-
Notifications
You must be signed in to change notification settings - Fork 7.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
istio-sidecar.deb fails to start on Debian buster with iptables default nftables setting #23279
Comments
@gnz00 what is your Linux kernel version? |
I think the vanilla @gnz00 could you do a quick check that this works if you replace |
The iptables docs only specify --to-ports, even though vanilla iptables silently accepts --to-port. nftables's iptables is more strict and rejects --to-port. Fixes #23279
The iptables docs only specify --to-ports, even though vanilla iptables silently accepts --to-port. nftables's iptables is more strict and rejects --to-port. Fixes #23279
The iptables docs only specify --to-ports, even though vanilla iptables silently accepts --to-port. nftables's iptables is more strict and rejects --to-port. Fixes istio#23279
Keeping this open until I cherry-pick #23289 into |
Changing to |
Note that this issue is not blocking usage on Debian Buster.
|
Actually, |
|
Minimal reproducer:
It seems like
This bug seems very specific to |
I would recommend filing this as a bug in Debian against the |
The
So the problem would seem to be that It's hard to know whether this is expected behavior, since |
The iptables docs only specify --to-ports, even though vanilla iptables silently accepts --to-port. nftables's iptables is more strict and rejects --to-port. Fixes #23279
I did actually try
|
I think so. You may need to run your container as privileged for this to work? There are definitely ways to make this work, since KIND works on Docker Desktop. |
The iptables docs only specify --to-ports, even though vanilla iptables silently accepts --to-port. nftables's iptables is more strict and rejects --to-port. Fixes #23279 Co-authored-by: Romain Lenglet <rlenglet@google.com>
BTW, another workaround is to enable Istio CNI. It still runs individual |
I will check whether upgrading to |
But that version too has a broken
|
That version 1.8.4-3 has a working
(no failure here) So this is not an Istio bug. It's a bug in I will close this bug. Feel free to file a bug against Debian Buster to ask them to upgrade |
The iptables docs only specify --to-ports, even though vanilla iptables silently accepts --to-port. nftables's iptables is more strict and rejects --to-port. Fixes #23279
The iptables docs only specify --to-ports, even though vanilla iptables silently accepts --to-port. nftables's iptables is more strict and rejects --to-port. Fixes istio#23279
Unable to start on the latest debian due to Istio dependency on iptables.
Bug description
Expected behavior
Steps to reproduce the bug
Version (include the output of
istioctl version --remote
andkubectl version
andhelm version
if you used Helm)1.5.2
How was Istio installed?
Manually installed the debian package, see above.
Environment where bug was observed (cloud vendor, OS, etc)
Docker on OSX running Debian buster
The text was updated successfully, but these errors were encountered: