kube-dns restarts frequently，using kubeadm v1.6.0-alpha.0.2074

[qsfang]

Seems that kube-dns is extremely unstable ,always CrashLoopBackOff, what could be the problem?

[pires]

Most probably caused by #102.

[tristanz]

We saw this on on earlier release (have not tested 1.6) and it seemed to be related to liveness check failure due to low CPU limits causing timeouts.

[qsfang]

Problem is liveness check failure, forgot to set net/bridge/bridge-nf-call-iptables=1, which must be set for cni network , details in http://kubernetes.io/docs/admin/network-plugins/#network-plugin-requirements

[luxas]

Oh, yeah. We should probably check for absence of bridge-nf-call-iptables and fail fast w/ preflight checks if it is not set. Hadn't thought of that before but that'd probably help some users.

…

On 06 Jan 2017, at 08:35, Fang Qiusheng ***@***.***> wrote: Problem is liveness check failure, forgot to set net/bridge/bridge-nf-call-iptables=1, which must be set for cni network , details in http://kubernetes.io/docs/admin/network-plugins/#network-plugin-requirements — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or mute the thread.

[pires]

@dmmcquay you're the preflight checks man. Can you take care of this?

[dmmcquay]

@pires and @luxas I'll take a look at this one.

[bjornl]

@fangqiusheng What Linux distribution?

[qsfang]

CentOS 7.2 qiusheng fang mail：[email protected] 发件人： Björn 发送时间： 2017-01-09 23:46 收件人： kubernetes/kubeadm 抄送： Fang Qiusheng; Mention 主题： Re: [kubernetes/kubeadm] kube-dns restarts frequently，using kubeadm v1.6.0-alpha.0.2074 (#99) @fangqiusheng What Linux distribution? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or mute the thread.

[bjornl]

@fangqiusheng If it is kube-dns that can not communicate to the kube-apiserver I did experience the same problem on CentOS 7.2. I isolated it to the iptables INPUT chain was blocking traffic from pod network to the kube network. I suspect firewalld config by kubeadm may be brokenon CentOS.

If it is the case one can see the API connect failure in the log.

kubectl logs kube-dns-2924299975-pn60c --namespace=kube-system --container=kube-dns

[luxas]

TL;DR; Please set net/bridge/bridge-nf-call-iptables=1 to avoid this.

The fix is in the master branch, so this is now fixed.