Kops: [Feature Request]: Docker networking (ipTables, ipMasq) on Instance Group level.

[iusergii]

1. Describe IN DETAIL the feature/behavior/change you would like to see.
Release 1.18 has changed default iptables rules. According to docs - to re-enable internet access for docker run containers we need updated cluster level config :

apiVersion: kops.k8s.io/v1alpha2
kind: Cluster
metadata:
  name: foo.dev
spec:
spec:
  docker:
    ipMasq: true
    ipTables: true 

I'd like to have an option to configure this rule on a specific Instance Group only.

[hakman]

Thanks for adding this @iusergii
/assign

[yuha0]

Just want to +1 on this.

We have some containers that require direct docker socket access to work. To reduce security impact, they are scheduled on dedicated IGs and we don't want to open docker on any other IGs in the cluster.

[rifelpet]

I think this would be a good issue for Hacktoberfest #9920

[monicagangwar]

@rifelpet I'd like to pick this one, can you assign it to me ?

[rifelpet]

/assign @monicagangwar

Thanks for picking this up! Feel free to reach out if you have any questions. There is a similar set of fields for Kubelet in the ClusterSpec and InstanceGroupSpec that we could follow as a pattern.