portmap: make DNAT entries last-write-wins - #1267
Open
hemeimei wants to merge 1 commit into
Open
Conversation
hemeimei
force-pushed
the
portmap-last-write-wins
branch
from
June 24, 2026 13:42
19e8631 to
14b8a58
Compare
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: hemeimei <hemeimei@baidu.com>
hemeimei
force-pushed
the
portmap-last-write-wins
branch
from
July 13, 2026 06:00
14b8a58 to
e1a6104
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The iptables portmap backend currently appends each per-container DNAT
entry to CNI-HOSTPORT-DNAT. If a container is recreated with the same
HostPort before the old mapping is fully removed, the older entry can
continue to match first.
Make genDnatChain set prependEntry=true so newly-created per-container
DNAT entries are inserted before older entries in CNI-HOSTPORT-DNAT,
giving hostport mappings last-write-wins semantics.
This does not revert the service-ordering fix from #269. That fix was
about not prepending CNI-HOSTPORT-DNAT into nat/PREROUTING or nat/OUTPUT,
where it could take precedence over kube-proxy's KUBE-SERVICES rules.
This change only affects ordering inside CNI-HOSTPORT-DNAT. The top-level
CNI-HOSTPORT-DNAT jump remains appended to PREROUTING/OUTPUT, while
kube-proxy ensures KUBE-SERVICES is installed in those top-level NAT
chains. Therefore Kubernetes Service and NodePort rules continue to run
before CNI hostport dispatch.
Validation: