projectcalico/calico

Calico node check includes false negatives for modern Linux distros

Fermée

#4 288 ouverte le 4 janv. 2021

 (8 commentaires) (6 réactions) (0 personne assignée)Go (1 594 forks)auto 404
good first issuehelp wantedimpact/lowkind/buglikelihood/hightriage/eternal

Métriques du dépôt

Stars
 (7 292 étoiles)
Métriques de merge PR
 (Métriques PR en attente)

Description

Expected Behavior

Expect Calico node check to not return an error if the OS supports all the features it needs.

Current Behavior

calicoctl node checksystem fails ipt_set, xt_icmp, xt_icmp6, and xt_rpfilter checks.

# calicoctl node checksystem  
Checking kernel version...
5.4.83-flatcar      OK
Checking kernel modules...
ip_set              OK
ip_tables           OK
ip6_tables          OK
ipt_REJECT          OK
ipt_rpfilter        OK
WARNING: Unable to detect the ipt_set module as Loaded/Builtin module or lsmod
ipt_set             FAIL
nf_conntrack_netlink OK
xt_addrtype         OK
xt_conntrack        OK
WARNING: Unable to detect the xt_icmp module as Loaded/Builtin module or lsmod
xt_icmp             FAIL
WARNING: Unable to detect the xt_icmp6 module as Loaded/Builtin module or lsmod
xt_icmp6            FAIL
xt_ipvs             OK
xt_mark             OK
xt_multiport        OK
WARNING: Unable to detect the xt_rpfilter module as Loaded/Builtin module or lsmod
xt_rpfilter         FAIL
xt_set              OK
xt_u32              OK
System doesn't meet one or more minimum systems requirements to run Calico

Possible Solution

Update node check logic. If the "ipt_set" module is built-in (as is the case with Flatcar and likely these other distros too), then "sudo modprobe ipt_set" is a no-op and it does not show up in "lsmod | grep ipt_set" We believe the checks for "xt_icmp", "xt_icmp6", and "xt_rpfilter" are outdated as those modules don't exist / aren't available in Flatcar, Debian or Fedora. Alternate methods of testing for the presence of required features should be used, or the tests removed, or at a minimum the summary text changed to indicate that the results do not necessarily mean minimum system requirements are not met.

Steps to Reproduce (for bugs)

  1. install Calico on latest Flatcar, Ubuntu, Fedora, or Debian
  2. run calicoctl noode checksystem
  3. observe output

Context

Impacted a Flatcar user that was trying to deploy Calico. Has also been reported by kubespray users - see https://github.com/kubernetes-sigs/kubespray/issues/6289

Your Environment

  • Calico version: 3.16
  • Orchestrator version (e.g. kubernetes, mesos, rkt): Kubernetes
  • Operating System and version: Flatcar 2605 (also present on Ubuntu 18.04 and others)

Guide contributeur