From e0205e7c76a3ce885e313f9e7b52eb70d2595686 Mon Sep 17 00:00:00 2001 From: Fabrizio Pandini Date: Sun, 8 Oct 2017 17:09:12 +0200 Subject: [PATCH] kubeadm-centos-iptables (#5707) --- docs/setup/independent/install-kubeadm.md | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/docs/setup/independent/install-kubeadm.md b/docs/setup/independent/install-kubeadm.md index 0f792affe6..368755609c 100644 --- a/docs/setup/independent/install-kubeadm.md +++ b/docs/setup/independent/install-kubeadm.md @@ -167,10 +167,18 @@ yum install -y kubelet kubeadm kubectl systemctl enable kubelet && systemctl start kubelet ``` -**Note:** Disabling SELinux by running `setenforce 0` is required to allow -containers to access the host filesystem, which is required for the `kubeadm init` -process to complete successfully. You have to do this until SELinux support -is improved. + **Note:** + + - Disabling SELinux by running `setenforce 0` is required to allow containers to access the host filesystem, which is required by pod networks for example. You have to do this until SELinux support is improved in the kubelet. + - Some users on RHEL/CentOS 7 have reported issues with traffic being routed incorrectly due to iptables being bypassed. You should ensure `net.bridge.bridge-nf-call-iptables` is set to 1 in your `sysctl` config, e.g. + + ``` bash + cat < /etc/sysctl.d/k8s.conf + net.bridge.bridge-nf-call-ip6tables = 1 + net.bridge.bridge-nf-call-iptables = 1 + EOF + sysctl --system + ``` {% endcapture %}