4

I am following this guide of installing kubernetes with kubeadm, and as part of the installation process, I need to set the following kernel parameters in sysctl.d/99-kuvernetes-cni.conf:

net.bridge.bridge-nf-call-iptables=1
net.bridge.bridge-nf-call-ip6tables=1

I know that these belong to the br_netfilter module, since I can only see them with sysctl -a after loading this module.

But what are they all about? Are they really necessary for running kubernetes?

2 Answers 2

5

These parameters determine whether packets crossing a bridge are sent to iptables for processing. Most Kubernetes CNIs rely on iptables, so this is usually necessary for Kubernetes.

The in-kernel default is to enable these settings, but many distributions disable them (see the previous link for details).

6
  • thanks for the answer. This article actually says that this is usually not a desirable configuration. Can you explain why it is needed in the context of kubernetes?
    – YoavKlein
    Oct 7, 2022 at 7:29
  • Most CNIs rely on iptables rules for at least some of their packet processing, and because they handle the container network, they need to handle bridged packets. If bridged packets aren’t sent through iptables, they aren’t processed as expected by the CNI. Oct 7, 2022 at 10:25
  • By "bridged packets" you mean packets that go from one interface on the bridge to another interface on the bridge, or even from an interface on the bridge to outside of the system (or the other way around)?
    – YoavKlein
    Oct 7, 2022 at 12:26
  • Yes, that’s right. Oct 7, 2022 at 14:14
  • That wasn't a yes/no question :)
    – YoavKlein
    Oct 8, 2022 at 18:56
0

It seems with Nftables these parameters are not used anymore: https://netdevconf.info/1.1/proceedings/papers/Bridge-filter-with-nftables.pdf

1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .