Fix net.bridge setting for Flannel on CentOS 7

[bittopaz]

Please refer to flannel-io/flannel#902 for details.

TL;DR

Running Flannel with iptables mode on CentOS 7 needs to have sysctl setting as below:

net.bridge.bridge-nf-call-ip6tables=1
net.bridge.bridge-nf-call-iptables=1

I have tested this change, and it did solve my problem.

[k8s-ci-robot]

Hi @bittopaz. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[joshbranham]

/ok-to-test

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[bittopaz]

I guess this is still relevant, but hope there is someone else could help to verify this change.

[justinsb]

Thanks so much for this @bittopaz . I speculate this is actually related to the problems we're seeing generally with flannel / calico on rhel (see #8614 , flannel-io/flannel#1282 and https://groups.google.com/forum/#!msg/kubernetes-sig-network/JxkTLd4M8WM/EW8O1E0PAgAJ ).

I'm trying to get flannel tests going on "every distro" here kubernetes/test-infra#17300

Then I'm hoping that shows that centos 7 is not working, and then we can merge this (and probably also broaden it to rhel7).

[justinsb]

/remove-lifecycle stale

[justinsb]

Got the grid test in (thanks @rifelpet and @hakman for lgtms), but I used an ami id for centos7 where I should have used the name. kubernetes/test-infra#17308 should hopefully get centos7 running the tests (and failing). rhel7 is failing the tests also in a reassuring fashion, so I hope:

• we get centos7 + flannel failing networking tests (after kops grid tests: use image name to refer to centos7 test-infra#17308)
• we apply this PR
• at the next run, centos7 + flannel passes
• we then expand this change to cover rhel7 as well
• at the next run, rhel7 + flannel passes

🤞

[justinsb]

The test grid is indeed now showing errors that look to be networking related: https://testgrid.k8s.io/sig-cluster-lifecycle-kops#kops-grid-aws-flannel-centos7

/approve
/lgtm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bittopaz, justinsb

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [justinsb]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment