{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubeadm/issues/689","repository_url":"https://api.github.com/repos/kubernetes/kubeadm","labels_url":"https://api.github.com/repos/kubernetes/kubeadm/issues/689/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubeadm/issues/689/comments","events_url":"https://api.github.com/repos/kubernetes/kubeadm/issues/689/events","html_url":"https://github.com/kubernetes/kubeadm/issues/689","id":293718088,"node_id":"MDU6SXNzdWUyOTM3MTgwODg=","number":689,"title":"Stale iptables rules seen after \"kubeadm reset\"","user":{"login":"vhosakot","id":8882663,"node_id":"MDQ6VXNlcjg4ODI2NjM=","avatar_url":"https://avatars0.githubusercontent.com/u/8882663?v=4","gravatar_id":"","url":"https://api.github.com/users/vhosakot","html_url":"https://github.com/vhosakot","followers_url":"https://api.github.com/users/vhosakot/followers","following_url":"https://api.github.com/users/vhosakot/following{/other_user}","gists_url":"https://api.github.com/users/vhosakot/gists{/gist_id}","starred_url":"https://api.github.com/users/vhosakot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vhosakot/subscriptions","organizations_url":"https://api.github.com/users/vhosakot/orgs","repos_url":"https://api.github.com/users/vhosakot/repos","events_url":"https://api.github.com/users/vhosakot/events{/privacy}","received_events_url":"https://api.github.com/users/vhosakot/received_events","type":"User","site_admin":false},"labels":[{"id":486863285,"node_id":"MDU6TGFiZWw0ODY4NjMyODU=","url":"https://api.github.com/repos/kubernetes/kubeadm/labels/help%20wanted","name":"help wanted","color":"006b75","default":true},{"id":486837088,"node_id":"MDU6TGFiZWw0ODY4MzcwODg=","url":"https://api.github.com/repos/kubernetes/kubeadm/labels/kind/bug","name":"kind/bug","color":"e11d21","default":false},{"id":764044866,"node_id":"MDU6TGFiZWw3NjQwNDQ4NjY=","url":"https://api.github.com/repos/kubernetes/kubeadm/labels/kind/documentation","name":"kind/documentation","color":"c7def8","default":false},{"id":778137739,"node_id":"MDU6TGFiZWw3NzgxMzc3Mzk=","url":"https://api.github.com/repos/kubernetes/kubeadm/labels/lifecycle/frozen","name":"lifecycle/frozen","color":"d3e2f0","default":false},{"id":486872444,"node_id":"MDU6TGFiZWw0ODY4NzI0NDQ=","url":"https://api.github.com/repos/kubernetes/kubeadm/labels/priority/important-soon","name":"priority/important-soon","color":"eb6420","default":false},{"id":764042656,"node_id":"MDU6TGFiZWw3NjQwNDI2NTY=","url":"https://api.github.com/repos/kubernetes/kubeadm/labels/sig/network","name":"sig/network","color":"d2b48c","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/kubernetes/kubeadm/milestones/9","html_url":"https://github.com/kubernetes/kubeadm/milestone/9","labels_url":"https://api.github.com/repos/kubernetes/kubeadm/milestones/9/labels","id":3587373,"node_id":"MDk6TWlsZXN0b25lMzU4NzM3Mw==","number":9,"title":"v1.13","description":"","creator":{"login":"timothysc","id":169553,"node_id":"MDQ6VXNlcjE2OTU1Mw==","avatar_url":"https://avatars0.githubusercontent.com/u/169553?v=4","gravatar_id":"","url":"https://api.github.com/users/timothysc","html_url":"https://github.com/timothysc","followers_url":"https://api.github.com/users/timothysc/followers","following_url":"https://api.github.com/users/timothysc/following{/other_user}","gists_url":"https://api.github.com/users/timothysc/gists{/gist_id}","starred_url":"https://api.github.com/users/timothysc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/timothysc/subscriptions","organizations_url":"https://api.github.com/users/timothysc/orgs","repos_url":"https://api.github.com/users/timothysc/repos","events_url":"https://api.github.com/users/timothysc/events{/privacy}","received_events_url":"https://api.github.com/users/timothysc/received_events","type":"User","site_admin":false},"open_issues":44,"closed_issues":12,"state":"open","created_at":"2018-08-21T15:44:02Z","updated_at":"2018-10-11T17:13:29Z","due_on":"2018-12-01T08:00:00Z","closed_at":null},"comments":6,"created_at":"2018-02-01T23:14:26Z","updated_at":"2018-10-11T17:13:38Z","closed_at":null,"author_association":"NONE","body":"**BUG REPORT:**\r\n\r\nAfter doing `kubeadm reset` on all the nodes, I see these stale iptables rules installed by kubernetes and the CNI on all the nodes and they are not deleted after `kubeadm reset` is done. `kubeadm` version `1.7` was used and `calico` was the CNI.\r\n\r\nThese stale iptables rules affect packet forwarding on the nodes after `kubeadm reset` is done.\r\n\r\n```\r\n$ sudo iptables -L -n -v\r\nChain INPUT (policy ACCEPT 63 packets, 4064 bytes)\r\n pkts bytes target     prot opt in     out     source               destination         \r\n83639  103M cali-INPUT  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:Cz_u1IQiXIMmKD4c */\r\n93907  154M KUBE-SERVICES  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* kubernetes service portals */\r\n 121K  170M KUBE-FIREWALL  all  --  *      *       0.0.0.0/0            0.0.0.0/0           \r\n\r\nChain FORWARD (policy DROP 0 packets, 0 bytes)\r\n pkts bytes target     prot opt in     out     source               destination         \r\n    0     0 DOCKER-ISOLATION  all  --  *      *       0.0.0.0/0            0.0.0.0/0           \r\n    0     0 DOCKER     all  --  *      docker0  0.0.0.0/0            0.0.0.0/0           \r\n    0     0 ACCEPT     all  --  *      docker0  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED\r\n    0     0 ACCEPT     all  --  docker0 !docker0  0.0.0.0/0            0.0.0.0/0           \r\n    0     0 ACCEPT     all  --  docker0 docker0  0.0.0.0/0            0.0.0.0/0           \r\n 1668  169K cali-FORWARD  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:wUHhoiAYhphO9Mso */\r\n\r\nChain OUTPUT (policy ACCEPT 59 packets, 25432 bytes)\r\n pkts bytes target     prot opt in     out     source               destination         \r\n83963   39M cali-OUTPUT  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:tVnHkvAo15HuiPy0 */\r\n95586   44M KUBE-SERVICES  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* kubernetes service portals */\r\n 122K   55M KUBE-FIREWALL  all  --  *      *       0.0.0.0/0            0.0.0.0/0           \r\n\r\nChain DOCKER (1 references)\r\n pkts bytes target     prot opt in     out     source               destination         \r\n\r\nChain DOCKER-ISOLATION (1 references)\r\n pkts bytes target     prot opt in     out     source               destination         \r\n    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           \r\n\r\nChain KUBE-FIREWALL (2 references)\r\n pkts bytes target     prot opt in     out     source               destination         \r\n    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* kubernetes firewall for dropping marked packets */ mark match 0x8000/0x8000\r\n\r\nChain KUBE-SERVICES (2 references)\r\n pkts bytes target     prot opt in     out     source               destination         \r\n    0     0 REJECT     tcp  --  *      *       0.0.0.0/0            10.101.37.60         /* kube-system/calico-typha:calico-typha has no endpoints */ tcp dpt:5473 reject-with icmp-port-unreachable\r\n\r\nChain cali-FORWARD (1 references)\r\n pkts bytes target     prot opt in     out     source               destination         \r\n 1668  169K MARK       all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:JV9-BRWxjz8He5Ib */ MARK and 0xf1ffffff\r\n 1668  169K cali-from-hep-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:p3dIAeGsCabF0CUT */ mark match 0x0/0x1000000\r\n  834 88218 cali-from-wl-dispatch  all  --  cali+  *       0.0.0.0/0            0.0.0.0/0            /* cali:DeNlxb0sUevj_Plt */\r\n  834 80898 cali-to-wl-dispatch  all  --  *      cali+   0.0.0.0/0            0.0.0.0/0            /* cali:B81FOaQNZymbX9H8 */\r\n  649 62953 cali-to-hep-forward  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:bB-I9T0YRAYMASx0 */\r\n  649 62953 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:I1Ki7aNgQsJFzEpG */ /* Policy explicitly accepted packet. */ mark match 0x1000000/0x1000000\r\n\r\nChain cali-INPUT (1 references)\r\n pkts bytes target     prot opt in     out     source               destination         \r\n    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:i7okJZpS8VxaJB3n */ mark match 0x1000000/0x1000000\r\n  842 98514 ACCEPT     4    --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:kLJdl8-9MpSKcclh */ /* Allow IPIP packets from Calico hosts */ match-set cali4-all-hosts src ADDRTYPE match dst-type LOCAL\r\n    0     0 DROP       4    --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:JhfQUFFJ2v0jbipF */ /* Drop IPIP packets from non-Calico hosts */\r\n 2731  569K cali-wl-to-host  all  --  cali+  *       0.0.0.0/0            0.0.0.0/0           [goto]  /* cali:lCcyvgf8VeDM1u1- */\r\n80066  102M MARK       all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:GlrNbO_EUWYWRCaO */ MARK and 0xf0ffffff\r\n80066  102M cali-from-host-endpoint  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:K-V6zS0uXrZMyaMZ */\r\n    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:LxVlCgv5vgFY0hIt */ /* Host endpoint policy accepted packet. */ mark match 0x1000000/0x1000000\r\n\r\nChain cali-OUTPUT (1 references)\r\n pkts bytes target     prot opt in     out     source               destination         \r\n    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:YQSSJIsRcHjFbXaI */ mark match 0x1000000/0x1000000\r\n    0     0 cali-to-wl-dispatch  all  --  *      cali+   0.0.0.0/0            0.0.0.0/0            /* cali:N882DxHZfedrB21M */ ipvs\r\n 3039  557K RETURN     all  --  *      cali+   0.0.0.0/0            0.0.0.0/0            /* cali:3DMcCmSodO9PvZSQ */\r\n  834  105K ACCEPT     4    --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:z0oSsuDED75MEj0R */ /* Allow IPIP packets to other Calico hosts */ match-set cali4-all-hosts dst ADDRTYPE match src-type LOCAL\r\n80090   39M MARK       all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:QNnJdgwPtObqbUOD */ MARK and 0xf0ffffff\r\n80090   39M cali-to-host-endpoint  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:B2nj6q0bloZNBIi- */\r\n    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:Exh0jTsM68POxMgM */ /* Host endpoint policy accepted packet. */ mark match 0x1000000/0x1000000\r\n\r\nChain cali-failsafe-in (0 references)\r\n pkts bytes target     prot opt in     out     source               destination         \r\n    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:wWFQM43tJU7wwnFZ */ multiport dports 22\r\n    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:LwNV--R8MjeUYacw */ multiport dports 68\r\n    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:QOO5NUOqOSS1_Iw0 */ multiport dports 179\r\n    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:cwZWoBSwVeIAZmVN */ multiport dports 2379\r\n    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:7FbNXT91kugE_upR */ multiport dports 2380\r\n    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:ywE9WYUBEpve70WT */ multiport dports 6666\r\n    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:l-WQSVBf_lygPR0J */ multiport dports 6667\r\n\r\nChain cali-failsafe-out (0 references)\r\n pkts bytes target     prot opt in     out     source               destination         \r\n    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:82hjfji-wChFhAqL */ multiport dports 53\r\n    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:TNM3RfEjbNr72hgH */ multiport dports 67\r\n    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:ycxKitIl4u3dK0HR */ multiport dports 179\r\n    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:hxjEWyxdkXXkdvut */ multiport dports 2379\r\n    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:cA_GLtruuvG88KiO */ multiport dports 2380\r\n    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:Sb1hkLYFMrKS6r01 */ multiport dports 6666\r\n    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:UwLSebGONJUG4yG- */ multiport dports 6667\r\n\r\nChain cali-from-hep-forward (1 references)\r\n pkts bytes target     prot opt in     out     source               destination         \r\n\r\nChain cali-from-host-endpoint (1 references)\r\n pkts bytes target     prot opt in     out     source               destination         \r\n\r\nChain cali-from-wl-dispatch (2 references)\r\n pkts bytes target     prot opt in     out     source               destination         \r\n 2847  525K cali-fw-cali760497f1014  all  --  cali760497f1014 *       0.0.0.0/0            0.0.0.0/0           [goto]  /* cali:btNvRWGS9Uc1--wZ */\r\n    0     0 cali-fw-cali8594ba11505  all  --  cali8594ba11505 *       0.0.0.0/0            0.0.0.0/0           [goto]  /* cali:7xg08ELbW_2BwUNt */\r\n  698  127K cali-fw-calicf8e623ea43  all  --  calicf8e623ea43 *       0.0.0.0/0            0.0.0.0/0           [goto]  /* cali:MXgqd9kDw1IoLnFq */\r\n    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:R_rUYoMTp_Y20Pvq */ /* Unknown interface */\r\n\r\nChain cali-fw-cali760497f1014 (1 references)\r\n pkts bytes target     prot opt in     out     source               destination         \r\n 2845  525K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:HwPuZaE8udxDVe6X */ ctstate RELATED,ESTABLISHED\r\n    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:lchRxTw8uJkvqAy7 */ ctstate INVALID\r\n    2   120 MARK       all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:pkBP2_7UaVFs00FS */ MARK and 0xfeffffff\r\n    2   120 cali-pro-kns.kube-system  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:LJ_eriaJn-qS--1s */\r\n    2   120 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:aQQiqtCp94gFrE4H */ /* Return if profile accepted */ mark match 0x1000000/0x1000000\r\n    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:Jcijcqe-Qk-gm2jL */ /* Drop if no profiles matched */\r\n\r\nChain cali-fw-cali8594ba11505 (1 references)\r\n pkts bytes target     prot opt in     out     source               