Issue 1:
StrategicPatch should delete all duplicates from a list of maps.

Currently it just delete the first one appears in the list.

We should make StrategicPatch delete all duplicates no matter it is a list of maps or a list of primitives. (StrategicPatch don't support list of lists).

Ref : kubernetes/community#140 (comment)

cc: @lavalamp

Issue 2:
Kubernetes version (use kubectl version):

Upgrading from 1.2.0 (working) to 1.3.9 (broken)

Environment:

Cloud provider or hardware configuration: Bare metal Dell R420's

OS (e.g. from /etc/os-release): CentOS 6 with a 3.10 kernel.

Kernel (e.g. uname -a): 3.10.0-327.18.2.el7.x86_64

Install tools:

Others:

iptables --version

iptables v1.4.7

What happened:

We upgraded from 1.2.0 to 1.3.9 and noticed that our service load balancer (based on haproxy) cpu utilization started going through the roof over the course of 3 days, mostly system time. It is now impacting all nodes with the 1.3.9 version of kubelet installed.

We've tracked down a likely culprit which is this version of kube seems to be continuously appending iptables rules at a rate of about 4 a second. Here's a dump from iptables-save:

$ sudo iptables-save | wc -l

67951

These tend to be the form of the duplicated rules:

-A KUBE-FIREWALL -m comment --comment "kubernetes firewall for dropping marked packets" -m mark --mark 0x8000/0x8000 -j DROP
<repeated>
-A KUBE-MARK-DROP -j MARK --set-xmark 0x8000/0x8000
<repeated>
-A KUBE-MARK-MASQ -j MARK --set-xmark 0x4000/0x4000
<repeated>
-A KUBE-POSTROUTING -m comment --comment "kubernetes service traffic requiring SNAT" -m mark --mark 0x4000/0x4000 -j MASQUERADE
<repeated>

The commits and issues I've found related to this are:

#2623

#30486

What you expected to happen:

It to stay at < 30% cpu utilization and a reasonable number of iptables rules.

How to reproduce it (as minimally and precisely as possible):

Setup centos6 with our kernel, run 1.3.9

Anything else do we need to know:

Here is the iptables output soon after starting the system. You can see it is already starting to accumulate rules:

$ sudo iptables-save
# Generated by iptables-save v1.4.7 on Wed Nov 23 16:35:34 2016
*filter
:INPUT ACCEPT [2753:1417441]
:FORWARD ACCEPT [107:7101]
:OUTPUT ACCEPT [1993:8997998]
:DOCKER - [0:0]
:DOCKER-ISOLATION - [0:0]
:KUBE-FIREWALL - [0:0]
-A INPUT -j KUBE-FIREWALL
-A FORWARD -j DOCKER-ISOLATION
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A OUTPUT -j KUBE-FIREWALL
-A DOCKER-ISOLATION -j RETURN
-A KUBE-FIREWALL -m comment --comment "kubernetes firewall for dropping marked packets" -m mark --mark 0x8000/0x8000 -j DROP
-A KUBE-FIREWALL -m comment --comment "kubernetes firewall for dropping marked packets" -m mark --mark 0x8000/0x8000 -j DROP
COMMIT
# Completed on Wed Nov 23 16:35:34 2016
# Generated by iptables-save v1.4.7 on Wed Nov 23 16:35:34 2016
*nat
:PREROUTING ACCEPT [462:40180]
:INPUT ACCEPT [136:16306]
:OUTPUT ACCEPT [1007:65897]
:POSTROUTING ACCEPT [1109:72017]
:DOCKER - [0:0]
:KUBE-MARK-DROP - [0:0]
:KUBE-MARK-MASQ - [0:0]
:KUBE-POSTROUTING - [0:0]
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
-A PREROUTING ! -s 127.0.0.1/32 -p tcp -m tcp --dport 10250 -m addrtype --dst-type LOCAL -j REDIRECT --to-ports 11250
-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
-A POSTROUTING -m comment --comment "kubernetes postrouting rules" -j KUBE-POSTROUTING
-A POSTROUTING -s 10.20.19.128/25 ! -o docker0 -j MASQUERADE
-A DOCKER -i docker0 -j RETURN
-A KUBE-MARK-DROP -j MARK --set-xmark 0x8000/0x8000
-A KUBE-MARK-DROP -j MARK --set-xmark 0x8000/0x8000
-A KUBE-MARK-MASQ -j MARK --set-xmark 0x4000/0x4000
-A KUBE-MARK-MASQ -j MARK --set-xmark 0x4000/0x4000
-A KUBE-POSTROUTING -m comment --comment "kubernetes service traffic requiring SNAT" -m mark --mark 0x4000/0x4000 -j MASQUERADE
-A KUBE-POSTROUTING -m comment --comment "kubernetes service traffic requiring SNAT" -m mark --mark 0x4000/0x4000 -j MASQUERADE
COMMIT
# Completed on Wed Nov 23 16:35:34 2016

@thockin @freehan