kubernetes
diff --git a/‎nodeup/pkg/model/firewall.go‎
Lines changed: 23 additions & 0 deletions b/‎nodeup/pkg/model/firewall.go‎
Lines changed: 23 additions & 0 deletions
diff --git a/‎upup/pkg/fi/nodeup/command.go‎
Lines changed: 9 additions & 3 deletions b/‎upup/pkg/fi/nodeup/command.go‎
Lines changed: 9 additions & 3 deletions
@@ -36,6 +36,29 @@ func (b *FirewallBuilder) Build(c *fi.NodeupModelBuilderContext) error {
 	c.AddTask(b.buildFirewallScript())
 	c.AddTask(b.buildSystemdService())
 
+	// On distros where Kubernetes CNIs (notably Calico) document firewalld
+	// as incompatible, stop and mask it. firewalld's default-reject
+	// filter_INPUT/filter_FORWARD policies and periodic-reload behavior
+	// conflict with the iptables/nftables rules CNIs install for pod and
+	// service traffic. Most cloud images in the RHEL family already ship
+	// firewalld off (AWS RHEL/Rocky AMIs, upstream Rocky GenericCloud); the
+	// GCE-optimized Rocky 10 image is the known outlier. The disable/mask
+	// sequence is idempotent and a no-op where firewalld isn't installed.
+	// See: https://docs.tigera.io/calico/latest/getting-started/kubernetes/requirements
+	if b.Distribution.ForceNftables() {
+		c.AddTask(&nodetasks.File{
+			Path:     "/etc/kops/firewalld-disabled",
+			Contents: fi.NewStringResource("# Marker: firewalld disabled by kops to avoid conflicts with the Kubernetes CNI dataplane.\n"),
+			Type:     nodetasks.FileType_File,
+			OnChangeExecute: [][]string{
+				// Stop and disable so it can't restart at boot.
+				{"bash", "-c", "systemctl disable --now firewalld.service 2>/dev/null; true"},
+				// Mask so package updates or preset reloads can't bring it back.
+				{"bash", "-c", "systemctl mask firewalld.service 2>/dev/null; true"},
+			},
+		})
+	}
+
 	return nil
 }
 
 
@@ -565,9 +565,15 @@ func loadKernelModules(context *model.NodeupModelContext, distribution distribut
 		}
 	}
 	if distribution.ForceNftables() {
-		// Distributions like RHEL10+ use nftables exclusively
-		// Load nf_tables and nf_conntrack to fix CNI plugins that use iptables-nft
-		for _, mod := range []string{"nf_tables", "nf_conntrack"} {
+		// Distributions like RHEL10+ use nftables exclusively.
+		// - nf_tables / nf_conntrack: required by CNI plugins that shell out
+		//   to iptables-nft.
+		// - ip_set: Calico's Felix unconditionally starts an `ipsetsManager`
+		//   that shells out to `ipset list -name` during dataplane resync,
+		//   even when NFTablesMode=Enabled. On RHEL10 family kernels the
+		//   ip_set module isn't auto-loaded, so the ipset call returns
+		//   EINVAL and Felix panics, crashlooping calico-node.
+		for _, mod := range []string{"nf_tables", "nf_conntrack", "ip_set"} {
 			if err := modprobe(mod); err != nil {
 				klog.Warningf("error loading %s module: %v", mod, err)
 			}
Original file line number	Diff line number	Diff line change
`@@ -565,9 +565,15 @@ func loadKernelModules(context *model.NodeupModelContext, distribution distribut`
`565`	`565`	`}`
`566`	`566`	`}`
`567`	`567`	`if distribution.ForceNftables() {`
`568`		`- // Distributions like RHEL10+ use nftables exclusively`
`569`		`- // Load nf_tables and nf_conntrack to fix CNI plugins that use iptables-nft`
`570`		`- for _, mod := range []string{"nf_tables", "nf_conntrack"} {`
	`568`	`+ // Distributions like RHEL10+ use nftables exclusively.`
	`569`	`+ // - nf_tables / nf_conntrack: required by CNI plugins that shell out`
	`570`	`+ // to iptables-nft.`
	`571`	+ // - ip_set: Calico's Felix unconditionally starts an `ipsetsManager`
	`572`	+ // that shells out to `ipset list -name` during dataplane resync,
	`573`	`+ // even when NFTablesMode=Enabled. On RHEL10 family kernels the`
	`574`	`+ // ip_set module isn't auto-loaded, so the ipset call returns`
	`575`	`+ // EINVAL and Felix panics, crashlooping calico-node.`
	`576`	`+ for _, mod := range []string{"nf_tables", "nf_conntrack", "ip_set"} {`
`571`	`577`	`if err := modprobe(mod); err != nil {`
`572`	`578`	`klog.Warningf("error loading %s module: %v", mod, err)`
`573`	`579`	`}`