mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-17 05:31:16 +08:00
Evan Lezar
a7ebf3a6bf
Three issues prevent k3s from starting on kernels where the nf_tables xt extension bridge (nft_compat) is unavailable: 1. kube-router's network policy controller uses the xt_comment iptables extension and panics on startup with "Extension comment revision 0 not supported, missing kernel module?" Pass --disable-network-policy to k3s so the controller never runs. The NSSH1 HMAC handshake remains the primary sandbox SSH isolation boundary, so this does not weaken the effective security posture. 2. flannel and kube-proxy also fail to insert rules via the nf_tables iptables backend on the same kernels. Add an xt_comment probe at cluster-entrypoint startup; if the probe fails, switch to iptables-legacy via update-alternatives before any other netfilter work so that flannel, kube-proxy, and the DNS proxy all use a consistent backend. 3. The br_netfilter kernel module must be loaded on the host for iptables rules to apply to pod bridge traffic. Without it, ClusterIP DNAT (including kube-dns at 10.43.0.10) is never applied to pod packets, causing silent DNS timeouts deep in the health-check loop. Add an early check that fails fast with an actionable error message if the module is not present, instructing the user to run `sudo modprobe br_netfilter` on the host. Signed-off-by: Evan Lezar <elezar@nvidia.com>