backport: Disable iptables bridge forwarding on initialization

[mingshuoqiu]

(cherry picked from commit 6521629)
Signed-off-by: Chris Chiu chris.chiu@suse.com

Problem:
In the Harvester cluster whose management network has a VLAN ID, the VM will be unable to access the host port or node port with the host IP where the VM is running.

Solution:
Disable net.bridge.bridge-nf-call-iptables to avoid iptables rules affecting bridge forwarding on vlan.init().

We could not disable net.bridge.bridge-nf-call-iptables in the harvester-installer because RKE2 will enable it after harvester-installer.

Related Issue:
harvester/harvester#3960

Test plan:

• Spin up a Harvester whose management network has a VLAN ID
• Create a VM with VLAN network whose VLAN ID is same with the management network.
• Curl nodeIP:443 in the VM.

[rrajendran17]

@mingshuoqiu I see iptables are disabled by default in the harvester node.Am I missing something ?
renuka-v131-dev:~ # sysctl -a | grep iptable
net.bridge.bridge-nf-call-iptables = 0

[mingshuoqiu]

@mingshuoqiu I see iptables are disabled by default in the harvester node.Am I missing something ? renuka-v131-dev:~ # sysctl -a | grep iptable net.bridge.bridge-nf-call-iptables = 0

It is 1 if no secondary guest network created.

[starbops]

Yes, it'll be turned off once there a new ClusterNetwork and VlanConfig created.

network-controller-harvester/pkg/network/iface/bridge.go

Line 34 in 7384dcc

if err := disableBridgeNF(); err != nil {

[starbops]

LGTM, thanks.

[rrajendran17]

Is this a specific case of mgmt network in custom vlan ? who is the caller of init() ?

[mingshuoqiu]

@rrajendran17 I installed Harvester 1.3.2-rc2 on a new machine w/o any config file, the net.bridge.bridge-nf-call-iptables is still. We still need this patch to disable it by default.

[rrajendran17]

Sure then, Thanks. LGTM