Calico node check includes false negatives for modern Linux distros
#4,288 opened on Jan 4, 2021
Repository metrics
- Stars
- (7,292 stars)
- PR merge metrics
- (PR metrics pending)
Description
Expected Behavior
Expect Calico node check to not return an error if the OS supports all the features it needs.
Current Behavior
calicoctl node checksystem fails ipt_set, xt_icmp, xt_icmp6, and xt_rpfilter checks.
# calicoctl node checksystem
Checking kernel version...
5.4.83-flatcar OK
Checking kernel modules...
ip_set OK
ip_tables OK
ip6_tables OK
ipt_REJECT OK
ipt_rpfilter OK
WARNING: Unable to detect the ipt_set module as Loaded/Builtin module or lsmod
ipt_set FAIL
nf_conntrack_netlink OK
xt_addrtype OK
xt_conntrack OK
WARNING: Unable to detect the xt_icmp module as Loaded/Builtin module or lsmod
xt_icmp FAIL
WARNING: Unable to detect the xt_icmp6 module as Loaded/Builtin module or lsmod
xt_icmp6 FAIL
xt_ipvs OK
xt_mark OK
xt_multiport OK
WARNING: Unable to detect the xt_rpfilter module as Loaded/Builtin module or lsmod
xt_rpfilter FAIL
xt_set OK
xt_u32 OK
System doesn't meet one or more minimum systems requirements to run Calico
Possible Solution
Update node check logic. If the "ipt_set" module is built-in (as is the case with Flatcar and likely these other distros too), then "sudo modprobe ipt_set" is a no-op and it does not show up in "lsmod | grep ipt_set" We believe the checks for "xt_icmp", "xt_icmp6", and "xt_rpfilter" are outdated as those modules don't exist / aren't available in Flatcar, Debian or Fedora. Alternate methods of testing for the presence of required features should be used, or the tests removed, or at a minimum the summary text changed to indicate that the results do not necessarily mean minimum system requirements are not met.
Steps to Reproduce (for bugs)
- install Calico on latest Flatcar, Ubuntu, Fedora, or Debian
- run calicoctl noode checksystem
- observe output
Context
Impacted a Flatcar user that was trying to deploy Calico. Has also been reported by kubespray users - see https://github.com/kubernetes-sigs/kubespray/issues/6289
Your Environment
- Calico version: 3.16
- Orchestrator version (e.g. kubernetes, mesos, rkt): Kubernetes
- Operating System and version: Flatcar 2605 (also present on Ubuntu 18.04 and others)