match https://github.com/kubernetes-sigs/iptables-wrappers/blob/maste…

[BenTheElder]

…r/iptables-wrapper-installer.sh selection logic

see: #2271 (comment)

this is one of the only deviations in functionality from the wrapper there.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: BenTheElder

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [BenTheElder]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[BenTheElder]

note: since I haven't bumped the base this doesn't change anything in CI, this is just for review. namely @aojea 🙃

[aojea]

yeah, Dan Winship make it work for the case of users that have both rules on the system

[BenTheElder]

the logic we had previously was the same as the source at https://github.com/kubernetes/kubernetes/blob/ffe93b3979486feb41a0f85191bdd189cbd56ccc/build/debian-iptables/iptables-wrapper

but that's changed now in https://github.com/kubernetes-sigs/iptables-wrappers/blob/97b01f43a8e8db07840fc4b95e833a37c0d36b12/iptables-wrapper-installer.sh

I haven't checked yet if kube-proxy was also updated

[BenTheElder]

https://github.com/kubernetes/release/blob/0539f9b737ef056d6007b991bd25b92a8706eb7e/images/build/debian-iptables/buster/iptables-wrapper#L28-L38 it has not been updated in kube-proxy

[aojea]

https://github.com/kubernetes/release/blob/0539f9b737ef056d6007b991bd25b92a8706eb7e/images/build/debian-iptables/buster/iptables-wrapper#L28-L38 it has not been updated in kube-proxy

I wonder if that may explain recent bugs open about kube-proxy delays on endpoints 🤔

[aojea]

@danwinship it seems that there are 2 detection modes:

1. num lines legacy > 10
2. num lines legacy > num lines nft

which one do you think is better?
https://github.com/kubernetes-sigs/iptables-wrappers/blob/97b01f43a8e8db07840fc4b95e833a37c0d36b12/iptables-wrapper-installer.sh#L112-L141

[danwinship]

The version of the script in the iptables-wrappers repo is best. You ideally want to check num lines legacy > num lines nft because that's more accurate, but you don't want to do that if you have the buggy version of iptables-nft that will hang and need to be timed out and killed. So the installer in iptables-wrappers does the good way if you have a good iptables-nft binary, and the less good way if you have a bad binary

[BenTheElder]

I filed kubernetes/release#2106 to correct the kube-proxy base image to the second version, we should be on iptables >= 1.8.5 there so we don't need the bug workaround version.

[BenTheElder]

This PR also updates kind to that variant.

[aojea]

/lgtm

[BenTheElder]

/retest

[aojea]

/test pull-kind-e2e-kubernetes-1-20

[BenTheElder]

we should push new image(s) anyhow
/hold

[k8s-ci-robot]

New changes are detected. LGTM label has been removed.

[BenTheElder]

/retest

[BenTheElder]

need to fix #2313 first

[BenTheElder]

will rebase on #2320

[BenTheElder]

thought we'd be landing other prioritized changes but since we're not yet, rebased this one.
edit: we did land #2320 though, which was pretty critical.

[BenTheElder]

/hold cancel

[BenTheElder]

re-applying as this is just a rebase