Change:
my k8s cluster version is 1.17.x this cluster has 10 master only 2 nodes get problem. it make my svc sometime can usesometime can timeout what can i do can resolve this problem ? this 2 node's svc is nodeportType
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
you can increase kube-proxy verbosity adding flag and you should get more information about the cause of the error Kubernetes 1.17 is EOL, so you should upgrade to 1.19 at least
/sig network
hello bromy cluster is use kubeadm init .so what should i do .i know this is use configmap but in this i can not found how edit this configmap is availableabout upgrade this cluster .this time is impossible
about stack. i only get this log.
To increase the verbosity on kube-proxy on a kubeadm deployment you can do and wait until pods are restarted. Despite that, if there is a bug, it will not be backported to 1.17, so you have to go to a supported version first
I swear we code to dump the ruleset when this happens, but I don't see it any more.
I'm going to re-purpose this as a feature :)
Hi, I would like to pick this up. Can someone give me some code pointers on where to start?
Let me know if I can help in anyway.
/assign
I'd start with - It's worth thinking about the cleanest solution here, but maybe something like: When you get an error from exec, parse the error for and if it matches, return a . Then let the callers check for a by interface assertion, extract the Line(), extract their input's data at -3 and +3 from that line and log it. E.g. You'll proably want a helper func to do that, which could live in that same iptables package. And a test.
/assign
hi everyone! Is anyone doing this? I am willing to do this
at least I didn't see any PR from , in case of collision please sync between both to avoid duplicate efforts
hi did you work on it?
Hi apologies I was busy with some other work. You must please continue.
thanks
/assign
I'm working on this now, but I'm stuck in here, I got the line, and then how I extract at -3 and +3 from that line?
you may need to write a helper function to extract them from the logs. my 2 cents.. here is my version for reference. you could add some tests, to cover the boundary conditions. to play around :)

Discussion:
klog.V(5).InfoS("Restoring iptables", "rules", proxier.iptablesData.Bytes()) err = proxier.iptables.RestoreAll(proxier.iptablesData.Bytes(), utiliptables.NoFlushTables, utiliptables.RestoreCounters) if err != nil { <del> klog.ErrorS(err, "Failed to execute iptables-restore") </del> <ins> if pErr, ok := err.(utiliptables.ParseError); ok { lines := utiliptables.ExtractLines(proxier.iptablesData.Bytes(), pErr.Line(), 3) klog.ErrorS(pErr, "Failed to execute iptables-restore", "rules", lines) } else { klog.ErrorS(err, "Failed to execute iptables-restore") } </ins> metrics.IptablesRestoreFailuresTotal.Inc() // Revert new local ports. klog.V(2).InfoS("Closing local ports after iptables-restore failure")

klog.V(5).InfoS("Restoring iptables", "rules", string(proxier.iptablesData.Bytes())) err = proxier.iptables.RestoreAll(proxier.iptablesData.Bytes(), utiliptables.NoFlushTables, utiliptables.RestoreCounters) if err != nil { <del> klog.ErrorS(err, "Failed to execute iptables-restore", "rules", string(proxier.iptablesData.Bytes())) </del> <ins> if pErr, ok := err.(utiliptables.ParseError); ok { lines := utiliptables.ExtractLines(proxier.iptablesData.Bytes(), pErr.Line(), 3) klog.ErrorS(pErr, "Failed to execute iptables-restore", "rules", lines) } else { klog.ErrorS(err, "Failed to execute iptables-restore", "rules", string(proxier.iptablesData.Bytes())) } </ins> metrics.IptablesRestoreFailuresTotal.Inc() // Revert new local ports. utilproxy.RevertPorts(replacementPortsMap, proxier.portsMap)

package iptables import ( <ins> "bufio" </ins> "bytes" "context" "fmt" "regexp" <ins> "strconv" </ins> "strings" "sync" "time"

cmd.SetStdin(bytes.NewBuffer(data)) b, err := cmd.CombinedOutput() if err != nil { <del> return fmt.Errorf("%v (%s)", err, b) </del> <ins> pErr, ok := parseRestoreError(string(b)) if ok { return pErr } return fmt.Errorf("%w: %s", err, b) </ins> } return nil }

