Sitelet https://github.com/kubernetes/kops/pull/18478/files
Skip to content

nodeup: load ip_set module and disable firewalld on RHEL10 #18478

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
k8s-ci-robot merged 1 commit into from
Jun 18, 2026
Merged

nodeup: load ip_set module and disable firewalld on RHEL10 #18478

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 23 additions & 0 deletions nodeup/pkg/model/firewall.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,29 @@ func (b *FirewallBuilder) Build(c *fi.NodeupModelBuilderContext) error {
c.AddTask(b.buildFirewallScript())
c.AddTask(b.buildSystemdService())

// On distros where Kubernetes CNIs (notably Calico) document firewalld
// as incompatible, stop and mask it. firewalld's default-reject
// filter_INPUT/filter_FORWARD policies and periodic-reload behavior
// conflict with the iptables/nftables rules CNIs install for pod and
// service traffic. Most cloud images in the RHEL family already ship
// firewalld off (AWS RHEL/Rocky AMIs, upstream Rocky GenericCloud); the
// GCE-optimized Rocky 10 image is the known outlier. The disable/mask
// sequence is idempotent and a no-op where firewalld isn't installed.
// See: https://docs.tigera.io/calico/latest/getting-started/kubernetes/requirements
if b.Distribution.ForceNftables() {
c.AddTask(&nodetasks.File{
Path: "/etc/kops/firewalld-disabled",
Contents: fi.NewStringResource("# Marker: firewalld disabled by kops to avoid conflicts with the Kubernetes CNI dataplane.\n"),
Type: nodetasks.FileType_File,
OnChangeExecute: [][]string{
// Stop and disable so it can't restart at boot.
{"bash", "-c", "systemctl disable --now firewalld.service 2>/dev/null; true"},
// Mask so package updates or preset reloads can't bring it back.
{"bash", "-c", "systemctl mask firewalld.service 2>/dev/null; true"},
},
})
}

return nil
}

Expand Down
12 changes: 9 additions & 3 deletions upup/pkg/fi/nodeup/command.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -592,9 +592,15 @@ func loadKernelModules(context *model.NodeupModelContext, distribution distribut
}
}
if distribution.ForceNftables() {
// Distributions like RHEL10+ use nftables exclusively
// Load nf_tables and nf_conntrack to fix CNI plugins that use iptables-nft
for _, mod := range []string{"nf_tables", "nf_conntrack"} {
// Distributions like RHEL10+ use nftables exclusively.
// - nf_tables / nf_conntrack: required by CNI plugins that shell out
// to iptables-nft.
// - ip_set: Calico's Felix unconditionally starts an `ipsetsManager`
// that shells out to `ipset list -name` during dataplane resync,
// even when NFTablesMode=Enabled. On RHEL10 family kernels the
// ip_set module isn't auto-loaded, so the ipset call returns
// EINVAL and Felix panics, crashlooping calico-node.
for _, mod := range []string{"nf_tables", "nf_conntrack", "ip_set"} {
if err := modprobe(mod); err != nil {
klog.Warningf("error loading %s module: %v", mod, err)
}
Expand Down
Loading