destination         \r\n    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:jS52NYKbyiOC3qME */ ctstate RELATED,ESTABLISHED\r\n    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:lTtF738vxqFewrMG */ ctstate INVALID\r\n    0     0 MARK       all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:O2aRve9PmrvmKDjK */ MARK and 0xfeffffff\r\n    0     0 cali-pro-kns.default  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:zGEL7My6RCPoIX85 */\r\n    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:ZQPTSS2mHPuxY26L */ /* Return if profile accepted */ mark match 0x1000000/0x1000000\r\n    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:6pzOMDX7P27iWW5s */ /* Drop if no profiles matched */\r\n\r\nChain cali-fw-calicf8e623ea43 (1 references)\r\n pkts bytes target     prot opt in     out     source               destination         \r\n  717  132K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:D3I3OjhrL7qQqzwR */ ctstate RELATED,ESTABLISHED\r\n    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:4JGZ_4cc7H-I3gtS */ ctstate INVALID\r\n    1    60 MARK       all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:aarFMNHyZ7MCf_Xb */ MARK and 0xfeffffff\r\n    1    60 cali-pro-kns.kube-system  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:5Kk0gGSPW5lTjnzS */\r\n    1    60 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:lJBOWbwmrxOkuWDS */ /* Return if profile accepted */ mark match 0x1000000/0x1000000\r\n    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:L4660BXZuZR_FU3S */ /* Drop if no profiles matched */\r\n\r\nChain cali-pri-kns.default (1 references)\r\n pkts bytes target     prot opt in     out     source               destination         \r\n    0     0 MARK       all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:5yVkkQ7pBcxxkSaE */ MARK or 0x1000000\r\n    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:pZi5w5MrTl3DghSD */ mark match 0x1000000/0x1000000\r\n\r\nChain cali-pri-kns.kube-system (2 references)\r\n pkts bytes target     prot opt in     out     source               destination         \r\n  649 62953 MARK       all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:jVs-zlYSX3OG8546 */ MARK or 0x1000000\r\n  649 62953 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:wbS84vjWKVIcWiCG */ mark match 0x1000000/0x1000000\r\n\r\nChain cali-pro-kns.default (1 references)\r\n pkts bytes target     prot opt in     out     source               destination         \r\n    0     0 MARK       all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:gbqtfAKh_VXndzz6 */ MARK or 0x1000000\r\n    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:JMure-l4CiemFMIB */ mark match 0x1000000/0x1000000\r\n\r\nChain cali-pro-kns.kube-system (2 references)\r\n pkts bytes target     prot opt in     out     source               destination         \r\n    3   180 MARK       all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:B_J-7WG5VtOu-bQy */ MARK or 0x1000000\r\n    3   180 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:_Xu55_wPL7ogYHes */ mark match 0x1000000/0x1000000\r\n\r\nChain cali-to-hep-forward (1 references)\r\n pkts bytes target     prot opt in     out     source               destination         \r\n\r\nChain cali-to-host-endpoint (1 references)\r\n pkts bytes target     prot opt in     out     source               destination         \r\n\r\nChain cali-to-wl-dispatch (2 references)\r\n pkts bytes target     prot opt in     out     source               