-
Notifications
You must be signed in to change notification settings - Fork 1.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
iptables-nft-save v1.8.7 (nf_tables): Could not fetch rule set generation id: Invalid argument #9053
Comments
Could possibly be fixed by #8859. |
I was thinking at first #8859 might fix it too; I think this might be an issue with Google's Container Optimized OS (COS) not supporting @dwilliams782 was kind enough to ssh onto his
These are some of the modules that I expected to see. Most of the
Using
In contrast, here's the output from
Full
Next, I wanted to see if we can :; find /lib/modules | grep tables
/lib/modules/4.19.0-20-amd64/kernel/net/ipv6/netfilter/ip6_tables.ko
/lib/modules/4.19.0-20-amd64/kernel/net/netfilter/x_tables.ko
/lib/modules/4.19.0-20-amd64/kernel/net/netfilter/nf_tables.ko
/lib/modules/4.19.0-20-amd64/kernel/net/netfilter/nf_tables_set.ko
/lib/modules/4.19.0-20-amd64/kernel/net/ipv4/netfilter/ip_tables.ko
/lib/modules/4.19.0-20-amd64/kernel/net/ipv4/netfilter/arp_tables.ko
/lib/modules/4.19.0-20-amd64/kernel/net/bridge/netfilter/ebtables.ko
/lib/modules/4.19.0-12-amd64/kernel/net/ipv6/netfilter/ip6_tables.ko
/lib/modules/4.19.0-12-amd64/kernel/net/netfilter/x_tables.ko
/lib/modules/4.19.0-12-amd64/kernel/net/netfilter/nf_tables.ko
/lib/modules/4.19.0-12-amd64/kernel/net/netfilter/nf_tables_set.ko
/lib/modules/4.19.0-12-amd64/kernel/net/ipv4/netfilter/ip_tables.ko
/lib/modules/4.19.0-12-amd64/kernel/net/ipv4/netfilter/arp_tables.ko
/lib/modules/4.19.0-12-amd64/kernel/net/bridge/netfilter/ebtables.ko
/lib/modules/4.19.0-21-amd64/kernel/net/ipv6/netfilter/ip6_tables.ko
/lib/modules/4.19.0-21-amd64/kernel/net/netfilter/x_tables.ko
/lib/modules/4.19.0-21-amd64/kernel/net/netfilter/nf_tables.ko
/lib/modules/4.19.0-21-amd64/kernel/net/netfilter/nf_tables_set.ko
/lib/modules/4.19.0-21-amd64/kernel/net/ipv4/netfilter/ip_tables.ko
/lib/modules/4.19.0-21-amd64/kernel/net/ipv4/netfilter/arp_tables.ko
/lib/modules/4.19.0-21-amd64/kernel/net/bridge/netfilter/ebtables.ko On
I found it weird and thought perhaps for some reason
Clearly didn't work. My feeling is that
I did some digging and found this GitLab issue: https://gitlab.com/kalilinux/tools/kali-ci-autopkgtest-lxc/-/issues/1. In the issue, they see a similar error (albeit when using I think this is just a compatibility issue (didn't expect to run into one so soon) and there's not much we can do in Linkerd other than document the error. We could perhaps have a compatibility table that we add to as we encounter these. Based on the steps we went through and based on the gitlab issues, I think it's safe to assume Google's Container Optimized OS doesn't include TL;DR: seems Google Container Optimized OS doesn't support |
Awesome thanks for the investigation into this! |
I think this is probably a good motivation to revert the default to legacy--GCOS is a fairly popular OS. |
Some hosts may not have 'nft' modules available. Currently, proxy-init defaults to using 'iptables-nft'; if the host does not have support for nft modules, the init container will crash, blocking all injected workloads from starting up. This change defaults the 'iptablesMode' value to 'legacy'. * Update linkerd-control-plane/values file default * Update proxy-init partial to default to 'legacy' when no mode is specified * Change expected values in 'pkg/charts/linkerd2/values_test.go' and in 'cli/cmd/install_test' * Update golden files Fixes #9053 Signed-off-by: Matei David <matei@buoyant.io>
What is the issue?
I've just upgraded to the latest edge (edge-22.7.3) and have the following iptables error:
Could not fetch rule set generation id
.I have got around this by using legacy:
How can it be reproduced?
Upgrade to the latest version of edge on a GKE cluster with COS nodes.
Logs, error output, etc
output of
linkerd check -o short
Environment
Possible solution
No response
Additional context
No response
Would you like to work on fixing this bug?
No response
The text was updated successfully, but these errors were encountered: