Calico: add NFTablesMode setting - #18452
Conversation
Surface Calico's Felix NFTablesMode (Disabled, Enabled, Auto) as a field on CalicoNetworkingSpec and propagate it to the calico-node DaemonSet via FELIX_NFTABLESMODE. When left unset, the upstream Calico chart default applies, preserving existing behavior. On distributions where iptables is only present as a shim over nftables (e.g. RHEL10+, Rocky10+), routing Felix's data plane through iptables-nft / nft_compat has produced BGP session flapping and broken pod networking on GCE. This field lets clusters opt their Calico install into native nftables on those nodes.
|
Skipping CI for Draft Pull Request. |
|
/test pull-kops-e2e-k8s-gce-calico-rocky10 |
2 similar comments
|
/test pull-kops-e2e-k8s-gce-calico-rocky10 |
|
/test pull-kops-e2e-k8s-gce-calico-rocky10 |
|
/test pull-kops-e2e-k8s-gce-calico-rocky10 |
6bca570 to
1c09677
Compare
|
Tests passed with a temporary commit setting this to true: https://prow.k8s.io/view/gs/kubernetes-ci-logs/pr-logs/pull/kops/18452/pull-kops-e2e-k8s-gce-calico-rocky10/2063625185440829440 |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: hakman The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/override pull-kops-e2e-cni-kubenet |
|
@hakman: Overrode contexts on behalf of hakman: pull-kops-e2e-cni-kubenet DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/override pull-kops-e2e-k8s-gce-calico-rocky10 |
|
@hakman: Overrode contexts on behalf of hakman: pull-kops-e2e-k8s-gce-calico-rocky10 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
…52-origin-release-1.35 Automated cherry pick of #18452: Calico: add NFTablesMode setting
Surface Calico's Felix NFTablesMode (Disabled, Enabled, Auto) as a field on CalicoNetworkingSpec and propagate it to the calico-node DaemonSet via FELIX_NFTABLESMODE. When left unset, the upstream Calico chart default applies, preserving existing behavior.
On distributions where iptables is only present as a shim over nftables (e.g. RHEL10+, Rocky10+), routing Felix's data plane through iptables-nft / nft_compat has produced BGP session flapping and broken pod networking on GCE. This field lets clusters opt their Calico install into native nftables on those nodes.