From 90d2c5ca5a892b6cdd20d84f80e5bf83840bc50a Mon Sep 17 00:00:00 2001 From: Timo Derstappen Date: Sat, 3 Nov 2018 11:36:14 +0100 Subject: [PATCH] flush iptable chains first and then remove them while cleaning up ipvs mode. flushing iptable chains first and then remove the chains. this avoids trying to remove chains that are still referenced by rules in other chains. fixes #70615 --- pkg/proxy/ipvs/proxier.go | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/pkg/proxy/ipvs/proxier.go b/pkg/proxy/ipvs/proxier.go index cfce9bb508..20097227fb 100644 --- a/pkg/proxy/ipvs/proxier.go +++ b/pkg/proxy/ipvs/proxier.go @@ -551,7 +551,7 @@ func cleanupIptablesLeftovers(ipt utiliptables.Interface) (encounteredError bool } } - // Flush and remove all of our chains. + // Flush and remove all of our chains. Flushing all chains before removing them also removes all links between chains first. for _, ch := range iptablesChains { if err := ipt.FlushChain(ch.table, ch.chain); err != nil { if !utiliptables.IsNotFoundError(err) { @@ -559,6 +559,10 @@ func cleanupIptablesLeftovers(ipt utiliptables.Interface) (encounteredError bool encounteredError = true } } + } + + // Remove all of our chains. + for _, ch := range iptablesChains { if err := ipt.DeleteChain(ch.table, ch.chain); err != nil { if !utiliptables.IsNotFoundError(err) { glog.Errorf("Error removing iptables rules in ipvs proxier: %v", err)