Calico node check includes false negatives for modern Linux distros
#4 288 ouverte le 4 janv. 2021
Métriques du dépôt
- Stars
- (7 292 étoiles)
- Métriques de merge PR
- (Métriques PR en attente)
Description
Expected Behavior
Expect Calico node check to not return an error if the OS supports all the features it needs.
Current Behavior
calicoctl node checksystem fails ipt_set, xt_icmp, xt_icmp6, and xt_rpfilter checks.
# calicoctl node checksystem
Checking kernel version...
5.4.83-flatcar OK
Checking kernel modules...
ip_set OK
ip_tables OK
ip6_tables OK
ipt_REJECT OK
ipt_rpfilter OK
WARNING: Unable to detect the ipt_set module as Loaded/Builtin module or lsmod
ipt_set FAIL
nf_conntrack_netlink OK
xt_addrtype OK
xt_conntrack OK
WARNING: Unable to detect the xt_icmp module as Loaded/Builtin module or lsmod
xt_icmp FAIL
WARNING: Unable to detect the xt_icmp6 module as Loaded/Builtin module or lsmod
xt_icmp6 FAIL
xt_ipvs OK
xt_mark OK
xt_multiport OK
WARNING: Unable to detect the xt_rpfilter module as Loaded/Builtin module or lsmod
xt_rpfilter FAIL
xt_set OK
xt_u32 OK
System doesn't meet one or more minimum systems requirements to run Calico
Possible Solution
Update node check logic. If the "ipt_set" module is built-in (as is the case with Flatcar and likely these other distros too), then "sudo modprobe ipt_set" is a no-op and it does not show up in "lsmod | grep ipt_set" We believe the checks for "xt_icmp", "xt_icmp6", and "xt_rpfilter" are outdated as those modules don't exist / aren't available in Flatcar, Debian or Fedora. Alternate methods of testing for the presence of required features should be used, or the tests removed, or at a minimum the summary text changed to indicate that the results do not necessarily mean minimum system requirements are not met.
Steps to Reproduce (for bugs)
- install Calico on latest Flatcar, Ubuntu, Fedora, or Debian
- run calicoctl noode checksystem
- observe output
Context
Impacted a Flatcar user that was trying to deploy Calico. Has also been reported by kubespray users - see https://github.com/kubernetes-sigs/kubespray/issues/6289
Your Environment
- Calico version: 3.16
- Orchestrator version (e.g. kubernetes, mesos, rkt): Kubernetes
- Operating System and version: Flatcar 2605 (also present on Ubuntu 18.04 and others)