云原生|kubernetes|解决kube-proxy报错：Not using `--random-fully` in the MASQUERADE rule for iptables

前言：

kubernetes的网络系统主要由kube-proxy负责，其支持iptables和ipvs以及userspace三种网络负载均衡，在更新负载均衡策略为ipvs后，查看kube-proxy的日志，发现如下警告：

Jul 16 09:32:09 k8s-node1 kube-proxy: I0716 09:32:09.536704   7242 proxier.go:1848] \
Not using `--random-fully` in the MASQUERADE rule for iptables because \
the local version of iptables does not support it

可以看出，此警告仅仅是警告，好像不影响kubernetes集群的运行，但本着万一的原则，还是尽量消除此警告。

此警告表示iptables不支持本地升级，也就是iptables的版本过低，查询iptables的版本如下：

暂无，后面补一个

因此，计划升级iptables到1.6.2，现将iptables的升级过程记录下来，以免后面的人踩坑。

一，

安装依赖

配置阿里云epel源（centos7的）：

wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo

yum install gcc make libnftnl-devel libmnl-devel autoconf automake libtool bison flex  libnetfilter_conntrack-devel libnetfilter_queue-devel libpcap-devel

 这里要注意一哈，libmnl-devel，libnftnl-devel等等几个包需要配置epel源才可以安装，如果有依赖没有安装，比如libmnl-devel，那么编译的时候会报错：

    checking for libmnl... no
         *** Error: No suitable libmnl found. ***
        Please install the 'libmnl' package
        Or consider --disable-nftables to skip
        iptables-compat over nftables support.

如果libnetfilter_conntrack-devel没有安装，将会报模块connlabel 没找到。

二，

解压源码包，并进入解压目录，准备编译

wget https://www.netfilter.org/projects/iptables/files/iptables-1.6.2.tar.bz2 --no-check-certificate
tar jxf iptables-1.6.2.tar.bz2
cd iptables-1.6.2
./autogen.sh #此命令输出如下：
#libtoolize: putting auxiliary files in AC_CONFIG_AUX_DIR, `build-aux'.
libtoolize: copying file `build-aux/ltmain.sh'
libtoolize: putting macros in AC_CONFIG_MACRO_DIR, `m4'.
libtoolize: copying file `m4/libtool.m4'
libtoolize: copying file `m4/ltoptions.m4'
libtoolize: copying file `m4/ltsugar.m4'
libtoolize: copying file `m4/ltversion.m4'
libtoolize: copying file `m4/lt~obsolete.m4'

 

三，

开始编译

这里说明一哈，都是使用的默认编译，编译产物在/usr/local/sbin目录下

./configure

输出如下：

config.status: creating include/iptables/internal.h
config.status: creating utils/nfnl_osf.8
config.status: creating config.h
config.status: executing depfiles commands
config.status: executing libtool commands

Iptables Configuration:
  IPv4 support:				yes
  IPv6 support:				yes
  Devel support:			yes
  IPQ support:				no
  Large file support:			yes
  BPF utils support:			no
  nfsynproxy util support:		no
  nftables support:			yes
  connlabel support:			yes

Build parameters:
  Put plugins into executable (static):	no
  Support plugins via dlopen (shared):	yes
  Installation prefix (--prefix):	/usr/local
  Xtables extension directory:		/usr/local/lib/xtables
  Pkg-config directory:			/usr/local/lib/pkgconfig
  Xtables lock file:			/run/xtables.lock
  Host:					x86_64-unknown-linux-gnu
  GCC binary:				gcc

