Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1645143

Summary: iptables-restore on RHEL 7.6 and OCP doesn't work properly
Product: OpenShift Container Platform Reporter: Vladislav Walek <vwalek>
Component: NetworkingAssignee: Casey Callendrello <cdc>
Networking sub component: openshift-sdn QA Contact: zhaozhanqi <zzhao>
Status: CLOSED ERRATA Docs Contact:
Severity: medium    
Priority: unspecified CC: aos-bugs, bbennett, huirwang, jokerman, lxia, mmccomas, mszczewski, wmeng
Version: 3.9.0   
Target Milestone: ---   
Target Release: 3.9.z   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-06 06:56:05 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Vladislav Walek 2018-11-01 13:35:36 UTC 
Description of problem:

with the release of RHEL 7.6 there is new version of the iptables 1.4.21-28.el7, which requires the iptables-restore to be executed with -w5 (no space between w and 5).
As the kubernetes in 3.9, 3.10 and 3.11 is using the option "-w 5" it breaks the iptables-restore command.
Possible fix in:
https://github.com/kubernetes/kubernetes/pull/59181
https://github.com/kubernetes/kubernetes/issues/58956

However, when running the man or the command, it works with "-w 5" on RHEL 7.6.

Version-Release number of selected component (if applicable):
OpenShift Container Platform 3.9

How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:
The workaround would be to downgrade to the previous version of iptables
Comment 1 Ben Bennett 2019-01-17 18:42:52 UTC 
Fixed in commit https://github.com/openshift/ose/commit/6fece4255b5346477eae3351ce350fced3692ccf
PR https://github.com/openshift/origin/pull/18925/files
Comment 2 Meng Bo 2019-01-22 07:31:53 UTC 
Tested on 3.9.64
The iptables version is iptables-1.4.21-28.el7.x86_64 on the nodes.

There is no iptables restore errors
Comment 4 errata-xmlrpc 2019-06-06 06:56:05 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:0788