kube-router iptables 版本兼容性隐患及其升级方法

#!/usr/bin/env bash
#
# kube-router iptables 兼容性预检脚本（只读，不执行任何修改操作）
# 用法: ./precheck-kube-router.sh [--threshold N] [--help]
#
# 检测内容:
#   1. networkpolicy 组件当前镜像版本
#   2. 各节点 iptables 后端（legacy / nf_tables）
#   3. nft 后端节点的 INPUT 链 169.254.20.10 重复规则数
#   4. 识别极度膨胀节点（iptables-save 报 incompatible）
#
set -euo pipefail

RED='\\033[0;31m'
GREEN='\\033[0;32m'
YELLOW='\\033[1;33m'
NC='\\033[0m'

log_info()  { echo -e "${GREEN}[INFO]${NC}  $*"; }
log_warn()  { echo -e "${YELLOW}[WARN]${NC}  $*"; }
log_error() { echo -e "${RED}[ERROR]${NC}  $*"; }

THRESHOLD=1000
NAMESPACE="kube-system"

usage() {
  cat <<EOF
用法: $0 [选项]

选项:
  --threshold N    重复规则判定阈值，默认 1000
  --help           显示帮助

前置条件:
  - kubectl 已安装，KUBECONFIG 已正确配置
  - 对目标集群有足够权限
EOF
  exit 0
}

while [[ $# -gt 0 ]]; do
  case "$1" in
  --threshold) THRESHOLD="$2"; shift ;;
  --help) usage ;;
  *) echo "未知选项: $1"; usage ;;
  esac
  shift
done

# 前置检查
command -v kubectl >/dev/null 2>&1 || { log_error "未安装 kubectl"; exit 1; }
kubectl cluster-info --request-timeout=5s >/dev/null 2>&1 || { log_error "无法连接集群，请检查 KUBECONFIG"; exit 1; }
kubectl get ds networkpolicy -n "$NAMESPACE" >/dev/null 2>&1 || { log_error "未找到 DaemonSet $NAMESPACE/networkpolicy，请确认 networkpolicy 组件已安装"; exit 1; }

echo "=== kube-router iptables 兼容性预检 ==="
echo "集群: $(kubectl config current-context)"
echo ""

# 当前镜像版本
current_image=$(kubectl get ds networkpolicy -n "$NAMESPACE" -o jsonpath='{.spec.template.spec.containers[0].image}')
echo "当前 networkpolicy 镜像: $current_image"
echo ""

# 遍历节点检测
echo "正在扫描各节点..."
echo "重复规则判定阈值: > ${THRESHOLD} 条"
echo ""

nodes=$(kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\\n"}{end}')

total=0; legacy=0; nft_ok=0; inflated=0; extreme=0; skipped=0

while IFS= read -r node_name; do
  [[ -z "$node_name" ]] && continue
  total=$((total + 1))

  # 找该节点的 kube-proxy Pod
  kp_pod=$(kubectl get pod -n "$NAMESPACE" -l k8s-app=kube-proxy \\
    --field-selector spec.nodeName="${node_name}" \\
    -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)

  if [[ -z "$kp_pod" ]]; then
    skipped=$((skipped + 1))
    echo "  [$total] $node_name: 未找到 kube-proxy Pod，跳过"
    continue
  fi

  # 检测 iptables 后端
  backend=$(kubectl exec -n "$NAMESPACE" "$kp_pod" -- sh -c 'iptables --version 2>/dev/null' 2>/dev/null | grep -o 'nf_tables\\|legacy' || echo "unknown")

  if [[ "$backend" == "legacy" ]]; then
    legacy=$((legacy + 1))
    echo "  [$total] $node_name: legacy 后端 → 无风险"
    continue
  fi

  if [[ "$backend" != "nf_tables" ]]; then
    skipped=$((skipped + 1))
    echo "  [$total] $node_name: 后端未知 ($backend)，跳过"
    continue
  fi

  # nft 后端：检测 INPUT 链重复规则
  save_output=$(kubectl exec -n "$NAMESPACE" "$kp_pod" -- timeout 15 sh -c 'iptables -t filter -S INPUT 2>/dev/null' 2>/dev/null || true)

  if echo "$save_output" | grep -q "incompatible"; then
    extreme=$((extreme + 1))
    echo "  [$total] $node_name: ⚠ filter 表不兼容（极度膨胀，建议重启节点）"
    continue
  fi

  count=$(echo "$save_output" | grep -c "169.254.20.10" || true)

  if [[ "$count" -gt "$THRESHOLD" ]]; then
    inflated=$((inflated + 1))
    echo "  [$total] $node_name: nft，${count} 条重复规则 → ⚠ 膨胀"
  else
    nft_ok=$((nft_ok + 1))
    echo "  [$total] $node_name: nft，${count} 条 → 正常"
  fi
done <<< "$nodes"

echo ""
echo "=== 预检结果汇总 ==="
echo "  扫描节点总数:  $total"
echo "  legacy 后端:   $legacy (无风险)"
echo "  nft 正常:      $nft_ok"
echo "  nft 膨胀:      $inflated (需清理)"
echo "  极度膨胀:      $extreme (建议重启节点)"
echo "  跳过:          $skipped"
echo ""
if [[ "$inflated" -gt 0 || "$extreme" -gt 0 ]]; then
  log_warn "发现 $((inflated + extreme)) 个需处理的节点，请参照下方升级方法和清理指引操作。"
else
  log_info "未发现膨胀节点。"
fi

chmod +x precheck-kube-router.sh
./precheck-kube-router.sh

./precheck-kube-router.sh --threshold 500

kubectl edit ds networkpolicy -n kube-system

spec:
  template:
    spec:
      containers:
      - name: networkpolicy
        image: ccr.ccs.tencentyun.com/tkeimages/kube-router:v1.3.7  # 替换为最新版本

kubectl rollout status ds networkpolicy -n kube-system --timeout=600s

kubectl get pods -n kube-system -l k8s-app=networkpolicy -o wide