kube-router duplicates rules in the KUBE-ROUTER-INPUT chain about kube-router HOT 3 CLOSED

Thanks for reporting this @TPXP!

I haven't seen this in any of my clusters, but I'll be taking a look as soon as I have a free moment to see if I can figure out what might be causing this.

In the meantime, if you get any more information that might be helpful, please add more comments.

from kube-router.

@TPXP - So after being a bit more observant, I can now say that I definitely see this happening in my own clusters as well.

Thanks for reporting it! This is a very serious problem, so I'm glad that you took the time.

From what I can tell, it looks like the Exists() function is no longer working. Behind the scenes that calls the iptables check option -C.

When I try to execute this even from within the kube-router pod, it looks like it is failing:

root@kube-router-vm2:~ #iptables-save | grep "allow traffic to load balancer IP range: 10.243.1.0/24" | head -1
-A KUBE-ROUTER-INPUT -d 10.243.1.0/24 -m comment --comment "allow traffic to load balancer IP range: 10.243.1.0/24 - GNMUGXUVWPZFLO4Q" -j RETURN
root@kube-router-vm2:~ #iptables -t filter -C KUBE-ROUTER-INPUT -d 10.243.1.0/24 -m comment --comment "allow traffic to load balancer IP range: 10.243.1.0/24 - GNMUGXUVWPZFLO4Q" -j RETURN
iptables: Bad rule (does a matching rule exist in that chain?).

This seems like something is broken upstream in the netfilter code. When I revert to a base image of Alpine 3.18 which carries with it iptables v1.8.9 instead of v1.8.10 it looks like this problem no longer occurs:

root@kube-router-vm2:~ #iptables-save | grep "allow traffic to load balancer IP range: 10.243.1.0/24" | head -1
-A KUBE-ROUTER-INPUT -d 10.243.1.0/24 -m comment --comment "allow traffic to load balancer IP range: 10.243.1.0/24 - GNMUGXUVWPZFLO4Q" -j RETURN
root@kube-router-vm2:~ #iptables -t filter -C KUBE-ROUTER-INPUT -d 10.243.1.0/24 -m comment --comment "allow traffic to load balancer IP range: 10.243.1.0/24 - GNMUGXUVWPZFLO4Q" -j RETURN
root@kube-router-vm2:~ #echo $?
0

I want to see if we're able to get to the bottom of this, but in the meantime, I think that we should revert the alpine version bump and see if we can get a stable version of kube-router out there.

from kube-router.

This will be fixed in v2.1.3 which should be pushed later today.

from kube-router.