安装：

make && make install

输出如下：

/usr/bin/mkdir -p '/usr/local/share/man/man1'
 /usr/bin/install -c -m 644 iptables-xml.1 '/usr/local/share/man/man1'
 /usr/bin/mkdir -p '/usr/local/share/man/man8'
 /usr/bin/install -c -m 644 iptables.8 iptables-restore.8 iptables-save.8 ip6tables.8 ip6tables-restore.8 ip6tables-save.8 iptables-extensions.8 '/usr/local/share/man/man8'
 /usr/bin/mkdir -p '/usr/local/lib/pkgconfig'
 /usr/bin/install -c -m 644 xtables.pc '/usr/local/lib/pkgconfig'
make[3]: Leaving directory `/root/iptables-1.6.2/iptables'
make[2]: Leaving directory `/root/iptables-1.6.2/iptables'
make[1]: Leaving directory `/root/iptables-1.6.2/iptables'
make[1]: Entering directory `/root/iptables-1.6.2'
make[2]: Entering directory `/root/iptables-1.6.2'
make[2]: Nothing to be done for `install-exec-am'.
 /usr/bin/mkdir -p '/usr/local/etc'
 /usr/bin/install -c -m 644 etc/ethertypes '/usr/local/etc'
make[2]: Leaving directory `/root/iptables-1.6.2'
make[1]: Leaving directory `/root/iptables-1.6.2'

四，

拷贝文件并检测成果

[root@master iptables-1.6.2]# cp /usr/local/sbin/{iptables,iptables-restore,iptables-save} /sbin/
cp: overwrite ‘/sbin/iptables’? y
cp: overwrite ‘/sbin/iptables-restore’? y
cp: overwrite ‘/sbin/iptables-save’? y

[root@master iptables-1.6.2]# lsmod |grep iptable
iptable_mangle         16384  1 
iptable_filter         16384  1 
iptable_nat            16384  1 
nf_nat                 49152  2 iptable_nat,xt_MASQUERADE
ip_tables              28672  3 iptable_filter,iptable_nat,iptable_mangle

重启kubelet和kube-proxy这两个服务，并查看日志，在也没有警告了，完美解决：

systemctl restart kubelet kube-proxy

0926 17:55:30.579345   10995 server_others.go:183] DetectLocalMode: 'ClusterCIDR'
I0926 17:55:30.579358   10995 server_others.go:259] Using ipvs Proxier.
I0926 17:55:30.580050   10995 proxier.go:426] nodeIP: 192.168.217.16, isIPv6: false
I0926 17:55:30.580518   10995 server.go:583] Version: v1.18.3
I0926 17:55:30.581269   10995 conntrack.go:52] Setting nf_conntrack_max to 262144
I0926 17:55:30.581794   10995 config.go:133] Starting endpoints config controller
I0926 17:55:30.581882   10995 shared_informer.go:223] Waiting for caches to sync for endpoints config
I0926 17:55:30.581882   10995 config.go:315] Starting service config controller
I0926 17:55:30.582000   10995 shared_informer.go:223] Waiting for caches to sync for service config
I0926 17:55:30.583390   10995 reflector.go:175] Starting reflector *v1.Service (15m0s) from k8s.io/client-go/informers/factory.go:135
I0926 17:55:30.586917   10995 reflector.go:175] Starting reflector *v1.Endpoints (15m0s) from k8s.io/client-go/informers/factory.go:135
I0926 17:55:30.682204   10995 shared_informer.go:230] Caches are synced for endpoints config
I0926 17:55:30.682313   10995 proxier.go:997] Not syncing ipvs rules until Services and Endpoints have been received from master
I0926 17:55:30.682462   10995 shared_informer.go:230] Caches are synced for service config
I0926 17:55:30.683027   10995 service.go:379] Adding new service port "default/kubernetes:https" at 10.0.0.1:443/TCP
I0926 17:55:30.683152   10995 service.go:379] Adding new service port "kube-system/coredns:dns-tcp" at 10.0.0.2:53/TCP
I0926 17:55:30.683165   10995 service.go:379] Adding new service port "kube-system/coredns:dns" at 10.0.0.2:53/UDP
I0926 17:55:30.683246   10995 proxier.go:1028] Stale udp service kube-system/coredns:dns -> 10.0.0.2