projectcalico/calico
iptablesFilterDenyAction: REJECT -> calio-nodes do not ready
Offen
#7.914 geöffnet am 10.08.2023
help wantedimpact/highkind/buglikelihood/low
Repository-Metriken
- Stars
- (7.292 Sterne)
- PR-Merge-Metriken
- (PR-Metriken ausstehend)
Beschreibung
Steps to Reproduce
set the next FelixConfiguration
apiVersion: crd.projectcalico.org/v1
kind: FelixConfiguration
metadata:
name: default
spec:
awsSrcDstCheck: Disable
bpfEnabled: false
bpfExternalServiceMode: DSR
bpfLogLevel: ""
healthPort: 9099
iptablesBackend: auto
iptablesFilterDenyAction: REJECT
ipv6Support: false
logSeverityScreen: Info
policySyncPathPrefix: /var/run/nodeagent
prometheusMetricsEnabled: true
reportingInterval: 30s
sidecarAccelerationEnabled: true
usageReportingEnabled: false
vxlanEnabled: true
And have logs for calico-node
2023-08-10 02:10:53.946 [WARNING][7475] felix/table.go 1350: Failed to execute ip(6)tables-restore command error=exit status 1 errorOutput="iptables-restore: line 5 failed\n" input="*raw\n-R cali-PREROUTING 4 -m comment --comment \"cali:fGC9ubZRKFY1o1ub\" -m mark --mark 0x40000/0x40000 -m rpfilter --invert --validmark --jump REJECT\n-R cali-PREROUTING 5 -m comment --comment \"cali:gcOAaVjcODGi92n9\" -m mark --mark 0/0x40000 --jump cali-from-host-endpoint\n-R cali-PREROUTING 6 -m comment --comment \"cali:3TJTLNt-nLa-rsup\" -m mark --mark 0x10000/0x10000 --jump ACCEPT\nCOMMIT\n" ipVersion=0x4 output="" table="raw"
Dmesg log on the node
ip_tables: REJECT target: only valid in filter table, not raw
Environment
- Calico version: v3.26.1
- Orchestrator version: EKS v1.24.14
- Operating System and version: ** Amazon Linux 2 kernel 5.10.179-168.710.amzn2.x86_64 ** Ubuntu 20.04.6 LTS kernel 5.15.0-1040-aws, 5.15.0-1039-aws