A task on the ingress network needs rules in its own network namespace
that redirect each published port to its target port and filter all
other traffic addressed to its ingress endpoint. Adding them can fail,
for example when the kernel lacks a feature the rules use.
populateLoadBalancers logged that failure and let the join succeed. The
task then ran, and was reported as running, without serving its
published ports and with every port it listens on reachable from the
rest of the ingress network. The only trace was the daemon log.
Return the error instead, so the join fails and the task fails with the
reason. This applies to both firewall backends.
Signed-off-by: Cory Snider <csnider@mirantis.com>
Cory Snider
b3e12c55d2