K
Q

iptables: repetitive identical entries in the iptables on the kubernetes nodes

8/22/2019

I play around with kubernetes and I have seen that there are a lot of repetitive identical entries in the iptables on the nodes. Any explication why?

Chain KUBE-FIREWALL (0 references)
target     prot opt source               destination         
DROP       all  --  anywhere             anywhere             mark match 0x8000/0x8000 /* kubernetes firewall for dropping marked packets */
DROP       all  --  anywhere             anywhere             mark match 0x8000/0x8000 /* kubernetes firewall for dropping marked packets */
DROP       all  --  anywhere             anywhere             mark match 0x8000/0x8000 /* kubernetes firewall for dropping marked packets */
DROP       all  --  anywhere             anywhere             mark match 0x8000/0x8000 /* kubernetes firewall for dropping marked packets */
DROP       all  --  anywhere             anywhere             mark match 0x8000/0x8000 /* kubernetes firewall for dropping marked packets */
....

System info:

  • os: Debian Stretch
  • kernel: 4.15.18-19-pve x86_64 GNU/Linux
  • kubelet 1.15.1-00

Installation is done with ansible

-- papanito
iptables
kubernetes

Similar Questions

What happens if a Kubernetes pod exceeds its cpu resources 'limit'?
Tracing apache camel route with Jaeger
How to have multiple pods access an existing NFS folder in Kubernetes?
Want to redirect the server url to server/somestring through nginx
kubernetes - route ingress traffic to specific pod for some paths
Persist a Single Value Kubernetes & Golang

1 Answer

8/30/2019

Followed few times in a row ansible approach, using the same kernel 4.15.18-19-pve x86_64 GNU/Linux, but not able at all reproduce your problem.

Each time I get(as expected in normal behavior)

Chain KUBE-FIREWALL (2 references)
target     prot opt source               destination         
DROP       all  --  anywhere             anywhere             /* kubernetes firewall for dropping marked packets */ mark match 0x8000/0x8000

The only way get into the same situation as you - is to manually update iptables duplicating the entries and get rig of references.

If I will find anything interesting - I will let you know.

-- VKR
Source: StackOverflow