On 3/20/25 10:05, Phil Sutter wrote: > IMO we should at least include the builtin 'flush ruleset' Boooo! In kubernetes, kube-proxy's iptables mode polls the iptables rules once every 30 seconds to make sure that the admin didn't do "systemctl restart iptables" or "firewall-cmd --restart" and COMPLETELY BREAK KUBERNETES[1]. The kube-proxy nftables mode *doesn't* currently do this, because it assumes nobody would be so rude as to flush the entire nft ruleset rather than only deleting and recreating their own table...[2] (If the nftables "owner" flag thwarts "flush ruleset", then that's definitely *better*, though that flag is still too new to help very much.) Once upon a time, it was reasonable for the system firewall scripts to assume that they were the only users of netfilter on the system, but that is not the world we live in any more. Sure, *most* Linux users aren't running Kubernetes, but many people run hypervisors, or docker/podman, or other things that create a handful of dynamic iptables/nftables rules, and then expect those rules to not suddenly disappear for no apparent reason later. If you're going to have a static nftables ruleset thing, please restrict it to a single table, and never ever ever do "flush ruleset". -- Dan [1] https://github.com/kubernetes/kubernetes/blob/v1.31.7/pkg/util/iptables/iptables.go#L80-L90 [2] https://github.com/kubernetes/enhancements/blob/master/keps/sig-network/3866-nftables-proxy/README.md?plain=1#L1274-L1296
