Aks-engine: Make conntrack more liberal on packets

[jackfrancis]

See:

https://github.com/kubernetes/kubernetes/pull/74840

Let's follow the recommendation here:

https://kubernetes.io/blog/2019/03/29/kube-proxy-subtleties-debugging-an-intermittent-connection-reset/

e.g., echo 1 > /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_be_liberal

[jackfrancis]

@rocketraman FYI

[mboersma]

Note that in Ubuntu 16.04 the kernel param is actually /proc/sys/net/netfilter/nf_conntrack_be_liberal.

[jackfrancis]

Re-opening. The next time we do this we'll need to not do it via /etc/systemd/system/kubelet.service:

root@k8s-agentpool1-30831010-vmss000000:/home/azureuser# systemctl status kubelet
● kubelet.service - Kubelet
   Loaded: loaded (/etc/systemd/system/kubelet.service; enabled; vendor preset: enabled)
   Active: failed (Result: start-limit-hit) since Thu 2019-04-18 18:42:20 UTC; 14min ago
  Process: 1437 ExecStartPre=/sbin/sysctl -w net.netfilter.nf_conntrack_tcp_be_liberal=1 (code=exited, status=255)
  Process: 1434 ExecStartPre=/bin/mount --make-shared /var/lib/kubelet (code=exited, status=0/SUCCESS)
  Process: 1427 ExecStartPre=/bin/bash -c if [ $(mount | grep "/var/lib/kubelet" | wc -l) -le 0 ] ; then /bin/mount --bind /var/lib/kubelet /var/lib/kubelet ; fi (code=exited, statu
  Process: 1425 ExecStartPre=/bin/mkdir -p /var/lib/cni (code=exited, status=0/SUCCESS)
  Process: 1422 ExecStartPre=/bin/mkdir -p /var/lib/kubelet (code=exited, status=0/SUCCESS)
  Process: 1418 ExecStartPre=/bin/bash /opt/azure/containers/kubelet.sh (code=exited, status=0/SUCCESS)

Apr 18 18:42:19 k8s-agentpool1-30831010-vmss000000 systemd[1]: kubelet.service: Unit entered failed state.
Apr 18 18:42:19 k8s-agentpool1-30831010-vmss000000 systemd[1]: kubelet.service: Failed with result 'exit-code'.
Apr 18 18:42:20 k8s-agentpool1-30831010-vmss000000 systemd[1]: kubelet.service: Service hold-off time over, scheduling restart.
Apr 18 18:42:20 k8s-agentpool1-30831010-vmss000000 systemd[1]: Stopped Kubelet.
Apr 18 18:42:20 k8s-agentpool1-30831010-vmss000000 systemd[1]: kubelet.service: Start request repeated too quickly.
Apr 18 18:42:20 k8s-agentpool1-30831010-vmss000000 systemd[1]: Failed to start Kubelet.
Apr 18 18:42:20 k8s-agentpool1-30831010-vmss000000 systemd[1]: kubelet.service: Unit entered failed state.
Apr 18 18:42:20 k8s-agentpool1-30831010-vmss000000 systemd[1]: kubelet.service: Failed with result 'start-limit-hit'.

[vishnukraj1111]

echo 1 > /proc/sys/net/netfilter/nf_conntrack_be_liberal`.

Does enabling this change requires us to restart the docker daemon in the node to take this in effect?

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.