Do not call NewFlannelServer() unless flannel overlay is enabled

[luxas]

Ref: #26093

This makes so kubelet does not warn the user that iptables isn't in PATH, although the user didn't enable the flannel overlay.

@vishh @freehan @bprashanth

[bprashanth]

you probably want to warn the user about iptables anway, because the kubelet installs a masquerade rule:

kubernetes/pkg/kubelet/container_bridge.go

Line 145 in dae5ac4

func ensureIPTablesMasqRule(nonMasqueradeCIDR string) error {

[luxas]

Ah, I missed that one.
It's a quite large project, so when one is researching like in #26093, there will be some things that fall out of scope.

Great, I'll add that one.

@bprashanth So the question is, is this masquerade rule really necessary in all cases, or just when enabling some functions? It would be really great if we found a way where kubelet didn't depend on iptables, because iptables depends on glibc, and that's quite heavy...

[bprashanth]

Kube-proxy requires iptables anway. I feel iptables is basic enough to require on every node, perhaps @kubernetes/sig-network has thoughts.

[luxas]

Yes, but the intention was to package kubelet in a small container (busybox would be the dream) that includes as few deps as possible statically linked (ethtool, socat, nsenter). kube-proxy will run in a daemonset on every node (maybe in a buildrooted base image or something)

So it would be great to not depend on iptables in that case, but I don't know if it's technically possible...

[thockin]

I think iptables is effectively required

On Wed, May 25, 2016 at 1:06 PM, Lucas Käldström notifications@github.com
wrote:

Yes, but the intention was to package kubelet in a small container (
busybox would be the dream) that includes as few deps as possible
statically linked (ethtool, socat, nsenter). kube-proxy will run in a
daemonset on every node (maybe in a buildrooted base image or something)

So it would be great to not depend on iptables in that case, but I don't
know if it's technically possible...

—
You are receiving this because you are on a team that was mentioned.
Reply to this email directly or view it on GitHub
#26264 (comment)

[luxas]

Okay, iptables is required for now.
But anyway, I think it's unnecessary to call NewFlannelServer() when we're not using it.
It might save a little memory at least.

@dchen1107 Should we proceed on this anyway?

[luxas]

@k8s-bot e2e test this please github issue: #IGNORE

[bprashanth]

Sure, lgtm but removing 1.3 milestone

[k8s-bot]

GCE e2e build/test passed for commit fdff659.

• Build Log
• Test Artifacts
• Internal Jenkins Results

[luxas]

removing 1.3 milestone

Yes, absolutely! Iit shouldn't have any specific priority anymore...

[k8s-github-robot]

@k8s-bot test this [submit-queue is verifying that this PR is safe to merge]

[k8s-bot]

GCE e2e build/test passed for commit fdff659.

• Build Log
• Test Artifacts
• Internal Jenkins Results

[k8s-github-robot]

Automatic merge from submit-queue