} return false } <ins> // ParseError records the payload when iptables reports an error parsing its input. type ParseError interface { // Line returns the line number on which the parse error was reported. // NOTE: First line is 1. Line() int // Error returns the error message of the parse error, including line number. Error() string } type parseError struct { cmd  string line int } func (e parseError) Line() int { return e.line } func (e parseError) Error() string { return fmt.Sprintf("%s: input error on line %d: ", e.cmd, e.line) } // LineData represents a single numbered line of data. type LineData struct { // Line holds the line number (the first line is 1). Line int // The data of the line. Data string } var regexpParseError = regexp.MustCompile("line ([1-9][0-9]*) failed$") // parseRestoreError extracts the line from the error, if it matches returns parseError // for example: // input: iptables-restore: line 51 failed // output: parseError:  cmd = iptables-restore, line = 51 // NOTE: parseRestoreError depends on the error format of iptables, if it ever changes // we need to update this function func parseRestoreError(str string) (ParseError, bool) { errors := strings.Split(str, ":") if len(errors) != 2 { return nil, false } cmd := errors[0] matches := regexpParseError.FindStringSubmatch(errors[1]) if len(matches) != 2 { return nil, false } line, errMsg := strconv.Atoi(matches[1]) if errMsg != nil { return nil, false } return parseError{cmd: cmd, line: line}, true } // ExtractLines extracts the -count and +count data from the lineNum row of lines and return // NOTE: lines start from line 1 func ExtractLines(lines []byte, line, count int) []LineData { // first line is line 1, so line can't be smaller than 1 if line < 1 { return nil } start := line - count if start <= 0 { start = 1 } end := line + count + 1 offset := 1 scanner := bufio.NewScanner(bytes.NewBuffer(lines)) extractLines := make([]LineData, 0, count*2) for scanner.Scan() { if offset >= start && offset < end { extractLines = append(extractLines, LineData{ Line: offset, Data: scanner.Text(), }) } if offset == end { break } offset++ } return extractLines } </ins>

t.Errorf("expected failure") } } <ins> // TestExtractLines tests that func TestExtractLines(t *testing.T) { mkLines := func(lines ...LineData) []LineData { return lines } lines := "Line1: 1nLine2: 2nLine3: 3nLine4: 4nLine5: 5nLine6: 6nLine7: 7nLine8: 8nLine9: 9nLine10: 10" tests := []struct { count int line  int name  string want  []LineData }{{ name:  "test-line-0", count: 3, line:  0, want:  nil, }, { name:  "test-count-0", count: 0, line:  3, want:  mkLines(LineData{3, "Line3: 3"}), }, { name:  "test-common-cases", count: 3, line:  6, want: mkLines( LineData{3, "Line3: 3"}, LineData{4, "Line4: 4"}, LineData{5, "Line5: 5"}, LineData{6, "Line6: 6"}, LineData{7, "Line7: 7"}, LineData{8, "Line8: 8"}, LineData{9, "Line9: 9"}), }, { name:  "test4-bound-cases", count: 11, line:  10, want: mkLines( LineData{1, "Line1: 1"}, LineData{2, "Line2: 2"}, LineData{3, "Line3: 3"}, LineData{4, "Line4: 4"}, LineData{5, "Line5: 5"}, LineData{6, "Line6: 6"}, LineData{7, "Line7: 7"}, LineData{8, "Line8: 8"}, LineData{9, "Line9: 9"}, LineData{10, "Line10: 10"}), }} for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { got := ExtractLines([]byte(lines), tt.line, tt.count) if !reflect.DeepEqual(got, tt.want) { t.Errorf("got = %v, want = %v", got, tt.want) } }) } } </ins>