bump iptables version to v1.8.8 #8416

cyclinder · 2024-01-18T02:20:11Z

Description

Currently, the iptables version of calico-node is 1.8.4, The iptables-nft-save -t raw are incompatible. This patch will bump iptables to 1.8.8, which can solve the incompatible issue.

Related issues/PRs

fixes #8403

Todos

Tests
Documentation
Release note

Release Note

Bump iptables version of calico-node to 1.8.8

Reminder for the reviewer

Make sure that this PR has the correct labels and milestone set.

Every PR needs one docs-* label.

docs-pr-required: This change requires a change to the documentation that has not been completed yet.
docs-completed: This change has all necessary documentation completed.
docs-not-required: This change has no user-facing impact and requires no docs.

Every PR needs one release-note-* label.

release-note-required: This PR has user-facing changes. Most PRs should have this label.
release-note-not-required: This PR has no user-facing changes.

Other optional labels:

cherry-pick-candidate: This PR should be cherry-picked to an earlier release. For bug fixes only.
needs-operator-pr: This PR is related to install and requires a corresponding change to the operator.

fasaxc · 2024-01-18T09:43:17Z

/sem-approve

fasaxc · 2024-01-18T09:44:39Z

Thanks a lot @cyclinder, I've kicked off CI.

fasaxc · 2024-01-18T12:48:46Z

Failing with this error:

#45 ERROR: executor failed running [/bin/sh -c /clean-up-filesystem.sh]: exit code: 1
------
 > [ubi 25/26] RUN /clean-up-filesystem.sh:
#45 10.22 warning: file /usr/share/locale/en_GB/LC_MESSAGES/chkconfig.mo: remove failed: No such file or directory
#45 10.22 warning: file /usr/lib/systemd/systemd-sysv-install: remove failed: No such file or directory
#45 10.50 Failed to disable unit, unit systemd-readahead-replay.service does not exist.
#45 10.50 Failed to disable unit, unit systemd-readahead-collect.service does not exist.
#45 10.53 warning: file /etc/rc.local: remove failed: No such file or directory
#45 10.83 install-info: No such file or directory for /usr/share/info/nettle.info
#45 10.89 install-info: No such file or directory for /usr/share/info/history.info
#45 10.89 install-info: No such file or directory for /usr/share/info/rluserman.info
#45 11.01 warning: file /usr/share/locale/en_GB/LC_MESSAGES/p11-kit.mo: remove failed: No such file or directory
#45 11.85 Binary is missing after RPM cleanup: /usr/sbin/ip6tables
------
error: failed to solve: executor failed running [/bin/sh -c /clean-up-filesystem.sh]: exit code: 1

cyclinder · 2024-01-19T02:32:59Z

Thanks @fasaxc

Failing with this error:

Yeah, This is the issue I mentioned in #8403 (comment), and I'm trying to fix it now..., so this PR is in draft state. As soon as I fix it, I'll mark it as ready.

cyclinder · 2024-01-23T13:19:03Z

hey @matthewdupre @mazdakn Could you mind give me some advices? curently, I'm stuck at this point. Any suggestions would be appreciated. Thanks！

cyclinder · 2024-01-23T14:27:04Z

➜  node git:(6503dfeb6) ✗ docker run --rm -it a21da52eb5b1 bash
[root@73874e0b42fe /]# ls /usr/sbin/ip6tables
/usr/sbin/ip6tables
[root@73874e0b42fe /]# 

