof("using iptables-%s", iptablesMode)
+	oldpath := fmt.Sprintf("xtables-%s-multi", iptablesMode)
+	for _, symlink := range []string{"iptables", "iptables-save", "iptables-restore", "ip6tables", "ip6tables-save", "ip6tables-restore"} {
+		symlinkPath := filepath.Join(k0sBinDir, symlink)
+
+		// remove if it exist and ignore error if it doesn't
+		_ = os.Remove(symlinkPath)
+
+		err := os.Symlink(oldpath, symlinkPath)
+		if err != nil {
+			return fmt.Errorf("failed to create symlink %s: %w", symlink, err), ""
+		}
+	}
+
+	return nil, iptablesMode
+}
+func kernelMajorVersion() byte {
+	if runtime.GOOS != "linux" {
+		return 0
+	}
+	data, err := os.ReadFile("/proc/sys/kernel/osrelease")
+	if err != nil {
+		return 0
+	}
+	return data[0] - '0'
+}
+
 // DetectHostIPTablesMode figure out whether iptables-legacy or iptables-nft is in use on the host.
 // Follows the same logic as kube-proxy/kube-route.
 // See: https://github.com/kubernetes-sigs/iptables-wrappers/blob/master/iptables-wrapper-installer.sh

pkg/component/worker/kernelsetup.go

@@ -19,5 +19,4 @@ limitations under the License.
 package worker
 
 // KernelSetup comment
-func KernelSetup()             {}
-func KernelMajorVersion() byte { return 0 }
+func KernelSetup() {}

pkg/component/worker/kernelsetup_linux.go

@@ -80,12 +80,3 @@ func KernelSetup() {
 	enableSysCtl("net/bridge/bridge-nf-call-iptables")
 	enableSysCtl("net/bridge/bridge-nf-call-ip6tables")
 }
-
-// KernelMajorVersion returns the major version number of the running kernel
-func KernelMajorVersion() byte {
-	data, err := os.ReadFile("/proc/sys/kernel/osrelease")
-	if err != nil {
-		return 0
-	}
-	return data[0] - '0'
-}

pkg/component/worker/kubelet.go

@@ -81,46 +81,18 @@ type kubeletConfig struct {
 
 // Init extracts the needed binaries
 func (k *Kubelet) Init(_ context.Context) error {
-	cmds := []string{"kubelet", "xtables-legacy-multi", "xtables-nft-multi"}
 
 	if runtime.GOOS == "windows" {
-		cmds = []string{"kubelet.exe"}
+		err := assets.Stage(k.K0sVars.BinDir, "kubelet.exe", constant.BinDirMode)
+		return err
 	}
 
-	for _, cmd := range cmds {
-		err := assets.Stage(k.K0sVars.BinDir, cmd, constant.BinDirMode)
+	if runtime.GOOS == "linux" {
+		err, iptablesMode := iptablesutils.ExtractIPTablesBinaries(k.K0sVars.BinDir, k.IPTablesMode)
 		if err != nil {
 			return err
 		}
-	}
-
-	if runtime.GOOS == "linux" {
-		iptablesMode := k.IPTablesMode
-		if iptablesMode == "" || iptablesMode == "auto" {
-			var err error
-			iptablesMode, err = iptablesutils.DetectHostIPTablesMode(k.K0sVars.BinDir)
-			if err != nil {
-				if KernelMajorVersion() < 5 {
-					iptablesMode = iptablesutils.ModeLegacy
-				} else {
-					iptablesMode = iptablesutils.ModeNFT
-				}
-				logrus.WithError(err).Infof("Failed to detect iptables mode, using iptables-%s by default", iptablesMode)
-			}
-		}
-		logrus.Infof("using iptables-%s", iptablesMode)
-		oldpath := fmt.Sprintf("xtables-%s-multi", iptablesMode)
-		for _, symlink := range []string{"iptables", "iptables-save", "iptables-restore", "ip6tables", "ip6tables-save", "ip6tables-restore"} {
-			symlinkPath := filepath.Join(k.K0sVars.BinDir, symlink)
-
-			// remove if it exist and ignore error if it doesn't
-			_ = os.Remove(symlinkPath)
-
-			err := os.Symlink(oldpath, symlinkPath)
-			if err != nil {
-				return fmt.Errorf("failed to create symlink %s: %w", symlink, err)
-			}
-		}
+		k.IPTablesMode = iptablesMode
 	}
 
 	k.dataDir = filepath.Join(k.K0sVars.DataDir, "kubelet")