Cleaning up IPTables Chain Ownership

[danwinship]

Enhancement Description

• One-line enhancement description (can be used as a release note): Clean up the IPTables chain ownership tangle between kubelet and kube-proxy
• Kubernetes Enhancement Proposal: https://github.com/kubernetes/enhancements/blob/master/keps/sig-network/3178-iptables-cleanup/
• Discussion Link: fix KUBE-MARK-MASQ ownership (kubelet vs kube-proxy) kubernetes#82125, more recently add option to delete the iptables, created by kubelet kubernetes#106480
• Primary contact (assignee): @danwinship
• Responsible SIGs: sig-network
• Enhancement target (which target equals to which milestone):
  • Alpha release target (x.y): 1.25
  • Beta release target (x.y): 1.27
  • Stable release target (x.y): 1.28
• Alpha
  • KEP (k/enhancements) update PR(s):
    • KEP-3178: Cleaning up IPTables Chain Ownership #3179
    • KEP 3178: mark implementable, update Test Plan for alpha #3418
    • KEP-3178: rename feature gate to IPTablesOwnershipCleanup #3444
  • Code (k/k) update PR(s):
    • Don't use KUBE-MARK-DROP for LoadBalancerSourceRanges kubernetes#110289
    • Don't use KUBE-MARK-DROP for "no local endpoints" kubernetes#110290
    • Implement KEP-3178 "iptables cleanup" in kubelet kubernetes#110291
    • don't use KUBE-MARK-DROP in ipvs proxy kubernetes#110628
  • Docs (k/website) update PR(s):
    • KEP 3178 alpha docs website#36020
    • Add blog post about KEP-3178 iptables cleanup website#34478
• Beta
  • KEP (k/enhancements) update PR(s):
    • KEP 3178: update for beta #3690
  • Code (k/k) update PR(s):
    • update IPTablesOwnershipCleanup to beta kubernetes#114472
    • KEP-3178-related iptables rule fixups kubernetes#114470
  • Docs (k/website) update(s): (no docs changes other than the release note from update IPTablesOwnershipCleanup to beta kubernetes#114472)
• Stable
  • KEP (k/enhancements) update PR(s): KEP-3178: Bump 'IPTables Ownership' to GA #4098
  • Code (k/k) update PR(s): move KEP-3178 IPTablesOwnershipCleanup to GA kubernetes#119374
  • Docs (k/website) update(s): update feature gate list for KEP-3178 to GA website#42058
• Post-GA
  • Code (k/k) update PR to remove deprecated kubelet command-line flags:
  • Code (k/k) update PR to remove feature gate:

Please keep this description up to date. This will help the Enhancement Team to track the evolution of the enhancement efficiently.

[danwinship]

/sig network

[thockin]

This is tagged for 1.25 - is that right?

[danwinship]

@thockin yeah... oh, I explained in the PR but not here. It involves changing the same pieces of code that the internal traffic policy and proxy terminating endpoints and preferlocal traffic policy KEPs are changing, and I wasn't sure we had time to queue another change on top of those ones for 1.24. And it's not like it's urgent or anything anyway...

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[danwinship]

/remove-lifecycle rotten

[thockin]

Added to spreadsheet for 25

[thockin]

NEXT: Aiming for GA in 1.28

[Atharva-Shinde]

Hello @danwinship 👋, Enhancements team here.

Just checking in as we approach enhancements freeze on Thursday, 16th June 2023.

Looks like this enhancement is targeting for stage stable for v1.28 (correct me if otherwise)

Here's where this enhancement currently stands:

• KEP readme using the latest template has been merged into the k/enhancements repo.
• KEP status is marked as implementable for latest-milestone:v1.28
• KEP readme has a updated detailed test plan section filled out
• KEP readme has up to date graduation criteria
• KEP has a production readiness review that has been completed and merged into k/enhancements.

For this KEP, we would need to update the following:

• Update kep.yaml with latest information.
• If moving to stage stable add approvers for it in the prod-readiness yaml file
• Get a PRR approval

The status of this enhancement is marked as at risk. Please keep the issue description up-to-date with appropriate stages as well. Thank you :)

[johnbelamaric]

Is this still planning on going to stable in 1.28? I don't see a KEP update PR.

[aojea]

ping @danwinship

[johnbelamaric]

Still don't see a KEP PR to bump this to GA?

[thockin]

#4098

…

On Thu, Jun 15, 2023 at 10:47 AM John Belamaric ***@***.***> wrote: Still don't see a KEP PR to bump this to GA? — Reply to this email directly, view it on GitHub <#3178 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABKWAVEFFHUEM7XIIZU2NI3XLNDBVANCNFSM5MTZDIJA> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[Atharva-Shinde]

Thanks @thockin :)
With all the KEP requirements in place and merged into k/enhancements, this enhancement is all good for the upcoming enhancements freeze 🚀.
The status of this enhancement is marked as tracked. Please keep the issue description up-to-date with appropriate stages as well.

[Atharva-Shinde]

Hey again @danwinship 👋

Just checking in as we approach Code freeze at 01:00 UTC Friday, 19th July 2023 .

I don't see any code (k/k) update PR(s) in the issue description so if there are any k/k related PR(s) that we should be tracking for this KEP please link them in the issue description above.

As always, we are here to help if any questions come up. Thanks!

[danwinship]

Sorry, this was discussed in the SIG but not updated here; we are not going to GA for 1.28, we are waiting for 1.29.
oops, no, wrong KEP!

[thockin]

Code is approved

[Atharva-Shinde]

Hey @danwinship 👋 Enhancements Lead here,
With kubernetes/kubernetes#119374 merged as per the issue description, this enhancement is now tracked for v1.28 Code Freeze. Thanks!

[danwinship]

/assign

[npolshakova]

Hey @danwinship 👋 1.29 Enhancements Lead here, is there any more work planned for this KEP? Also is the milestone accurate (are you targeting v1.30 instead of v1.29?)

[npolshakova]

/remove-label lead-opted-in

[danwinship]

@npolshakova I'm not sure this needs to be tracked by the release team at this point, since it is already GA. The issue is just being left open to remind us to finish the cleanup 2 releases post-GA (so yes, the next expected change is in 1.30, not 1.29).