[root@ca5c2fb949c6 /]# /usr/sbin/iptables
iptables v1.8.8 (nf_tables): no command specified
Try `iptables -h' or 'iptables --help' for more information.
[root@ca5c2fb949c6 /]# /usr/sbin/ip6tables 
bash: /usr/sbin/ip6tables: No such file or directory
[root@ca5c2fb949c6 /]# ^C
[root@ca5c2fb949c6 /]# cd /etc/alternatives/
[root@ca5c2fb949c6 alternatives]# ls
arptables         arptables-restore      arptables-save-man  ebtables-restore  ip6tables-restore  iptables-restore      python
arptables-helper  arptables-restore-man  ebtables            ebtables-save     ip6tables-save     iptables-save         unversioned-python-man
arptables-man     arptables-save         ebtables-man        ip6tables         iptables           libnssckbi.so.x86_64
[root@ca5c2fb949c6 alternatives]# ./ip6tables
bash: ./ip6tables: No such file or directory
[root@ca5c2fb949c6 alternatives]# ls -l
total 0
lrwxrwxrwx 1 root root 23 Jan 23 13:14 arptables -> /usr/sbin/arptables-nft
lrwxrwxrwx 1 root root 33 Jan 23 13:14 arptables-helper -> /usr/libexec/arptables-nft-helper
lrwxrwxrwx 1 root root 38 Jan 23 13:14 arptables-man -> /usr/share/man/man8/arptables-nft.8.gz
lrwxrwxrwx 1 root root 31 Jan 23 13:14 arptables-restore -> /usr/sbin/arptables-nft-restore
lrwxrwxrwx 1 root root 46 Jan 23 13:14 arptables-restore-man -> /usr/share/man/man8/arptables-nft-restore.8.gz
lrwxrwxrwx 1 root root 28 Jan 23 13:14 arptables-save -> /usr/sbin/arptables-nft-save
lrwxrwxrwx 1 root root 43 Jan 23 13:14 arptables-save-man -> /usr/share/man/man8/arptables-nft-save.8.gz
lrwxrwxrwx 1 root root 22 Jan 23 13:14 ebtables -> /usr/sbin/ebtables-nft
lrwxrwxrwx 1 root root 37 Jan 23 13:14 ebtables-man -> /usr/share/man/man8/ebtables-nft.8.gz
lrwxrwxrwx 1 root root 30 Jan 23 13:14 ebtables-restore -> /usr/sbin/ebtables-nft-restore
lrwxrwxrwx 1 root root 27 Jan 23 13:14 ebtables-save -> /usr/sbin/ebtables-nft-save
lrwxrwxrwx 1 root root 26 Jan 23 13:14 ip6tables -> /usr/sbin/ip6tables-legacy
lrwxrwxrwx 1 root root 31 Jan 23 13:14 ip6tables-restore -> /usr/sbin/ip6tables-nft-restore
lrwxrwxrwx 1 root root 28 Jan 23 13:14 ip6tables-save -> /usr/sbin/ip6tables-nft-save
lrwxrwxrwx 1 root root 22 Jan 23 13:14 iptables -> /usr/sbin/iptables-nft
lrwxrwxrwx 1 root root 30 Jan 23 13:14 iptables-restore -> /usr/sbin/iptables-nft-restore
lrwxrwxrwx 1 root root 27 Jan 23 13:14 iptables-save -> /usr/sbin/iptables-nft-save
lrwxrwxrwx 1 root root 34 Mar 28  2023 libnssckbi.so.x86_64 -> /usr/lib64/pkcs11/p11-kit-trust.so
lrwxrwxrwx 1 root root 22 Jan 17 09:46 python -> /usr/libexec/no-python
lrwxrwxrwx 1 root root 43 Jan 17 09:46 unversioned-python-man -> /usr/share/man/man1/unversioned-python.1.gz
[root@ca5c2fb949c6 alternatives]# ls /usr/sbin/

In fact we can be sure that ip6tables is there, but I wonder why this script is complaining that it has been deleted. but why
lrwxrwxrwx 1 root root 26 Jan 23 13:14 ip6tables -> /usr/sbin/ip6tables-legacy ?

[root@ca5c2fb949c6 alternatives]# ls /usr/sbin/ip6tables-legacy
ls: cannot access '/usr/sbin/ip6tables-legacy': No such file or directory

coutinhop · 2024-01-23T17:29:16Z

@cyclinder ip6tables is present as a symlink to /usr/sbin/ip6tables-legacy, which is not found, right? On #8403 @defo89 mentioned that the "legacy case is not covered". Is ip6tables-legacy included in version 1.8.4 (what we currently have), but not in 1.8.9? I wonder if there's an extra package that needs to be installed that will include it

cyclinder · 2024-01-24T02:46:17Z

ip6tables is present as a symlink to /usr/sbin/ip6tables-legacy, which is not found, right? On #8403 @defo89 mentioned that the "legacy case is not covered". Is ip6tables-legacy included in version 1.8.4 (what we currently have), but not in 1.8.9?

