From 543c8a4c8b05e9dc6d7d1ddbc4a40be1b3110c08 Mon Sep 17 00:00:00 2001 From: simplytunde Date: Mon, 16 Sep 2019 09:52:38 -0600 Subject: [PATCH] Add instructions for switching to iptables-legacy (#16271) (#16369) (cherry picked from commit 9cdaf4ead1f4c514a6a2582ab00e01efad331a0d) --- .../tools/kubeadm/install-kubeadm.md | 34 +++++++++++++++++-- 1 file changed, 31 insertions(+), 3 deletions(-) diff --git a/content/en/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md b/content/en/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md index 1f9354d405..426da6910c 100644 --- a/content/en/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md +++ b/content/en/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md @@ -19,10 +19,10 @@ For information how to create a cluster with kubeadm once you have performed thi * One or more machines running one of: - Ubuntu 16.04+ - - Debian 9 + - Debian 9+ - CentOS 7 - - RHEL 7 - - Fedora 25/26 (best-effort) + - Red Hat Enterprise Linux (RHEL) 7 + - Fedora 25+ - HypriotOS v1.0.1+ - Container Linux (tested with 1800.6.0) * 2 GB or more of RAM per machine (any less will leave little room for your apps) @@ -51,6 +51,34 @@ may [fail](https://github.com/kubernetes/kubeadm/issues/31). If you have more than one network adapter, and your Kubernetes components are not reachable on the default route, we recommend you add IP route(s) so Kubernetes cluster addresses go via the appropriate adapter. +## Ensure iptables tooling does not use the nftables backend + +In Linux, nftables is available as a modern replacement for the kernel's iptables subsystem. The +`iptables` tooling can act as a compatibility layer, behaving like iptables but actually configuring +nftables. This nftables backend is not compatible with the current kubeadm packages: it causes duplicated +firewall rules and breaks `kube-proxy`. + +If your system's `iptables` tooling uses the nftables backend, you will need to switch the `iptables` +tooling to 'legacy' mode to avoid these problems. This is the case on at least Debian 10 (Buster), +Ubuntu 19.04, Fedora 29 and newer releases of these distributions by default. RHEL 8 does not support +switching to legacy mode, and is therefore incompatible with current kubeadm packages. + +{{< tabs name="iptables_legacy" >}} +{{% tab name="Debian or Ubuntu" %}} +```bash +update-alternatives --set iptables /usr/sbin/iptables-legacy +update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy +update-alternatives --set arptables /usr/sbin/arptables-legacy +update-alternatives --set ebtables /usr/sbin/ebtables-legacy +``` +{{% /tab %}} +{{% tab name="Fedora" %}} +```bash +update-alternatives --set iptables /usr/sbin/iptables-legacy +``` +{{% /tab %}} +{{< /tabs >}} + ## Check required ports ### Control-plane node(s)