don't set conntrack parameters in kube-proxy #2241
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
k8s-ci-robot
added
the
cncf-cla: yes
k8s-ci-robot
added
the
approved
|
/assign @BenTheElder |
k8s-ci-robot
added
the
size/S
|
/hold
|
k8s-ci-robot
added
the
do-not-merge/hold
ghost
mentioned this pull request
It seems the kernel doesn't allow to set some conntrack fields from non-init netns because they are global, so setting it in a namespaces leaks it to other namespace: netfilter: conntrack: Make global sysctls readonly in non-init netns torvalds/linux@671c54e By default kube-proxy tries to set nf_conntrack_max, that is readonly, hence failing and the kproxy pods fail to start crashlooping.
k8s-ci-robot
added
size/XS
|
/hold cancel |
k8s-ci-robot
removed
the
do-not-merge/hold
|
/assign @BenTheElder |
|
/lgtm |
k8s-ci-robot
added
the
lgtm
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: aojea, BenTheElder The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
bk201
added a commit
to bk201/harvester
that referenced
this pull request
Jun 7, 2021
Skip setting `net.netfilter.nf_conntrack_max` sysctl parameter. Setting this parameter causes Kind cluster initialization failure on newer kernels. Please see kubernetes-sigs/kind#2241 for more information. Signed-off-by: Kiefer Chang <kiefer.chang@suse.com>
bk201
added a commit
to bk201/harvester
that referenced
this pull request
Jun 7, 2021
Skip setting `net.netfilter.nf_conntrack_max` sysctl parameter. Setting this parameter causes Kind cluster initialization failure on newer kernels. Please see kubernetes-sigs/kind#2241 for more information. Signed-off-by: Kiefer Chang <kiefer.chang@suse.com>
gitlawr
pushed a commit
to harvester/harvester
that referenced
this pull request
Jun 7, 2021
Skip setting `net.netfilter.nf_conntrack_max` sysctl parameter. Setting this parameter causes Kind cluster initialization failure on newer kernels. Please see kubernetes-sigs/kind#2241 for more information. Signed-off-by: Kiefer Chang <kiefer.chang@suse.com>
10 tasks
nelljerram
pushed a commit
to projectcalico/node
that referenced
this pull request
Jul 27, 2021
For kube-proxy not becoming ready, like this:
semaphore@semaphore-vm:~$ kubectl logs kube-proxy-42v55 -n kube-system
I0727 19:55:26.230888 1 node.go:135] Successfully retrieved node IP: 172.17.0.2
I0727 19:55:26.230923 1 server_others.go:172] Using ipvs Proxier.
I0727 19:55:26.230930 1 server_others.go:174] creating dualStackProxier for ipvs.
W0727 19:55:26.232364 1 proxier.go:420] IPVS scheduler not specified, use rr by default
W0727 19:55:26.232522 1 proxier.go:420] IPVS scheduler not specified, use rr by default
W0727 19:55:26.232538 1 ipset.go:107] ipset name truncated; [KUBE-6-LOAD-BALANCER-SOURCE-CIDR] -> [KUBE-6-LOAD-BALANCER-SOURCE-CID]
W0727 19:55:26.232546 1 ipset.go:107] ipset name truncated; [KUBE-6-NODE-PORT-LOCAL-SCTP-HASH] -> [KUBE-6-NODE-PORT-LOCAL-SCTP-HAS]
I0727 19:55:26.232648 1 server.go:571] Version: v1.17.0
I0727 19:55:26.232963 1 conntrack.go:100] Set sysctl 'net/netfilter/nf_conntrack_max' to 131072
F0727 19:55:26.232982 1 server.go:485] open /proc/sys/net/netfilter/nf_conntrack_max: permission denied
See kubernetes-sigs/kind#2240 and
kubernetes-sigs/kind#2241.
Brian-McM
pushed a commit
to projectcalico/node
that referenced
this pull request
Aug 5, 2021
For kube-proxy not becoming ready, like this:
semaphore@semaphore-vm:~$ kubectl logs kube-proxy-42v55 -n kube-system
I0727 19:55:26.230888 1 node.go:135] Successfully retrieved node IP: 172.17.0.2
I0727 19:55:26.230923 1 server_others.go:172] Using ipvs Proxier.
I0727 19:55:26.230930 1 server_others.go:174] creating dualStackProxier for ipvs.
W0727 19:55:26.232364 1 proxier.go:420] IPVS scheduler not specified, use rr by default
W0727 19:55:26.232522 1 proxier.go:420] IPVS scheduler not specified, use rr by default
W0727 19:55:26.232538 1 ipset.go:107] ipset name truncated; [KUBE-6-LOAD-BALANCER-SOURCE-CIDR] -> [KUBE-6-LOAD-BALANCER-SOURCE-CID]
W0727 19:55:26.232546 1 ipset.go:107] ipset name truncated; [KUBE-6-NODE-PORT-LOCAL-SCTP-HASH] -> [KUBE-6-NODE-PORT-LOCAL-SCTP-HAS]
I0727 19:55:26.232648 1 server.go:571] Version: v1.17.0
I0727 19:55:26.232963 1 conntrack.go:100] Set sysctl 'net/netfilter/nf_conntrack_max' to 131072
F0727 19:55:26.232982 1 server.go:485] open /proc/sys/net/netfilter/nf_conntrack_max: permission denied
See kubernetes-sigs/kind#2240 and
kubernetes-sigs/kind#2241.
16 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
It seems the kernel doesn't allow to set some conntrack fields
from non-init netns:
netfilter: conntrack: Make global sysctls readonly in non-init netns
torvalds/linux@671c54e
By default kube-proxy tries to set them, hence failing and the pods
crashlooping.
We can configure kube-proxy to net try to set these values in kubeadm.
Fixes: #2240