kubeadm-centos-iptables (#5707)

docs/setup/independent/install-kubeadm.md

@@ -167,10 +167,18 @@ yum install -y kubelet kubeadm kubectl
 systemctl enable kubelet && systemctl start kubelet
 ```
 
-**Note:** Disabling SELinux by running `setenforce 0` is required to allow
-containers to access the host filesystem, which is required for the `kubeadm init`
-process to complete successfully. You have to do this until SELinux support
-is improved.
+  **Note:**
+
+  - Disabling SELinux by running `setenforce 0` is required to allow containers to access the host filesystem, which is required by pod networks for example. You have to do this until SELinux support is improved in the kubelet.
+  - Some users on RHEL/CentOS 7 have reported issues with traffic being routed incorrectly due to iptables being bypassed. You should ensure `net.bridge.bridge-nf-call-iptables` is set to 1 in your `sysctl` config, e.g.
+  
+    ``` bash
+    cat <<EOF >  /etc/sysctl.d/k8s.conf
+    net.bridge.bridge-nf-call-ip6tables = 1
+    net.bridge.bridge-nf-call-iptables = 1
+    EOF
+    sysctl --system
+    ```
 
 {% endcapture %}