Cleaning up IPTables Chain Ownership

[danwinship]

Enhancement Description

• One-line enhancement description (can be used as a release note): Clean up the IPTables chain ownership tangle between kubelet and kube-proxy
• Kubernetes Enhancement Proposal: https://github.com/kubernetes/enhancements/blob/master/keps/sig-network/3178-iptables-cleanup/
• Discussion Link: fix KUBE-MARK-MASQ ownership (kubelet vs kube-proxy) kubernetes#82125, more recently add option to delete the iptables, created by kubelet kubernetes#106480
• Primary contact (assignee): @danwinship
• Responsible SIGs: sig-network
• Enhancement target (which target equals to which milestone):
  • Alpha release target (x.y): 1.25
  • Beta release target (x.y): 1.27
  • Stable release target (x.y): 1.28
• Alpha
  • KEP (k/enhancements) update PR(s):
    • KEP-3178: Cleaning up IPTables Chain Ownership #3179
    • KEP 3178: mark implementable, update Test Plan for alpha #3418
    • KEP-3178: rename feature gate to IPTablesOwnershipCleanup #3444
  • Code (k/k) update PR(s):
    • Don't use KUBE-MARK-DROP for LoadBalancerSourceRanges kubernetes#110289
    • Don't use KUBE-MARK-DROP for "no local endpoints" kubernetes#110290
    • Implement KEP-3178 "iptables cleanup" in kubelet kubernetes#110291
    • don't use KUBE-MARK-DROP in ipvs proxy kubernetes#110628
  • Docs (k/website) update PR(s):
    • KEP 3178 alpha docs website#36020
    • Add blog post about KEP-3178 iptables cleanup website#34478
• Beta
  • KEP (k/enhancements) update PR(s):
    • KEP 3178: update for beta #3690
  • Code (k/k) update PR(s):
    • update IPTablesOwnershipCleanup to beta kubernetes#114472
    • KEP-3178-related iptables rule fixups kubernetes#114470
  • Docs (k/website) update(s): (no docs changes other than the release note from update IPTablesOwnershipCleanup to beta kubernetes#114472)
• Stable
  • KEP (k/enhancements) update PR(s): KEP-3178: Bump 'IPTables Ownership' to GA #4098
  • Code (k/k) update PR(s): move KEP-3178 IPTablesOwnershipCleanup to GA kubernetes#119374
  • Docs (k/website) update(s): update feature gate list for KEP-3178 to GA website#42058
• Post-GA
  • Code (k/k) update PR to remove deprecated kubelet command-line flags: remove deprecated kubelet command-line flags kubernetes#122363
  • Code (k/k) update PR to remove feature gate: Remove GA featuregate about IPTablesOwnershipCleanup in 1.30 kubernetes#122137

Please keep this description up to date. This will help the Enhancement Team to track the evolution of the enhancement efficiently.

[danwinship]

/sig network

[thockin]

This is tagged for 1.25 - is that right?

[danwinship]

@thockin yeah... oh, I explained in the PR but not here. It involves changing the same pieces of code that the internal traffic policy and proxy terminating endpoints and preferlocal traffic policy KEPs are changing, and I wasn't sure we had time to queue another change on top of those ones for 1.24. And it's not like it's urgent or anything anyway...

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[danwinship]

/remove-lifecycle rotten

[thockin]

Added to spreadsheet for 25

[Priyankasaggu11929]

Hello @danwinship 👋, 1.25 Enhancements team here.

Just checking in as we approach enhancements freeze on 18:00 PT on Thursday June 23, 2022, which is just over 3 days from now.

Could you please confirm if this KEP targetting to beta in release cycle?

This enhancement is targeting alpha in 1.25

Here's where this enhancement currently stands:

• KEP file using the latest template has been merged into the k/enhancements repo.
• KEP status is marked as implementable
• KEP has a updated detailed test plan section filled out
• KEP has up to date graduation criteria
• KEP has a production readiness review that has been completed and merged into k/enhancements.

Looks like for this one, we would need to update the following:

• update the merged kep.yaml file to add status: implementable,
• update the merged Test Plan section as per the updated details listed here

For note, the status of this enhancement is marked as at risk. Please keep the issue description up-to-date with appropriate stages as well. Thank you!

[Atharva-Shinde]

Hey again @danwinship 👋

Just checking in as we approach Code freeze at 01:00 UTC Friday, 19th July 2023 .

I don't see any code (k/k) update PR(s) in the issue description so if there are any k/k related PR(s) that we should be tracking for this KEP please link them in the issue description above.

As always, we are here to help if any questions come up. Thanks!

[danwinship]

Sorry, this was discussed in the SIG but not updated here; we are not going to GA for 1.28, we are waiting for 1.29.
oops, no, wrong KEP!

[thockin]

Code is approved

[Atharva-Shinde]

Hey @danwinship 👋 Enhancements Lead here,
With kubernetes/kubernetes#119374 merged as per the issue description, this enhancement is now tracked for v1.28 Code Freeze. Thanks!

[danwinship]

/assign

[npolshakova]

Hey @danwinship 👋 1.29 Enhancements Lead here, is there any more work planned for this KEP? Also is the milestone accurate (are you targeting v1.30 instead of v1.29?)

[npolshakova]

/remove-label lead-opted-in

[danwinship]

@npolshakova I'm not sure this needs to be tracked by the release team at this point, since it is already GA. The issue is just being left open to remind us to finish the cleanup 2 releases post-GA (so yes, the next expected change is in 1.30, not 1.29).

[carlory]

the feature-gate was removed in kubernetes/kubernetes#122137

[salehsedghpour]

/milestone clear

[aojea]

It seems this is done, so I'm going to close it
/close

[k8s-ci-robot]

@aojea: Closing this issue.

In response to this:

It seems this is done, so I'm going to close it
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.