Description of problem:

The installer uses the os_firewall to add rules to iptables during upgrades/installations, and that leads under certain circumstances to persist rules that shouldn't be persisted, such as "-A KUBE-SERVICES" or "-A KUBE-SVC-X".

The playbooks calls https://github.com/openshift/openshift-ansible/blob/release-3.11/roles/openshift_node/tasks/firewall.yml#L5-L11

This initializes the module, which saves the current iptables rules in https://github.com/openshift/openshift-ansible/blob/release-3.11/roles/lib_utils/library/os_firewall_manage_iptables.py#L67

This gen_save_cmd saves all the current iptables rules:
~~~
def gen_save_cmd(self):  # pylint: disable=no-self-use
  return ['/usr/libexec/iptables/iptables.init', 'save']
~~~

That could lead to saving iptables rules that shouldn't be saved, as stated earlier, for example:
~~~
-A KUBE-SEP-CNQERSD3TC7SLBPT -s 10.74.178.134/32 -m comment --comment "default/router:80-tcp" -j KUBE-MARK-MASQ
-A KUBE-SEP-CNQERSD3TC7SLBPT -p tcp -m comment --comment "default/router:80-tcp" -m tcp -j DNAT --to-destination 10.74.178.134:80
-A KUBE-SEP-CXODZIVCMSLDI3N7 -s 10.74.178.148/32 -m comment --comment "default/kubernetes:dns" -j KUBE-MARK-MASQ
-A KUBE-SEP-CXODZIVCMSLDI3N7 -p udp -m comment --comment "default/kubernetes:dns" -m udp -j DNAT --to-destination 10.74.178.148:8053
-A KUBE-SERVICES ! -s 10.128.0.0/14 -d 172.30.14.144/32 -p tcp -m comment --comment "default/registry-console:registry-console cluster IP" -m tcp --dport 9000 -j KUBE-MARK-MASQ
-A KUBE-SERVICES -d 172.30.14.144/32 -p tcp -m comment --comment "default/registry-console:registry-console cluster IP" -m tcp --dport 9000 -j KUBE-SVC-DEGCXZMVXZMJS2KL
~~~

Those rules should be dinamically created by the kubelet and never saved in /etc/sysconfig/iptables

Version-Release number of the following components:
All 3.11.X

How reproducible:
Always

Actual results:
Please include the entire output from the last TASK line through the end of output if an error is generated

Expected results: