Incorrect br-netfilter warning on Centos 7

[dogan-sky]

Centos 7 official packages include linux kernel 3.10 bundled with bridge-netfilter.

This can be verified by checking the existence of the following files:

ls -l /proc/sys/net/bridge
total 0
-rw-r--r-- 1 root root 0 Mar 23 15:40 bridge-nf-call-arptables
-rw-r--r-- 1 root root 0 Mar 23 15:40 bridge-nf-call-ip6tables
-rw-r--r-- 1 root root 0 Mar 23 15:40 bridge-nf-call-iptables
-rw-r--r-- 1 root root 0 Mar 23 16:22 bridge-nf-filter-pppoe-tagged
-rw-r--r-- 1 root root 0 Mar 23 16:22 bridge-nf-filter-vlan-tagged
-rw-r--r-- 1 root root 0 Mar 23 16:22 bridge-nf-pass-vlan-input-dev

However, kubelet prints a warning highlighting the absence of br-netfilter:

1:58.462930   18042 proxier.go:205] missing br-netfilter module or unset br-nf-call-iptables; proxy may not work as intended

This warning seems to be incorrect.

The check that triggers the warning is in Newproxier, located in proxier.go:

if _, err := os.Stat("/sys/module/br_netfilter"); os.IsNotExist(err) {
    warnBrNetfilter = true
}

Fundamentally, in the case of Centos 7, the absence of /sys/module/br_netfilter is not a proof of the absence of the br-netfilter module.

[cescoferraro]

Same issue here on CoreOS stable on digital ocean running Kubernetes v1.2 latest release

core@master ~ $ ls -l /proc/sys/net/bridge
total 0
-rw-r--r-- 1 root root 0 Mar 23 20:46 bridge-nf-call-arptables
-rw-r--r-- 1 root root 0 Mar 23 17:14 bridge-nf-call-ip6tables
-rw-r--r-- 1 root root 0 Mar 23 17:14 bridge-nf-call-iptables
-rw-r--r-- 1 root root 0 Mar 23 20:46 bridge-nf-filter-pppoe-tagged
-rw-r--r-- 1 root root 0 Mar 23 20:46 bridge-nf-filter-vlan-tagged
-rw-r--r-- 1 root root 0 Mar 23 20:46 bridge-nf-pass-vlan-input-dev
core@master ~ $ uname -a
Linux master 4.3.6-coreos #2 SMP Wed Mar 23 01:17:29 UTC 2016 x86_64 Intel(R) Xeon(R) CPU E5-2630L 0 @ 2.00GHz GenuineIntel GNU/Linux

[adidenko]

Same on Ubuntu-14.04:

I0502 12:42:29.202324   14562 proxier.go:205] missing br-netfilter module or unset br-nf-call-iptables; proxy may not work as intended

# ll /proc/sys/net/bridge/
total 0
dr-xr-xr-x 1 root root 0 Apr 26 11:03 .
dr-xr-xr-x 1 root root 0 Apr 26 11:03 ..
-rw-r--r-- 1 root root 0 May  2 12:41 bridge-nf-call-arptables
-rw-r--r-- 1 root root 0 May  2 12:41 bridge-nf-call-ip6tables
-rw-r--r-- 1 root root 0 Apr 26 11:03 bridge-nf-call-iptables
-rw-r--r-- 1 root root 0 May  2 12:41 bridge-nf-filter-pppoe-tagged
-rw-r--r-- 1 root root 0 May  2 12:41 bridge-nf-filter-vlan-tagged
-rw-r--r-- 1 root root 0 May  2 12:41 bridge-nf-pass-vlan-input-dev

# uname -a
Linux node-main.local.int 3.13.0-85-generic #129-Ubuntu SMP Thu Mar 17 20:50:15 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux

# sysctl net.bridge.bridge-nf-call-iptables
net.bridge.bridge-nf-call-iptables = 1

# kubectl version
Client Version: version.Info{Major:"1", Minor:"2", GitVersion:"v1.2.0", GitCommit:"5cb86ee022267586db386f62781338b0483733b3", GitTreeState:"clean"}
Server Version: version.Info{Major:"1", Minor:"2", GitVersion:"v1.2.0", GitCommit:"5cb86ee022267586db386f62781338b0483733b3", GitTreeState:"clean"}

[thockin]

ls -l /sys/module/br_netfilter - maybe it is built-in and therefore not
listed as a module? This could perhaps just test for the sysctl and
recommend loading the module.

@freehan for convergence with CNI stuff...

Anyone have time to pitch in here, should be an easy change...

On Mon, May 2, 2016 at 5:55 AM, Alex Didenko notifications@github.com
wrote:

Same on Ubuntu-14.04:

I0502 12:42:29.202324 14562 proxier.go:205] missing br-netfilter module or
unset br-nf-call-iptables; proxy may not work as intended
ll /proc/sys/net/bridge/

total 0
dr-xr-xr-x 1 root root 0 Apr 26 11:03 .
dr-xr-xr-x 1 root root 0 Apr 26 11:03 ..
-rw-r--r-- 1 root root 0 May 2 12:41 bridge-nf-call-arptables
-rw-r--r-- 1 root root 0 May 2 12:41 bridge-nf-call-ip6tables
-rw-r--r-- 1 root root 0 Apr 26 11:03 bridge-nf-call-iptables
-rw-r--r-- 1 root root 0 May 2 12:41 bridge-nf-filter-pppoe-tagged
-rw-r--r-- 1 root root 0 May 2 12:41 bridge-nf-filter-vlan-tagged
-rw-r--r-- 1 root root 0 May 2 12:41 bridge-nf-pass-vlan-input-dev

Linux node-main.local.int 3.13.0-85-generic #129
#129 SMP Thu Mar
17 20:50:15 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
sysctl net.bridge.bridge-nf-call-iptables

net.bridge.bridge-nf-call-iptables = 1
kubectl version

Client Version: version.Info{Major:"1", Minor:"2", GitVersion:"v1.2.0",
GitCommit:"5cb86ee022267586db386f62781338b0483733b3", GitTreeState:"clean"}
Server Version: version.Info{Major:"1", Minor:"2", GitVersion:"v1.2.0",
GitCommit:"5cb86ee022267586db386f62781338b0483733b3", GitTreeState:"clean"}

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub
#23385 (comment)

[xulis]

Configuration option is not "m", this is not a module.

#cat /etc/redhat-release                
CentOS Linux release 7.1.1503 (Core) 
#uname -r
3.10.0-229.el7.x86_64
#grep CONFIG_BRIDGE_NETFILTER /boot/config-3.10.0-229.el7.x86_64   
CONFIG_BRIDGE_NETFILTER=y

[errordeveloper]

Also happens on Docker for Mac, and it's got this:

docker:~# cat /proc/sys/net/bridge/bridge-nf-call-iptables
1
docker:~# zcat /proc/config.gz | grep CONFIG_BRIDGE_NETFILTER
CONFIG_BRIDGE_NETFILTER=y
docker:~# uname -r
4.4.6-moby

[becile]

how to check kube-proxy policy(namespace、iptables) which kubernetes used right now? thank you

[jwerak]

Can this also result in fall backing into userspace even when --proxy-mode=iptables is used?

[antoineco]

@becile when kube-proxy starts it should log something like server.go:202] Using iptables Proxier.

@veverjak not if proxy-mode is set explicitely to iptables.