destination         \r\n  834 80898 cali-tw-cali760497f1014  all  --  *      cali760497f1014  0.0.0.0/0            0.0.0.0/0           [goto]  /* cali:SgH8SZ2p7yHU21J5 */\r\n    0     0 cali-tw-cali8594ba11505  all  --  *      cali8594ba11505  0.0.0.0/0            0.0.0.0/0           [goto]  /* cali:_2M9Z9a9p18n7wQX */\r\n    0     0 cali-tw-calicf8e623ea43  all  --  *      calicf8e623ea43  0.0.0.0/0            0.0.0.0/0           [goto]  /* cali:sNxqIDmwZi4H7tq- */\r\n    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:JHgjJgzanocMZ1mf */ /* Unknown interface */\r\n\r\nChain cali-tw-cali760497f1014 (1 references)\r\n pkts bytes target     prot opt in     out     source               destination         \r\n  185 17945 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:zrThrogfCh8Y2nYo */ ctstate RELATED,ESTABLISHED\r\n    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:AXdlwjDUaY2pTO3g */ ctstate INVALID\r\n  649 62953 MARK       all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:PP8JFDh8KlAI3KKK */ MARK and 0xfeffffff\r\n  649 62953 cali-pri-kns.kube-system  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:fHkZrXsYWnCA_5Wz */\r\n  649 62953 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:Elr81ubmQg_TKLO- */ /* Return if profile accepted */ mark match 0x1000000/0x1000000\r\n    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:Xvdfce-QzGRHIVod */ /* Drop if no profiles matched */\r\n\r\nChain cali-tw-cali8594ba11505 (1 references)\r\n pkts bytes target     prot opt in     out     source               destination         \r\n    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:_-IvXbRS5Zv8ZD1w */ ctstate RELATED,ESTABLISHED\r\n    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:_ZefvJfhlYH0SWeq */ ctstate INVALID\r\n    0     0 MARK       all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:d3RTUJsAwhQo41gp */ MARK and 0xfeffffff\r\n    0     0 cali-pri-kns.default  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:-vul7suSFRHeXrEq */\r\n    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:EmlzY4reMNRb3UZ7 */ /* Return if profile accepted */ mark match 0x1000000/0x1000000\r\n    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:BNNJOWy9OOI_tKnw */ /* Drop if no profiles matched */\r\n\r\nChain cali-tw-calicf8e623ea43 (1 references)\r\n pkts bytes target     prot opt in     out     source               destination         \r\n    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:iPQfnGZvq-6vWckM */ ctstate RELATED,ESTABLISHED\r\n    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:dK4AfsX0qQOjoETY */ ctstate INVALID\r\n    0     0 MARK       all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:DqtECX--DEsSgCUo */ MARK and 0xfeffffff\r\n    0     0 cali-pri-kns.kube-system  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:Ys68MMb9Q8rXxCj3 */\r\n    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:Rw3g-Sg47oS_qcnU */ /* Return if profile accepted */ mark match 0x1000000/0x1000000\r\n    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:tSV75lL-CSxHUNeP */ /* Drop if no profiles matched */\r\n\r\nChain cali-wl-to-host (1 references)\r\n pkts bytes target     prot opt in     out     source               destination         \r\n 2731  569K cali-from-wl-dispatch  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:Ee9Sbo10IpVujdIY */\r\n    3   180 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:nSZbcOoG1xPONxb8 */ /* Configured