Change:
// configureFirewall configures iptable firewall rules. func configureFirewall(host string) error { <del> klog.V(2).Infof("Configure iptables firewall rules on %q", host) // TODO: consider calling bootstrap script to configure host based on OS output, err := SSH(host, "iptables", "-L", "INPUT") if err != nil { return fmt.Errorf("failed to get iptables INPUT on %q: %v output: %q", host, err, output) } if strings.Contains(output, "Chain INPUT (policy DROP)") { cmd := getSSHCommand("&&", "(iptables -C INPUT -w -p TCP -j ACCEPT || iptables -A INPUT -w -p TCP -j ACCEPT)", "(iptables -C INPUT -w -p UDP -j ACCEPT || iptables -A INPUT -w -p UDP -j ACCEPT)", "(iptables -C INPUT -w -p ICMP -j ACCEPT || iptables -A INPUT -w -p ICMP -j ACCEPT)") output, err := SSH(host, "sh", "-c", cmd) if err != nil { return fmt.Errorf("failed to configured firewall on %q: %v output: %v", host, err, output) } } output, err = SSH(host, "iptables", "-L", "FORWARD") </del> <ins> klog.V(2).Infof("Configure iptables HEYHO firewall rules on %q", host) // Since the goal is to enable connectivity without taking into account current rule, // we can just prepend the accept rules directly without any check cmd := getSSHCommand("&&", "iptables -I INPUT 1 -w -p tcp -j ACCEPT", "iptables -I INPUT 1 -w -p udp -j ACCEPT", "iptables -I INPUT 1 -w -p icmp -j ACCEPT", "iptables -I FORWARD 1 -w -p tcp -j ACCEPT", "iptables -I FORWARD 1 -w -p udp -j ACCEPT", "iptables -I FORWARD 1 -w -p icmp -j ACCEPT", ) output, err := SSH(host, "sh", "-c", cmd) </ins> if err != nil { <del> return fmt.Errorf("failed to get iptables FORWARD on %q: %v output: %q", host, err, output) } if strings.Contains(output, "Chain FORWARD (policy DROP)") { cmd := getSSHCommand("&&", "(iptables -C FORWARD -w -p TCP -j ACCEPT || iptables -A FORWARD -w -p TCP -j ACCEPT)", "(iptables -C FORWARD -w -p UDP -j ACCEPT || iptables -A FORWARD -w -p UDP -j ACCEPT)", "(iptables -C FORWARD -w -p ICMP -j ACCEPT || iptables -A FORWARD -w -p ICMP -j ACCEPT)") output, err = SSH(host, "sh", "-c", cmd) if err != nil { return fmt.Errorf("failed to configured firewall on %q: %v output: %v", host, err, output) } </del> <ins> return fmt.Errorf("failed to configured firewall on %q: %v output: %v", host, err, output) </ins> } return nil }

Discussion:
<!-- Please only use this template for submitting reports about continuously failing tests or jobs in Kubernetes CI --Which jobs are failing: Before node e2e tests are started, iptables rules are applied. The rules aren't correctly applied for some OSes like, Fedora CoreOS. Which test(s) are failing: node e2e tests that depend on communication between the containers tend to fail on Fedora CoreOS where the iptable rules don't get applied properly before starting the tests. Since when has it been failing: Probably always. I am in the process of fixing issues that I am seeing on Fedora CoreOS. Testgrid link: Reason for failure: The test infra currently checks if is to or not. But like in case of Fedora CoreOS, the iptables policy might be but it still lacks the individual rule for , and . In that case, since the iptables policy is not the test infra doesn't attempt to add any required iptable rules for , and . To fix this we need to see if the iptable policy is not set to plus check if the rules of , and are actually present or not. Anything else we need to know:
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/sig node
/assign