Feature Request

What problem are you trying to solve?

The proxy-init container will fail to start if either of the PROXY_INIT_OUTPUT or PROXY_INIT_REDIRECT chains already exist in the iptables rules. When the init container fails to start, the pod goes into a CrashLoopBackOff state.

The scenario where this behavior was discovered is an edge case where a process external to Kubernetes removed the proxy-init image from the node. k8s has its own garbage collection mechanism for images, so when an image is removed outside of that mechanism, k8s will pull the missing image and restart any containers that use the image.

The underlying cause for this behavior is that the logic in iptables.go adds the PROXY_INIT_OUTPUT and PROXY_INIT_REDIRECT chains without checking to see if they exist first.

How should the problem be solved?

Add logic to iptables.go that captures the output from the iptables save command and uses regex to search for the PROXY_INIT_OUTPUT and PROXY_INIT_REDIRECT rules.

If either of them exist, remove them, then allow the existing code to add the rules back in.

Any alternatives you've considered?

1. Do the same check outlined above to see if the rules exist, and if they do, then don't remove them or run the addIncomingTrafficRules and addOutgoingTrafficRules functions. Instead exit 0 and assume that the rules are valid.

The drawback here is that a skipped port could have been added at the namespace level, and those won't be reflected in the iptables rules. I see this being a pretty infrequent or improbable scenario, since updating skipped ports at the namespace level should be followed by restarting the pods.

2. Set restartPolicy: never in the proxy-init PodSpec

I don't know the full ramifications of this, so it could be a really bad idea 😄

How would users interact with this feature?

This would be transparent to users and they won't need any interaction