Check conntrack module presence instead of kernel version

[VannTen]

What type of PR is this?
/kind bug

What this PR does / why we need it:
Depending on kernel distributor, the kernel version might not be a
correct indicator of the conntrack module use.
Instead, we check both (and use the first found).

This is a case on a RedHat 8 host I use, with kernel 4.18, where modprobe nf_conntrack succeds and modprobe nf_conntrack_ipv4 fail

• Try both conntrack modules instead of checking kernel version
• Use modproble.persistent rather than manual persistence

Special notes for your reviewer:

The "loop until first success" trick is from https://stackoverflow.com/a/63996744
Follow-up of #10625

Does this PR introduce a user-facing change?:

Check for correct conntrack module presence, regardless of kernel versions

[k8s-ci-robot]

Hi @VannTen. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[MrFreezeex]

nits: I think it would be nice to have a small comment explaining that only the first sucessful module will be loaded

[MrFreezeex]

Ah actually there is one word misspelled

roles/kubernetes/node/defaults/main.yml:252:64: "sucessfully" is a misspelling of "successfully"

[MrFreezeex]

Does it only persist it when the modprobe is a success?

[VannTen]

I would assume so, but it's undocumented. Gonna check.

[VannTen]

Indeed, it only adds it if successful

$ ANSIBLE_STDOUT_CALLBACK=debug ansible-playbook -i localhost playbook.yml -b
[WARNING]: Unable to parse /home/max/client/upstream/localhost as an inventory source
[WARNING]: No inventory was parsed, only implicit localhost is available
[WARNING]: provided hosts list is empty, only localhost is available. Note that the implicit localhost does not match 'all'

PLAY [localhost] ******************************************************************************************************************************************************************************

TASK [community.general.modprobe] *************************************************************************************************************************************************************
failed: [localhost] (item=nf_conntrack_ipv4) => {
    "ansible_loop_var": "item",
    "changed": false,
    "item": "nf_conntrack_ipv4",
    "name": "nf_conntrack_ipv4",
    "params": "",
    "rc": 1,
    "state": "present"
}

STDERR:

modprobe: FATAL: Module nf_conntrack_ipv4 not found in directory /lib/modules/6.6.2-arch1-1



MSG:

modprobe: FATAL: Module nf_conntrack_ipv4 not found in directory /lib/modules/6.6.2-arch1-1

changed: [localhost] => (item=nf_conntrack)
...ignoring

PLAY RECAP ************************************************************************************************************************************************************************************
localhost                  : ok=1    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=1   

[max@desktop ~/client/upstream] (master *%>)$ cat /etc/mod
modprobe.d/     modulefiles/    modules-load.d/ 
[max@desktop ~/client/upstream] (master *%>)$ cat /etc/modules-load.d/
gnutls.conf        nf_conntrack.conf  
[max@desktop ~/client/upstream] (master *%>)$ cat /etc/modules-load.d/nf_conntrack.conf 
nf_conntrack

# playbook.yml

- hosts: localhost
  gather_facts: no
  tasks:
  - community.general.modprobe:
      name: "{{ item }}"
      state: present
      persistent: present
    register: modprobe_conntrack_module
    ignore_errors: true  # noqa ignore-errors
    loop:
    - nf_conntrack_ipv4
    - nf_conntrack
    when:
      - "(modprobe_conntrack_module|default({'rc': 1})).rc != 0"  # loop until first success

[MrFreezeex]

Great thank you for this very nice cleanup 🤝
/lgtm
/ok-to-test

[MrFreezeex]

/lgtm

[VannTen]

/assign @mzaian
for approval

[mzaian]

Thanks a lot @VannTen

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: MrFreezeex, mzaian, VannTen

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [mzaian]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment