CoreOS hyperkube v1.9.0_coreos.0: No ipset utility, IPVS proxy mode fails

[ivanilves]

hyperkube v1.9.0_coreos.0 does not have ipset utility installed, IPVS proxy mode fails.

Proxying this as CoreOS hyperkube image has the same issue: kubernetes/kubernetes#57321

This is the fix:
kubernetes/kubernetes@787a55b#diff-bf0f8d724d18f700f3c821aa5a74f4cf

💡 Could we publish a new version of CoreOS hyperkube v1.9.0 with ipset installed? 🙏

Thanks!

P.S.:
Meanwhile I've put a fixed image in ivanilves/hyperkube:v1.9.0_coreos.0 https://hub.docker.com/r/ivanilves/hyperkube/

[ericchiang]

Any idea why kubernetes/kubernetes#56115 wasn't cherry picked to 1.9?

[ivanilves]

No idea. 😞

FYI hyperkube build from gcr.io should have it cherry-picked. Read more:
kubernetes-retired/kube-aws#1104

[rphillips]

It looks like the upstream PR kubernetes/kubernetes#57648 has not been merged yet.

[christianhuening]

I would appreciate a new hyperkube image with ipset as well

[christianhuening]

Ok so kubernetes/kubernetes#57648 is finally approved and merged. How do we get a hyperkube image with ipset included?

[rphillips]

We should try and get the change cherry picked into the 1.9 branch for the next release cycle.

[christianhuening]

any updates here @rphillips ?

[rphillips]

@christianhuening this should now be fixed in the later 1.9 releases... Can you verify the tool is present in the latest release, so we can close out this issue?

[christianhuening]

@rphillips Well I am running coreos/hyperkube:v1.9.6_coreos.0 now, and I cannot find ipset in it. It should be at /sbin/ipset right?

[rphillips]

@christianhuening there was a bug in the 1.9 release that didn't pull in the right image to get this fixed. It is fixed in 1.10, though the hyperkube image is not ready yet. kubernetes/kubernetes#61357 is pending to add udev which would bump the image again. I'm sorry about the churn on this, but I will get this straightened out. If you can use 1.10, please keep your eye out for the image.

[christianhuening]

thanks @rphillips ! Already planning the 1.10 update, would be great to have 'em in there!

[rphillips]

@christianhuening the 1.10 image was pushed!

[christianhuening]

@rphillips thanks! will test!

[rphillips]

ipset still isn't in the 1.10 release. The PR is still pending... kubernetes/kubernetes#61861

[rphillips]

The upstream PR just merged... This fix will be in the next 1.10 release.

[PabloCastellano]

I have just checked that the ipset binary is present in v1.9.11_coreos.0

$ docker run --rm -ti quay.io/coreos/hyperkube:v1.9.11_coreos.0 ipset
ipset v6.30: No command specified.
Try `ipset help' for more information.

I think we can close this issue now @ivanilves

[ivanilves]

Yes @PabloCastellano indeed. Thank you!