mirror of
https://github.com/edgelesssys/constellation.git
synced 2024-12-16 11:24:35 -05:00
20 lines
822 B
Bash
20 lines
822 B
Bash
|
set -o errexit
|
||
|
|
set -o pipefail
|
||
|
|
set -o nounset
|
||
|
|
|
||
|
|
# When running in AWS ENI mode, it's likely that 'aws-node' has
|
||
|
|
# had a chance to install SNAT iptables rules. These can result
|
||
|
|
# in dropped traffic, so we should attempt to remove them.
|
||
|
|
# We do it using a 'postStart' hook since this may need to run
|
||
|
|
# for nodes which might have already been init'ed but may still
|
||
|
|
# have dangling rules. This is safe because there are no
|
||
|
|
# dependencies on anything that is part of the startup script
|
||
|
|
# itself, and can be safely run multiple times per node (e.g. in
|
||
|
|
# case of a restart).
|
||
|
|
if [[ "$(iptables-save | grep -c 'AWS-SNAT-CHAIN|AWS-CONNMARK-CHAIN')" != "0" ]];
|
||
|
|
then
|
||
|
|
echo 'Deleting iptables rules created by the AWS CNI VPC plugin'
|
||
|
|
iptables-save | grep -v 'AWS-SNAT-CHAIN|AWS-CONNMARK-CHAIN' | iptables-restore
|
||
|
|
fi
|
||
|
|
echo 'Done!'
|