Re: [PATCH] tools: add a systemd unit for static rulesets

[Phil Sutter <phil@nwl.cc>]

On Mon, Mar 24, 2025 at 09:34:26PM -0400, Dan Winship wrote:
> On 3/20/25 10:05, Phil Sutter wrote:
> > IMO we should at least include the builtin 'flush ruleset'
> 
> Boooo!

Hi Dan!

> In kubernetes, kube-proxy's iptables mode polls the iptables rules once
> every 30 seconds to make sure that the admin didn't do "systemctl
> restart iptables" or "firewall-cmd --restart" and COMPLETELY BREAK
> KUBERNETES[1]. The kube-proxy nftables mode *doesn't* currently do this,
> because it assumes nobody would be so rude as to flush the entire nft
> ruleset rather than only deleting and recreating their own table...[2]

The suggested 'flush ruleset' stems from Fedora's nftables.service and
is also present in CentOS Stream and RHEL. So anyone running k8s there
either doesn't use nftables.service (likely, firewalld is default) or
doesn't restart the service. Maybe k8s should "officially" conflict with
nftables and iptables services?

> (If the nftables "owner" flag thwarts "flush ruleset", then that's
> definitely *better*, though that flag is still too new to help very much.)

Yes, "owned" tables may only be manipulated by their owner. Firewalld
will use it as well, for the same reason as k8s.

> Once upon a time, it was reasonable for the system firewall scripts to
> assume that they were the only users of netfilter on the system, but
> that is not the world we live in any more. Sure, *most* Linux users
> aren't running Kubernetes, but many people run hypervisors, or
> docker/podman, or other things that create a handful of dynamic
> iptables/nftables rules, and then expect those rules to not suddenly
> disappear for no apparent reason later.

The question is whether the nftables and iptables services are meant for
the world we live in now. At least with iptables, it is very hard not to
stomp on others' feet when restarting. With nftables, we could cache the
'add table' commands for use later when stopping the service. There is
margin for error though since the added table may well exist already.

> If you're going to have a static nftables ruleset thing, please restrict
> it to a single table, and never ever ever do "flush ruleset".

Cheers, Phil