hashicorp / hashicorp/nomad

Cleanup iptables rules for other CNI networks

Open
#16,455 1 comment 1 reaction 0 assignees View on GitHub
stage/accepted theme/cni theme/networking type/enhancement
Dominant language
Go
Stars
17k
Forks
2.1k
Avg merge
1d 9h
Merged PRs (30d)
105

Description

### Proposal

https://github.com/hashicorp/nomad/pull/15407 introduced a mechanism to monitor and clean-up iptables rules created by Nomad. The code uses a [regular expression](https://github.com/hashicorp/nomad/blob/v1.5.0/client/allocrunner/networking_cni.go#L252-L254) to find rules managed by Nomad, but it hardcodes `"name: \\"nomad\\"` where `nomad` is the default name that Nomad uses for its built-in bridge. Users that have custom CNI bridges will have different names that would not match this expression and therefore may leak.

### Use-cases

Run a custom bridge using CNI plugins.

### Attempted Solutions

N/A

> **Note**
> Issue extracted from https://github.com/hashicorp/nomad/issues/13824. Refer to that issue for more context.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in client/allocrunner/networking_cni.go around lines 252-254 and inspect how the regular expression identifies Nomad-managed iptables rules. Trace how custom CNI bridge names are represented, then verify that cleanup also matches rules for those bridges without losing the existing built-in bridge behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
networking
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.