@coutinhop Yes, We have not found ip6tables-legacy in 1.8.8

I wonder if there's an extra package that needs to be installed that will include it

I'm more inclined to say that the symlink is incorrect, and ip6tables-nft is there. so it should be ip6tables -> /usr/sbin/ip6tables-nft?

fasaxc · 2024-01-24T11:44:49Z

It think the whole point of that custom build logic is to build the legacy and nft versions of iptables. Normally, RPMs contain one or the other with the same name iptables but we need to install both and select at runtime.

cyclinder · 2024-01-25T15:11:59Z

So it seems that iptables-legacy is not included in our custom compiled iptables...Or it needs to be compiled separately

matthewdupre · 2024-01-29T19:15:35Z

We may need to get iptables legacy from a different source to iptables-nft - I think that's OK, and probably inevitable given the deprecation progress of iptables.

cyclinder · 2024-01-31T06:36:38Z

thanks @matthewdupre .yeah, We really should build both legacy and NFT and then let Runtime choose which one to use.
I verified the latest changes locally for me, It works well.

@fasaxc Can you help trigger the CI and then see what happens with the CI?

mazdakn · 2024-01-31T19:21:24Z

/sem-approve

coutinhop · 2024-01-31T21:12:28Z

node/Dockerfile.arm64

+ARG LIBNFTNL_SOURCERPM_URL=${CENTOS_MIRROR_BASE_URL}/BaseOS/Source/SPackages/libnftnl-${LIBNFTNL_VER}.el9.src.rpm
+ARG IPTABLES_SOURCERPM_URL=${CENTOS_MIRROR_BASE_URL}/BaseOS/Source/SPackages/iptables-${IPTABLES_VER}.el9.src.rpm


arm64 build failed with a 404 on this package, changing the URL to match the amd64 build seems to fix it:

Suggested change

ARG LIBNFTNL_SOURCERPM_URL=${CENTOS_MIRROR_BASE_URL}/BaseOS/Source/SPackages/libnftnl-${LIBNFTNL_VER}.el9.src.rpm

ARG IPTABLES_SOURCERPM_URL=${CENTOS_MIRROR_BASE_URL}/BaseOS/Source/SPackages/iptables-${IPTABLES_VER}.el9.src.rpm

ARG LIBNFTNL_SOURCERPM_URL=${CENTOS_MIRROR_BASE_URL}/BaseOS/source/tree/Packages/libnftnl-${LIBNFTNL_VER}.el9.src.rpm

ARG IPTABLES_SOURCERPM_URL=${CENTOS_MIRROR_BASE_URL}/BaseOS/source/tree/Packages/iptables-${IPTABLES_VER}.el9.src.rpm

oh, I forgot to commit the changes in Dockerfile.arm64, now let me resubmit them!

coutinhop · 2024-02-01T23:29:12Z

/sem-approve

coutinhop

CI is green and image looks good:

$ make image
(...)
$ docker run -it --rm calico/node sh
sh-4.4# iptables --version
iptables v1.8.8 (legacy)
sh-4.4# iptables-nft --version
iptables v1.8.8 (nf_tables)

