Cleanup iptables rules for other CNI networks
- Dominant language
- Go
- Stars
- 17k
- Forks
- 2.1k
- Avg merge
- 1d 9h
- Merged PRs (30d)
- 105
Description
### Proposal
https://github.com/hashicorp/nomad/pull/15407 introduced a mechanism to monitor and clean-up iptables rules created by Nomad. The code uses a [regular expression](https://github.com/hashicorp/nomad/blob/v1.5.0/client/allocrunner/networking_cni.go#L252-L254) to find rules managed by Nomad, but it hardcodes `"name: \\"nomad\\"` where `nomad` is the default name that Nomad uses for its built-in bridge. Users that have custom CNI bridges will have different names that would not match this expression and therefore may leak.
### Use-cases
Run a custom bridge using CNI plugins.
### Attempted Solutions
N/A
> **Note**
> Issue extracted from https://github.com/hashicorp/nomad/issues/13824. Refer to that issue for more context.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start in client/allocrunner/networking_cni.go around lines 252-254 and inspect how the regular expression identifies Nomad-managed iptables rules. Trace how custom CNI bridge names are represented, then verify that cleanup also matches rules for those bridges without losing the existing built-in bridge behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- networking
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100