@cchxn258886: This issue is currently awaiting triage.

If a SIG or subproject determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

@Network

you can increase kube-proxy verbosity adding -v7 flag and you should get more information about the cause of the error

Kubernetes 1.17 is EOL, so you should upgrade to 1.19 at least https://kubernetes.io/releases/

/sig network

you can increase kube-proxy verbosity adding -v7 flag and you should get more information about the cause of the error

Kubernetes 1.17 is EOL, so you should upgrade to 1.19 at least https://kubernetes.io/releases/

hello bro。my cluster is use kubeadm init .so what should i do .i know this is use configmap 。but in this i can not found how edit this configmap is available？about upgrade this cluster .this time is impossible。

you can increase kube-proxy verbosity adding -v7 flag and you should get more information about the cause of the error

Kubernetes 1.17 is EOL, so you should upgrade to 1.19 at least https://kubernetes.io/releases/

about stack. i only get this log.

 11:25:38.390292       1 proxier.go:779] Sync failed; retrying in 30s
E0805 11:36:18.240849       1 proxier.go:1507] Failed to execute iptables-restore: exit status 1 (iptables-restore: line 46 failed
)
I0805 11:36:18.240985       1 proxier.go:779] Sync failed; retrying in 30s
W0805 11:45:14.938674       1 server_others.go:323] Unknown proxy mode "", assuming iptables proxy
I0805 11:45:14.951384       1 node.go:135] Successfully retrieved node IP: 10.60.44.71
I0805 11:45:14.951437       1 server_others.go:145] Using iptables Proxier.
I0805 11:45:14.951948       1 server.go:571] Version: v1.17.2
I0805 11:45:14.952618       1 conntrack.go:52] Setting nf_conntrack_max to 655360
I0805 11:45:14.953070       1 config.go:131] Starting endpoints config controller
I0805 11:45:14.953105       1 config.go:313] Starting service config controller
I0805 11:45:14.953143       1 shared_informer.go:197] Waiting for caches to sync for endpoints config
I0805 11:45:14.953144       1 shared_informer.go:197] Waiting for caches to sync for service config
I0805 11:45:15.053346       1 shared_informer.go:204] Caches are synced for endpoints config 
I0805 11:45:15.053355       1 shared_informer.go:204] Caches are synced for service config 
E0805 11:46:53.104982       1 proxier.go:1507] Failed to execute iptables-restore: exit status 1 (iptables-restore: line 47 failed
)

To increase the verbosity on kube-proxy on a kubeadm deployment you can do

 kubectl patch -n kube-system daemonset/kube-proxy \
    --type='json' -p='[{"op": "add", "path": "/spec/template/spec/containers/0/command/-", "value": "--v=7" }]'

and wait until pods are restarted.

Despite that, if there is a bug, it will not be backported to 1.17, so you have to go to a supported version first

I swear we added code to dump the ruleset when this happens, but I don't see it any more.

I'm going to re-purpose this as a feature :)

Hi, I would like to pick this up. Can someone give me some code pointers on where to start?

Let me know if I can help in anyway. @thockin

/assign

I'd start with pkg/util/iptables/iptables.go - restoreInternal()

It's worth thinking about the cleanest solution here, but maybe something like:

type ParseError interface {
    Line() Int
}

type parseError struct {
    cmd string
    line int
}

func (e parseError) Line() int {
    return line
}

func (e parseError) Error() string {
    return fmt.Sprintf("%s: parse error on line %d", e.cmd, e.line)
} 

When you get an error from exec, parse the error for line %d failed and if it matches, return a parseError. Then let the callers check for a ParseError by interface assertion, extract the Line(), extract their input's data at -3 and +3 from that line and log it. E.g.

 Failed to execute iptables-restore: input error on line 1234:
    1231: ...
    1232: ...
    1233: ...
    1234: ...
    1235: ...
    1236: ...
    1237: ...

You'll proably want a helper func to do that, which could live in that same iptables package. And a test.