nftables service is broken after reboot

[duritong]

I am having the issue that after rebooting a node the nftables service is broken:

# systemctl status nftables.service 
● nftables.service - Netfilter Tables
   Loaded: loaded (/usr/lib/systemd/system/nftables.service; enabled; vendor preset: disabled)
  Drop-In: /etc/systemd/system/nftables.service.d
           └─puppet_nft.conf
   Active: failed (Result: exit-code) since Mon 2021-03-01 14:21:53 UTC; 11min ago
     Docs: man:nft(8)
  Process: 759 ExecStart=/sbin/nft -I /etc/nftables/puppet -f /etc/sysconfig/nftables.conf (code=exited, status=1/FAILURE)
 Main PID: 759 (code=exited, status=1/FAILURE)

Mar 01 14:21:53 example.glei.ch nft[759]: /etc/nftables/puppet.nft:8:26-44: Error: Could not process rule: No such file or directory
Mar 01 14:21:53 example.glei.ch nft[759]: flush table inet filter; flush table ip nat; flush table ip6 nat
Mar 01 14:21:53 example.glei.ch nft[759]:                          ^^^^^^^^^^^^^^^^^^^
Mar 01 14:21:53 example.glei.ch nft[759]: In file included from /etc/sysconfig/nftables.conf:4:1-35:
Mar 01 14:21:53 example.glei.ch nft[759]: /etc/nftables/puppet.nft:8:46-65: Error: Could not process rule: No such file or directory
Mar 01 14:21:53 example.glei.ch nft[759]: flush table inet filter; flush table ip nat; flush table ip6 nat
Mar 01 14:21:53 example.glei.ch nft[759]:                                              ^^^^^^^^^^^^^^^^^^^^
Mar 01 14:21:53 example.glei.ch systemd[1]: nftables.service: Main process exited, code=exited, status=1/FAILURE
Mar 01 14:21:53 example.glei.ch systemd[1]: nftables.service: Failed with result 'exit-code'.
Mar 01 14:21:53 example.glei.ch systemd[1]: Failed to start Netfilter Tables.

It will go back in a working by running puppet twice (!).

First it will remove the flush table cmds (since the fact returns an empty list of tables) and thus the nft rule set become applicable again.
On the second run it will re-add the tables.

We should not try to flush the tables when they are not present!

[nbarrientos]

Interesting. Indeed those tables won't be there right after the system boots so they cannot be flushed at start-up :) Just for completeness, this is happening with non-default module configuration, right? I mean, you're setting nftables::noflush_tables (otherwise there should be a flush ruleset instead in /etc/nftables/nftables.nft).

[duritong]

Yes, I am setting it to:

hieradata/defaults.yaml:nftables::noflush_tables: ['ip-fail2ban']

since that one should not get flushed.