DefaultEndpointToHostAction */\r\n```\r\n\r\n```\r\n$ sudo iptables -S\r\n-P INPUT ACCEPT\r\n-P FORWARD DROP\r\n-P OUTPUT ACCEPT\r\n-N DOCKER\r\n-N DOCKER-ISOLATION\r\n-N KUBE-FIREWALL\r\n-N KUBE-SERVICES\r\n-N cali-FORWARD\r\n-N cali-INPUT\r\n-N cali-OUTPUT\r\n-N cali-failsafe-in\r\n-N cali-failsafe-out\r\n-N cali-from-hep-forward\r\n-N cali-from-host-endpoint\r\n-N cali-from-wl-dispatch\r\n-N cali-fw-cali760497f1014\r\n-N cali-fw-cali8594ba11505\r\n-N cali-fw-calicf8e623ea43\r\n-N cali-pri-kns.default\r\n-N cali-pri-kns.kube-system\r\n-N cali-pro-kns.default\r\n-N cali-pro-kns.kube-system\r\n-N cali-to-hep-forward\r\n-N cali-to-host-endpoint\r\n-N cali-to-wl-dispatch\r\n-N cali-tw-cali760497f1014\r\n-N cali-tw-cali8594ba11505\r\n-N cali-tw-calicf8e623ea43\r\n-N cali-wl-to-host\r\n-A INPUT -m comment --comment \"cali:Cz_u1IQiXIMmKD4c\" -j cali-INPUT\r\n-A INPUT -m comment --comment \"kubernetes service portals\" -j KUBE-SERVICES\r\n-A INPUT -j KUBE-FIREWALL\r\n-A FORWARD -j DOCKER-ISOLATION\r\n-A FORWARD -o docker0 -j DOCKER\r\n-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT\r\n-A FORWARD -i docker0 ! -o docker0 -j ACCEPT\r\n-A FORWARD -i docker0 -o docker0 -j ACCEPT\r\n-A FORWARD -m comment --comment \"cali:wUHhoiAYhphO9Mso\" -j cali-FORWARD\r\n-A OUTPUT -m comment --comment \"cali:tVnHkvAo15HuiPy0\" -j cali-OUTPUT\r\n-A OUTPUT -m comment --comment \"kubernetes service portals\" -j KUBE-SERVICES\r\n-A OUTPUT -j KUBE-FIREWALL\r\n-A DOCKER-ISOLATION -j RETURN\r\n-A KUBE-FIREWALL -m comment --comment \"kubernetes firewall for dropping marked packets\" -m mark --mark 0x8000/0x8000 -j DROP\r\n-A KUBE-SERVICES -d 10.101.37.60/32 -p tcp -m comment --comment \"kube-system/calico-typha:calico-typha has no endpoints\" -m tcp --dport 5473 -j REJECT --reject-with icmp-port-unreachable\r\n-A cali-FORWARD -m comment --comment \"cali:JV9-BRWxjz8He5Ib\" -j MARK --set-xmark 0x0/0xe000000\r\n-A cali-FORWARD -m comment --comment \"cali:p3dIAeGsCabF0CUT\" -m mark --mark 0x0/0x1000000 -j cali-from-hep-forward\r\n-A cali-FORWARD -i cali+ -m comment --comment \"cali:DeNlxb0sUevj_Plt\" -j cali-from-wl-dispatch\r\n-A cali-FORWARD -o cali+ -m comment --comment \"cali:B81FOaQNZymbX9H8\" -j cali-to-wl-dispatch\r\n-A cali-FORWARD -m comment --comment \"cali:bB-I9T0YRAYMASx0\" -j cali-to-hep-forward\r\n-A cali-FORWARD -m comment --comment \"cali:I1Ki7aNgQsJFzEpG\" -m comment --comment \"Policy explicitly accepted packet.\" -m mark --mark 0x1000000/0x1000000 -j ACCEPT\r\n-A cali-INPUT -m comment --comment \"cali:i7okJZpS8VxaJB3n\" -m mark --mark 0x1000000/0x1000000 -j ACCEPT\r\n-A cali-INPUT -p ipencap -m comment --comment \"cali:kLJdl8-9MpSKcclh\" -m comment --comment \"Allow IPIP packets from Calico hosts\" -m set --match-set cali4-all-hosts src -m addrtype --dst-type LOCAL -j ACCEPT\r\n-A cali-INPUT -p ipencap -m comment --comment \"cali:JhfQUFFJ2v0jbipF\" -m comment --comment \"Drop IPIP packets from non-Calico hosts\" -j DROP\r\n-A cali-INPUT -i cali+ -m comment --comment \"cali:lCcyvgf8VeDM1u1-\" -g cali-wl-to-host\r\n-A cali-INPUT -m comment --comment \"cali:GlrNbO_EUWYWRCaO\" -j MARK --set-xmark 0x0/0xf000000\r\n-A cali-INPUT -m comment --comment \"cali:K-V6zS0uXrZMyaMZ\" -j cali-from-host-endpoint\r\n-A cali-INPUT -m comment --comment \"cali:LxVlCgv5vgFY0hIt\" -m comment --comment \"Host endpoint policy accepted packet.