Cleaning up IPTables Chain Ownership

[danwinship]

Enhancement Description

• One-line enhancement description (can be used as a release note): Clean up the IPTables chain ownership tangle between kubelet and kube-proxy
• Kubernetes Enhancement Proposal: https://github.com/kubernetes/enhancements/blob/master/keps/sig-network/3178-iptables-cleanup/
• Discussion Link: fix KUBE-MARK-MASQ ownership (kubelet vs kube-proxy) kubernetes#82125, more recently add option to delete the iptables, created by kubelet kubernetes#106480
• Primary contact (assignee): @danwinship
• Responsible SIGs: sig-network
• Enhancement target (which target equals to which milestone):
  • Alpha release target (x.y): 1.25
  • Beta release target (x.y): 1.27
  • Stable release target (x.y): 1.28
• Alpha
  • KEP (k/enhancements) update PR(s):
    • KEP-3178: Cleaning up IPTables Chain Ownership #3179
    • KEP 3178: mark implementable, update Test Plan for alpha #3418
    • KEP-3178: rename feature gate to IPTablesOwnershipCleanup #3444
  • Code (k/k) update PR(s):
    • Don't use KUBE-MARK-DROP for LoadBalancerSourceRanges kubernetes#110289
    • Don't use KUBE-MARK-DROP for "no local endpoints" kubernetes#110290
    • Implement KEP-3178 "iptables cleanup" in kubelet kubernetes#110291
    • don't use KUBE-MARK-DROP in ipvs proxy kubernetes#110628
  • Docs (k/website) update PR(s):
    • KEP 3178 alpha docs website#36020
    • Add blog post about KEP-3178 iptables cleanup website#34478
• Beta
  • KEP (k/enhancements) update PR(s):
    • KEP 3178: update for beta #3690
  • Code (k/k) update PR(s):
    • update IPTablesOwnershipCleanup to beta kubernetes#114472
    • KEP-3178-related iptables rule fixups kubernetes#114470
  • Docs (k/website) update(s): (no docs changes other than the release note from update IPTablesOwnershipCleanup to beta kubernetes#114472)
• Stable
  • KEP (k/enhancements) update PR(s): KEP-3178: Bump 'IPTables Ownership' to GA #4098
  • Code (k/k) update PR(s): move KEP-3178 IPTablesOwnershipCleanup to GA kubernetes#119374
  • Docs (k/website) update(s): update feature gate list for KEP-3178 to GA website#42058
• Post-GA
  • Code (k/k) update PR to remove deprecated kubelet command-line flags: remove deprecated kubelet command-line flags kubernetes#122363
  • Code (k/k) update PR to remove feature gate: Remove GA featuregate about IPTablesOwnershipCleanup in 1.30 kubernetes#122137

Please keep this description up to date. This will help the Enhancement Team to track the evolution of the enhancement efficiently.

[danwinship]

/sig network

[thockin]

This is tagged for 1.25 - is that right?

[danwinship]

@thockin yeah... oh, I explained in the PR but not here. It involves changing the same pieces of code that the internal traffic policy and proxy terminating endpoints and preferlocal traffic policy KEPs are changing, and I wasn't sure we had time to queue another change on top of those ones for 1.24. And it's not like it's urgent or anything anyway...