"ipset v7.1: Kernel and userspace incompatible: settype hash:net with revision 7 not supported by userspace

[mikekuzak]

Description

When trying to federate to K8S clusters running Canal via submariner.io the Canal plugin is crash-looping after the federation setup

Impact

K8s network plugin crashing. I'm not sure who should be looking as this is an interaction between Cancal/Calicio/Flatcar/Submariner.io/Rancher/K8s

Environment and steps to reproduce

submariner-io/submariner#1922

[pothos]

To understand, the container has its own ipset binary, right? That should be good then and it sounds like the kernel interface in this area is API is not really backwards compatible (probably not a regression but by design?). Sounds like the solution is to use newer versions of the Calico/whatever containers - can you try that?

[dghubble]

Calico fixed this projectcalico/calico#5011

[tormath1]

Hi @mikekuzak,

Thanks for raising this issue. I quickly checked: rancher-1.20.12 ships calico-v3.17.2 which is not yet fixed for the issue linked by @dghubble.

You can try to upgrade your Rancher version to one that ships >=calico-3.22.1 or you can try to bump directly your calico version to >=3.22.1.

It was called out in the Flatcar release notes as a known issue: https://www.flatcar.org/releases#release-3115.0.0 but we did not propagate this section to Stable release note since in the meantime Calico fixed the issue.

Let us know how it goes!

[tormath1]

Hello, as mentioned it has been fixed upstream and updating to newer version of rancher should fix the issue. I'll go ahead and close that one.