Support for nftables

[mnlipp]

Is your feature request related to a problem? Please describe

I'm using k3s and thus -- as I understand the dependencies -- implicitly kube-router.

I had to upgrade my nodes to AlmaLinux 10 for non-kubernetes related reasons. Now i'm getting lot's of warnings that I'm using a non maintained feature: iptables.

From my understanding k3s requires kube-router to support nftables in order to, well, support nftables (k3s-io/k3s#12849). (Sorry, but I had chosen k3s in order to not needing a deep understanding about all this.)

I have searched and couldn't find anything about an already started effort to make kube-router support nftables.

Describe the solution you'd like

A switch to make kube-router use nftables instead of iptables

Describe alternatives you've considered

As far as I have understood things, I'd have to replace k3s with some other kubernetes distribution or assemble one myself.

Additional context

RHEL 9 will still be supported until 2032. But that's not that far in the future. RHEL 10 is here since about a year and has already had it's first minor update. So I think we'll see more and more new installations using RHEL 10

[aauren]

Hey @mnlipp thanks for reporting this.

It is true, that there has not yet been an effort under way to update to nftables. While not ideal, a nftables rewrite of the iptables logic that kube-router has would be a significant undertaking. the iptables-nft layer that was introduced to help cover for iptables and nftables has proven to work pretty well for us in general.

Its a bummer that RHEL is choosing to remove this. While it wasn't meant to last forever, I did a quick survey of the other distros and it looks like they are the only major distro that I can find that has chosen to take this direct of a stance on removing the backwards compatibility of iptables. As a note, this is a userspace tool that essentially translates iptables commands into nftables. This means that the datapath is essentially the same whether the user uses nft or iptables to create rules. This was a big win for kube-router as it means that we get most efficiencies that are introduced in nftables without having to translate all of our commands and do the hard work of migrating the control path.

One thing that I did notice when I spun up an Alma Linux 10 VM is that RHEL 10 / Alma Linux 10 does include the NFT_COMPAT module as a built module on the system. So while they've removed all of the iptables kernel modules and the user-space tooling that was available in iptables-nft, the real blocker of removing NFT_COMPAT was not done.

This gives us potentially a bit of reprieve as it concerns RHEL 10 / Alma Linux 10 in the interim. If you run kube-router in such a way that it is able to bundle its own user-space tooling (like in a container) then it should still work. Indeed, I noticed that if I run the kube-router container and enter the container and run iptables -L it works fine.

I tried to startup k3s with kube-router, but my install didn't seem to work well.

Can I ask you some additional questions that would help me understand what's going on in your situation:

• How are you installing k3s? This would allow me to reproduce your situation a little better.
• Where are you seeing iptables warnings? When I ran several iptables commands I didn't see any messages anywhere?
• How is kube-router installed with k3s? Is it running as a container inside the k8s cluster that k3s creates? Some other way?
• Do you have a k3s issue that describes this issue to them? It might be helpful to have a collaborative conversation.

[mnlipp]

Its a bummer that RHEL is choosing to remove this.

Well, they set it to deprecated for RHEL 9 and didn't actually remove it from RHEL 10, but its status is "unmaintained", which means that nobody will care if it suddenly stops working due to an upgrade of some other component. (https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.0_release_notes/deprecated_functionality#deprecated-functionality_networking)

Can I ask you some additional questions that would help me understand what's going on in your situation...

• You can still install the package iptables-nft and then you can still install k3s.

• The warning appears on the console when booting.

• Don't ask me, how k3s uses kube-router. I'm using k3s so that I don't have to know this ;-) The problem was mentioned here

[github-actions]

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.

[mnlipp]

/remove stale

[mnlipp]

Okay, no "/remove stale", so comment:I think this should remain open because eventually support for iptables will diminish in the complete chain (tools, kernel).