microk8s is sets iptables policy FORWARD to DROP on reboot

[mnbf9rca]

I created a fresh install of ubuntu 18.04 minimal on a vmware esxi 6.7u1 host. i checked iptables -S and got this output (truncated):

-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT

This is consistent, no matter how often i reboot. Then i installed microk8s and all looks fine:

robert@k:~$ sudo snap install microk8s --edge --classic
microk8s (edge) v1.13.1 from Canonical✓ installed
robert@k:~$ sudo iptables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
<trimmed>

However, after a reboot:

robert@k:~$ sudo iptables -S
[sudo] password for robert: 
-P INPUT ACCEPT
-P FORWARD DROP
-P OUTPUT ACCEPT
<trimmed>

I've attached the microk8s.inspect tarball as
inspection-report-20181229_224350.tar.gz

[mnbf9rca]

Adding --iptables=false to /var/snap/microk8s/current/args/dockerd fixes it.

[andyljones]

Nabbed from one of the referencing issues: to fix this on the current session, use sudo iptables -P FORWARD ACCEPT.

[vovapolu]

@mnbf9rca with new version v1.15.1, you don't have dockerd, so this option isn't working anymore. I can't find any solution for containerd to make iptables persistent, maybe do you know one? The sudo iptables -P FORWARD ACCEPT works fine, but only for the current session.

[ktsakalozos]

@vovapolu You should be able to use the iptables-persistent package:

sudo apt-get install iptables-persistent

[vovapolu]

@ktsakalozos Hmm, that's strange, I've installed this package almost at the start, but for some time it didn't work, but now everything is good. Thanks :)

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[bcouetil]

Adding --iptables=false to /var/snap/microk8s/current/args/dockerd fixes it.

Sadly this does not work. Don't know if it's me or anymore. this file does not exist, I created it with the line, and still see DROP upon restarts.

Same for the iptables-persistent package, sadly.

[illja96]

Adding --iptables=false to /var/snap/microk8s/current/args/dockerd fixes it.

This will no longer work cause new version of microk8s use containerd instead of dockerd