--cleanup-iptables are deprecated

[KeithTt]

I followed this page: https://github.com/cloudnativelabs/kube-router/blob/master/Documentation/kubeadm.md

Everything is running, and I delete the kube-proxy daemonset, then meet the issue:

# docker run --privileged --net=host gcr.mirrors.ustc.edu.cn/google_containers/kube-proxy-amd64:v1.7.3 kube-proxy --cleanup-iptables
Unable to find image 'gcr.mirrors.ustc.edu.cn/google_containers/kube-proxy-amd64:v1.7.3' locally
v1.7.3: Pulling from google_containers/kube-proxy-amd64
2bab9f5a025e: Pull complete
b54d289ec6e2: Pull complete
9e9dc20d80fd: Pull complete
Digest: sha256:dba7121df9f74b40901fb655053af369f58c82c3636d8125986ce474a759be80
Status: Downloaded newer image for gcr.mirrors.ustc.edu.cn/google_containers/kube-proxy-amd64:v1.7.3
W0110 09:27:38.505905       1 server.go:190] WARNING: all flags other than --config, --write-config-to, and --cleanup-iptables are deprecated. Please begin using a config file ASAP.

Is there a good way to clean the iptables rules?

Or, does it matters if not delete iptables?

[murali-reddy]

@KeithTt I think flag name was changed to just --cleanup, check if that works. Iptables need to be deleted as it will interfere with ipvs doing load balancing.

[KeithTt]

@murali-reddy

#kube-proxy --help
--cleanup   If true cleanup iptables and ipvs rules and exit.

It seems will cleanup ipvs as well.

[murali-reddy]

@KeithTt ideally you do it in three steps

• delete deamonset for kube-proxy
• clean up the config done by kube-proxy
• deploy deamonset for kube-router

Step 2 should be is one time thing. It should be okay it cleanup ipvs rules also. kube-router will configure IPVS as needed.

[KeithTt]

@murali-reddy I tried different versions, but failed with errors:

# docker run --privileged --net=host gcr.mirrors.ustc.edu.cn/google_containers/kube-proxy-amd64:v1.7.3 kube-proxy --cleanup-iptables
W0110 11:36:39.345321       1 server.go:190] WARNING: all flags other than --config, --write-config-to, and --cleanup-iptables are deprecated. Please begin using a config file ASAP.

# docker run --privileged --net=host gcr.io/google_containers/kube-proxy-amd64:v1.8.4 kube-proxy --cleanup
W0110 11:37:59.074115       1 server.go:191] WARNING: all flags other than --config, --write-config-to, and --cleanup are deprecated. Please begin using a config file ASAP.
time="2018-01-10T11:37:59Z" level=warning msg="Running modprobe ip_vs failed with message: `modprobe: ERROR: ../libkmod/libkmod.c:557 kmod_search_moddep() could not open moddep file '/lib/modules/4.9.0-4-amd64/modules.dep.bin'`, error: exit status 1"
error: encountered an error while tearing down rules.

[murali-reddy]

@KeithTt error in second step is okay to ignore. It failed to cleanup ipvs rules. So very likely kube-proxy was running with iptables proxier, and would have cleaned up.

After performing that step just verify that iptables nat table does not have any rules releated service proxy. If its clean you are good to deploy kube-router daemonset.

[KeithTt]

@murali-reddy Got it, thanks a lot!

Close it.

[zakkg3]

If someone lands here hitting an error on kube-proxy --cleanup, make sure the kube-proxy version matches your k8s version :D