Change:
} return false } <ins> // ParseError records the payload when iptables reports an error parsing its input. type ParseError interface { // Line returns the line number on which the parse error was reported. // NOTE: First line is 1. Line() int // Error returns the error message of the parse error, including line number. Error() string } type parseError struct { cmd  string line int } func (e parseError) Line() int { return e.line } func (e parseError) Error() string { return fmt.Sprintf("%s: input error on line %d: ", e.cmd, e.line) } // LineData represents a single numbered line of data. type LineData struct { // Line holds the line number (the first line is 1). Line int // The data of the line. Data string } var regexpParseError = regexp.MustCompile("line ([1-9][0-9]*) failed$") // parseRestoreError extracts the line from the error, if it matches returns parseError // for example: // input: iptables-restore: line 51 failed // output: parseError:  cmd = iptables-restore, line = 51 // NOTE: parseRestoreError depends on the error format of iptables, if it ever changes // we need to update this function func parseRestoreError(str string) (ParseError, bool) { errors := strings.Split(str, ":") if len(errors) != 2 { return nil, false } cmd := errors[0] matches := regexpParseError.FindStringSubmatch(errors[1]) if len(matches) != 2 { return nil, false } line, errMsg := strconv.Atoi(matches[1]) if errMsg != nil { return nil, false } return parseError{cmd: cmd, line: line}, true } // ExtractLines extracts the -count and +count data from the lineNum row of lines and return // NOTE: lines start from line 1 func ExtractLines(lines []byte, line, count int) []LineData { // first line is line 1, so line can't be smaller than 1 if line < 1 { return nil } start := line - count if start <= 0 { start = 1 } end := line + count + 1 offset := 1 scanner := bufio.NewScanner(bytes.NewBuffer(lines)) extractLines := make([]LineData, 0, count*2) for scanner.Scan() { if offset >= start && offset < end { extractLines = append(extractLines, LineData{ Line: offset, Data: scanner.Text(), }) } if offset == end { break } offset++ } return extractLines } </ins>

Discussion:
my k8s cluster version is 1.17.x this cluster has 10 master only 2 nodes get problem. it make my svc sometime can usesometime can timeout what can i do can resolve this problem ? this 2 node's svc is nodeportType
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
you can increase kube-proxy verbosity adding flag and you should get more information about the cause of the error Kubernetes 1.17 is EOL, so you should upgrade to 1.19 at least
/sig network
hello bromy cluster is use kubeadm init .so what should i do .i know this is use configmap but in this i can not found how edit this configmap is availableabout upgrade this cluster .this time is impossible
about stack. i only get this log.
To increase the verbosity on kube-proxy on a kubeadm deployment you can do and wait until pods are restarted. Despite that, if there is a bug, it will not be backported to 1.17, so you have to go to a supported version first
I swear we code to dump the ruleset when this happens, but I don't see it any more.
I'm going to re-purpose this as a feature :)
Hi, I would like to pick this up. Can someone give me some code pointers on where to start?
Let me know if I can help in anyway.
/assign
I'd start with - It's worth thinking about the cleanest solution here, but maybe something like: When you get an error from exec, parse the error for and if it matches, return a . Then let the callers check for a by interface assertion, extract the Line(), extract their input's data at -3 and +3 from that line and log it. E.g. You'll proably want a helper func to do that, which could live in that same iptables package. And a test.
/assign
hi everyone! Is anyone doing this?

I am willing to do this
at least I didn't see any PR from , in case of collision please sync between both to avoid duplicate efforts
hi did you work on it?
Hi apologies I was busy with some other work. You must please continue.
thanks
/assign
I'm working on this now, but I'm stuck in here, I got the line, and then how I extract at -3 and +3 from that line?
you may need to write a helper function to extract them from the logs. my 2 cents.. here is my version for reference. you could add some tests, to cover the boundary conditions. to play around :)