Change:
BUG REPORT Kubernetes version 2 Environment: Install tools: What happened: The code in takes care to supply the flag so it will wait on a lock to avoid interference between multiple processes modifying the table. If you read the source you discover it does this by creating a file . However, when is running in a container, is in a local filesystem, so it is not able to lock against processes running on the host or in other containers. And before you decide that the answer is to mount from the host, look at all the issues around leaking netns, e.g. Credit for pointing this out to me. Credit for pointing out locking functionality was to a few months back
Ironically, this is caused by a bugfix that moved to file-based locking. Previously, iptables would lock by reserving an abstract unix socket, which is tied to the network namespace.
Some discussion also in and following comments.
I experimented with this: but it didn't work on CoreOS, as the host wasn't using a version of iptables that used the file lock yet. Just ended up creating a directory call
I guess I should file this as an issue against kubeadm and any of the other sources of kube-proxy container config.
/assign
Should we leave this open (waiting for ... ?)
Waiting for I guess... (which I'm reviewing now)
i think this should not be marked as complete until the kubeadm fixes are in.
/reopen
/close fix in

Discussion:
}, ) <del> docker_build( name = "busybox-net", base = ":busybox", debs = [ "@libc_deb//file", "@iptables_deb//file", "@iproute2_deb//file", "@libnetlink_deb//file", "@libxtables_deb//file", ], ) </del> # This list should roughly match kube::build::get_docker_wrapped_binaries() # in build/common.sh. DOCKERIZED_BINARIES = {

"target": "//plugin/cmd/kube-scheduler:kube-scheduler", }, "kube-proxy": { <del> "base": ":busybox-net", </del> <ins> "base": "@debian-iptables-amd64//image:image.tar", </ins> "target": "//cmd/kube-proxy:kube-proxy", }, }

) load("@io_bazel_rules_go//go:def.bzl", "go_repositories") <del> load("@io_bazel_rules_docker//docker:docker.bzl", "docker_repositories") </del> <ins> load("@io_bazel_rules_docker//docker:docker.bzl", "docker_repositories", "docker_pull") </ins> go_repositories( go_version = "1.8.3",

"http://ftp.us.debian.org/debian/pool/main/b/busybox/busybox-static_1.22.0-19+b3_amd64.deb", "https://storage.googleapis.com/kubernetes-release/debs/busybox-static_1.22.0-19+b3_amd64.deb", ), <del> ( "libc_deb", "372aac4a9ce9dbb26a08de0b9c41b0500ba019430295d29f39566483f5f32732", "http://ftp.us.debian.org/debian/pool/main/g/glibc/libc6_2.24-10_amd64.deb", "https://storage.googleapis.com/kubernetes-release/debs/libc6_2.24-10_amd64.deb", ), ( "iptables_deb", "7747388a97ba71fede302d70361c81d486770a2024185514c18b5d8eab6aaf4e", "http://ftp.us.debian.org/debian/pool/main/i/iptables/iptables_1.4.21-2+b1_amd64.deb", "https://storage.googleapis.com/kubernetes-release/debs/iptables_1.4.21-2+b1_amd64.deb", ), ( "libnetlink_deb", "5d486022cd9e047e9afbb1617cf4519c0decfc3d2c1fad7e7fe5604943dbbf37", "http://ftp.us.debian.org/debian/pool/main/libn/libnfnetlink/libnfnetlink0_1.0.1-3_amd64.deb", "https://storage.googleapis.com/kubernetes-release/debs/libnfnetlink0_1.0.1-3_amd64.deb", ), ( "libxtables_deb", "6783f316af4cbf3ada8b9a2b7bb5f53a87c0c2575c1903ce371fdbd45d3626c6", "http://ftp.us.debian.org/debian/pool/main/i/iptables/libxtables10_1.4.21-2+b1_amd64.deb", "https://storage.googleapis.com/kubernetes-release/debs/libxtables10_1.4.21-2+b1_amd64.deb", ), ( "iproute2_deb", "3ce9cb1d03a2a1359cbdd4f863b15d0c906096bf713e8eb688149da2f4e350bc", "http://ftp.us.debian.org/debian/pool/main/i/iproute2/iproute_3.16.0-2_all.deb", "https://storage.googleapis.com/kubernetes-release/debs/iproute_3.16.0-2_all.deb", ), </del> ) [http_file(

sha256 = "05ab3937bc68562e989dc143362ec4d4275262ba9f359338aed720fc914457a5", url = "https://storage.googleapis.com/kubernetes-release/network-plugins/cni-amd64-0799f5732f2a11b329d9e3d51b9c8f2e3759f2ff.tar.gz", ) <ins> docker_pull( name = "debian-iptables-amd64", digest = "sha256:adde513f7b3561042cd2d2af4d2d355189bbb2f579584b5766e7d07be4f7e71e",  # v7 registry = "gcr.io", repository = "google-containers/debian-iptables-amd64", ) </ins>