Thanks @cyclinder! 🎉

cyclinder requested a review from a team as a code owner January 18, 2024 02:20

marvin-tigera added this to the Calico v3.28.0 milestone Jan 18, 2024

marvin-tigera added release-note-required Change has user-facing impact (no matter how small) docs-pr-required Change is not yet documented labels Jan 18, 2024

cyclinder marked this pull request as draft January 18, 2024 02:20

cyclinder mentioned this pull request Jan 18, 2024

option to bump iptables to ≥1.8.8 #8403

Closed

cyclinder force-pushed the bump_iptables_v1.8.9 branch 2 times, most recently from ac1615b to ec3272a Compare January 18, 2024 03:12

fasaxc added docs-not-required Docs not required for this change and removed docs-pr-required Change is not yet documented labels Jan 18, 2024

cyclinder force-pushed the bump_iptables_v1.8.9 branch from ec3272a to 4c5e703 Compare January 31, 2024 06:31

cyclinder marked this pull request as ready for review January 31, 2024 06:36

cyclinder force-pushed the bump_iptables_v1.8.9 branch from 4c5e703 to 98757fb Compare January 31, 2024 06:39

coutinhop reviewed Jan 31, 2024

View reviewed changes

cyclinder force-pushed the bump_iptables_v1.8.9 branch from 98757fb to 1bc4203 Compare February 1, 2024 07:27

bump iptables version to v1.8.8

1e85aff

cyclinder force-pushed the bump_iptables_v1.8.9 branch from 1bc4203 to 1e85aff Compare February 1, 2024 09:35

coutinhop approved these changes Feb 2, 2024

View reviewed changes

coutinhop merged commit d4896d8 into projectcalico:master Feb 2, 2024
2 checks passed

coutinhop mentioned this pull request Feb 5, 2024

[release-v3.27] Auto pick #8416: bump iptables version to v1.8.8 #8485

Merged

3 tasks

caseydavenport mentioned this pull request Mar 11, 2024

Calico panics if kube-proxy using nftables mode #8025

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

bump iptables version to v1.8.8 #8416

bump iptables version to v1.8.8 #8416

cyclinder commented Jan 18, 2024

fasaxc commented Jan 18, 2024

fasaxc commented Jan 18, 2024

fasaxc commented Jan 18, 2024

cyclinder commented Jan 19, 2024 •

edited

Loading

cyclinder commented Jan 23, 2024

cyclinder commented Jan 23, 2024 •

edited

Loading

coutinhop commented Jan 23, 2024

cyclinder commented Jan 24, 2024

fasaxc commented Jan 24, 2024

cyclinder commented Jan 25, 2024

matthewdupre commented Jan 29, 2024

cyclinder commented Jan 31, 2024

mazdakn commented Jan 31, 2024

coutinhop Jan 31, 2024

cyclinder Feb 1, 2024

coutinhop commented Feb 1, 2024

coutinhop left a comment

		ARG LIBNFTNL_SOURCERPM_URL=${CENTOS_MIRROR_BASE_URL}/BaseOS/Source/SPackages/libnftnl-${LIBNFTNL_VER}.el9.src.rpm
		ARG IPTABLES_SOURCERPM_URL=${CENTOS_MIRROR_BASE_URL}/BaseOS/Source/SPackages/iptables-${IPTABLES_VER}.el9.src.rpm

bump iptables version to v1.8.8 #8416

bump iptables version to v1.8.8 #8416

Conversation

cyclinder commented Jan 18, 2024

Description

Related issues/PRs

Todos

Release Note

Reminder for the reviewer

fasaxc commented Jan 18, 2024

fasaxc commented Jan 18, 2024

fasaxc commented Jan 18, 2024

cyclinder commented Jan 19, 2024 • edited Loading

cyclinder commented Jan 23, 2024

cyclinder commented Jan 23, 2024 • edited Loading

coutinhop commented Jan 23, 2024

cyclinder commented Jan 24, 2024

fasaxc commented Jan 24, 2024

cyclinder commented Jan 25, 2024

matthewdupre commented Jan 29, 2024

cyclinder commented Jan 31, 2024

mazdakn commented Jan 31, 2024

coutinhop Jan 31, 2024

Choose a reason for hiding this comment

cyclinder Feb 1, 2024

Choose a reason for hiding this comment

coutinhop commented Feb 1, 2024

coutinhop left a comment

Choose a reason for hiding this comment

cyclinder commented Jan 19, 2024 •

edited

Loading

cyclinder commented Jan 23, 2024 •

edited

Loading