Switching from iptables-legacy to iptables-nft

[nickmhankins]

I'm running into issues switching from iptables-legacy on our AlmaLinux 9.4 nodes running weave in Kubernetes. Setting update-alternatives to use iptables-nft on the host (or just uninstalling legacy) and then rebooting the node still shows the weave-kube pod trying to launch with iptables-legacy even though the host is no longer using it:

Host:

iptables -V
iptables v1.8.10 (nf_tables)

Pod:

❯ kubectl logs weave-net-vpbk4
Defaulted container "weave" out of: weave, weave-npc
iptables v1.8.10 (legacy): can't initialize iptables table `filter': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.

I've tried removing weave related items from the host that are getting mounted into the container in the hopes it would trigger some sort or re-initialization, am I just missing a step?

[rajch]

There is currently a problem detecting iptables-nft and using it instead of iptables-legacy, also reported in a different context in #15.

You could manually specify the iptables-nft backend by running:

$ kubectl apply -f "https://reweave.azurewebsites.net/k8s/v1.28/net.yaml?env.IPTABLES_BACKEND=nft"

[nickmhankins]

Yeah I tried that as well but get the same error, weird!

[rajch]

That is weird. Could you share a full log of any weave pod, please? Particularly the first 15 or so lines.

[rajch]

I have created an interim release which tries to solve that and a related problem, and tested it the best i can. I am in the middle of a move to a different city, so currently my test matrix is limited to debian, alpine and rocky Linux only. Could you do me a solid, and apply that on your Alma cluster? It will not change any settings, just use the iptables-nft backend, and can be rolled back or forward later. You can do it with:

$ kubectl apply -f "https://reweave.azurewebsites.net/k8s/v1.28/net.yaml?version=2.9.0-beta1"

[rajch]

A new release is out: v2.9.0. Upgrading to this should solve your problem. I'll keep the issue open for now.

[nickmhankins]

More than happy to help but I won't be back to work for a few more days. I'll update once I've tried it.