[release-0.15] Allow smooth upgrades to new kube-proxy with nft #5383
Conversation
The new eks-d version includes the new kube-proxy with support for iptables nft. The old kube-proxy always uses iptables legacy. During an upgrade, when the new machine for the new CP node is started, if the machine has iptables nft as the default, the kubelet will use it. Then, before capi updates the kube-proxy image version in the DS (this doesn't happen until the CP upgrade is finished), the old kube-proxy is scheduled in the node. This old kube-proxy doesn't support nft and always uses iptables legacy. When it starts, it adds legacy iptables rules. However, at this point the kubelet has already added iptables-nft rules. After the CP has been updated, capi updates the kube-proxy DS to the new version. This new version has the new wrapper, which detects the rules introduced by the kubelet, so it starts using nft. The hypothesis is that these leftover legacy rules break the k8s service IP "redirection". This allows a smooth transition by scheduling a DS with the old kube proxy only in the old nodes and schedule a DS with the new kube-proxy only in the new nodes.
|
Hi @eks-distro-pr-bot. Thanks for your PR. I'm waiting for a aws member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
eks-distro-bot
added
needs-ok-to-test
size/XXL
|
/lgtm |
|
With @cxbrowne1207's permission |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: g-gaston The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Codecov Report
@@ Coverage Diff @@
## release-0.15 #5383 +/- ##
===============================================
Coverage ? 72.65%
===============================================
Files ? 441
Lines ? 36660
Branches ? 0
===============================================
Hits ? 26634
Misses ? 8426
Partials ? 1600 Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here. |
|
/retest |
1 similar comment
|
/retest |
This is an automated cherry-pick of #5345
/assign g-gaston