Re: [PATCH] tools: add a systemd unit for static rulesets

[Dan Winship <danwinship@redhat.com>]

On 3/20/25 10:05, Phil Sutter wrote:
> IMO we should at least include the builtin 'flush ruleset'

Boooo!

In kubernetes, kube-proxy's iptables mode polls the iptables rules once
every 30 seconds to make sure that the admin didn't do "systemctl
restart iptables" or "firewall-cmd --restart" and COMPLETELY BREAK
KUBERNETES[1]. The kube-proxy nftables mode *doesn't* currently do this,
because it assumes nobody would be so rude as to flush the entire nft
ruleset rather than only deleting and recreating their own table...[2]

(If the nftables "owner" flag thwarts "flush ruleset", then that's
definitely *better*, though that flag is still too new to help very much.)

Once upon a time, it was reasonable for the system firewall scripts to
assume that they were the only users of netfilter on the system, but
that is not the world we live in any more. Sure, *most* Linux users
aren't running Kubernetes, but many people run hypervisors, or
docker/podman, or other things that create a handful of dynamic
iptables/nftables rules, and then expect those rules to not suddenly
disappear for no apparent reason later.

If you're going to have a static nftables ruleset thing, please restrict
it to a single table, and never ever ever do "flush ruleset".

-- Dan

[1]
https://github.com/kubernetes/kubernetes/blob/v1.31.7/pkg/util/iptables/iptables.go#L80-L90
[2]
https://github.com/kubernetes/enhancements/blob/master/keps/sig-network/3866-nftables-proxy/README.md?plain=1#L1274-L1296