\" -m mark --mark 0x1000000/0x1000000 -j ACCEPT\r\n-A cali-OUTPUT -m comment --comment \"cali:YQSSJIsRcHjFbXaI\" -m mark --mark 0x1000000/0x1000000 -j ACCEPT\r\n-A cali-OUTPUT -o cali+ -m comment --comment \"cali:N882DxHZfedrB21M\" -m ipvs --ipvs -j cali-to-wl-dispatch\r\n-A cali-OUTPUT -o cali+ -m comment --comment \"cali:3DMcCmSodO9PvZSQ\" -j RETURN\r\n-A cali-OUTPUT -p ipencap -m comment --comment \"cali:z0oSsuDED75MEj0R\" -m comment --comment \"Allow IPIP packets to other Calico hosts\" -m set --match-set cali4-all-hosts dst -m addrtype --src-type LOCAL -j ACCEPT\r\n-A cali-OUTPUT -m comment --comment \"cali:QNnJdgwPtObqbUOD\" -j MARK --set-xmark 0x0/0xf000000\r\n-A cali-OUTPUT -m comment --comment \"cali:B2nj6q0bloZNBIi-\" -j cali-to-host-endpoint\r\n-A cali-OUTPUT -m comment --comment \"cali:Exh0jTsM68POxMgM\" -m comment --comment \"Host endpoint policy accepted packet.\" -m mark --mark 0x1000000/0x1000000 -j ACCEPT\r\n-A cali-failsafe-in -p tcp -m comment --comment \"cali:wWFQM43tJU7wwnFZ\" -m multiport --dports 22 -j ACCEPT\r\n-A cali-failsafe-in -p udp -m comment --comment \"cali:LwNV--R8MjeUYacw\" -m multiport --dports 68 -j ACCEPT\r\n-A cali-failsafe-in -p tcp -m comment --comment \"cali:QOO5NUOqOSS1_Iw0\" -m multiport --dports 179 -j ACCEPT\r\n-A cali-failsafe-in -p tcp -m comment --comment \"cali:cwZWoBSwVeIAZmVN\" -m multiport --dports 2379 -j ACCEPT\r\n-A cali-failsafe-in -p tcp -m comment --comment \"cali:7FbNXT91kugE_upR\" -m multiport --dports 2380 -j ACCEPT\r\n-A cali-failsafe-in -p tcp -m comment --comment \"cali:ywE9WYUBEpve70WT\" -m multiport --dports 6666 -j ACCEPT\r\n-A cali-failsafe-in -p tcp -m comment --comment \"cali:l-WQSVBf_lygPR0J\" -m multiport --dports 6667 -j ACCEPT\r\n-A cali-failsafe-out -p udp -m comment --comment \"cali:82hjfji-wChFhAqL\" -m multiport --dports 53 -j ACCEPT\r\n-A cali-failsafe-out -p udp -m comment --comment \"cali:TNM3RfEjbNr72hgH\" -m multiport --dports 67 -j ACCEPT\r\n-A cali-failsafe-out -p tcp -m comment --comment \"cali:ycxKitIl4u3dK0HR\" -m multiport --dports 179 -j ACCEPT\r\n-A cali-failsafe-out -p tcp -m comment --comment \"cali:hxjEWyxdkXXkdvut\" -m multiport --dports 2379 -j ACCEPT\r\n-A cali-failsafe-out -p tcp -m comment --comment \"cali:cA_GLtruuvG88KiO\" -m multiport --dports 2380 -j ACCEPT\r\n-A cali-failsafe-out -p tcp -m comment --comment \"cali:Sb1hkLYFMrKS6r01\" -m multiport --dports 6666 -j ACCEPT\r\n-A cali-failsafe-out -p tcp -m comment --comment \"cali:UwLSebGONJUG4yG-\" -m multiport --dports 6667 -j ACCEPT\r\n-A cali-from-wl-dispatch -i cali760497f1014 -m comment --comment \"cali:btNvRWGS9Uc1--wZ\" -g cali-fw-cali760497f1014\r\n-A cali-from-wl-dispatch -i cali8594ba11505 -m comment --comment \"cali:7xg08ELbW_2BwUNt\" -g cali-fw-cali8594ba11505\r\n-A cali-from-wl-dispatch -i calicf8e623ea43 -m comment --comment \"cali:MXgqd9kDw1IoLnFq\" -g cali-fw-calicf8e623ea43\r\n-A cali-from-wl-dispatch -m comment --comment \"cali:R_rUYoMTp_Y20Pvq\" -m comment --comment \"Unknown interface\" -j DROP\r\n-A cali-fw-cali760497f1014 -m comment --comment \"cali:HwPuZaE8udxDVe6X\" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT\r\n-A cali-fw-cali760497f1014 -m comment --comment \"cali:lchRxTw8uJkvqAy7\" -m conntrack --ctstate INVALID -j DROP\r\n-A cali-fw-cali760497f1014 -m comment --comment \"cali:pkBP2_7UaVFs00FS\" -j MARK --set-xmark 0x0/0x1000000\r\n-A cali-fw-cali760497f1014 -m comment --comment \"cali:LJ_eriaJn-qS--1s\" -j cali-pro-kns.kube-system\r\n-A cali-fw-cali760497f1014 -m comment --comment \"cali:aQQiqtCp94gFrE4H\" -m comment --comment \"Return if profile accepted\" -m mark --mark 0x1000000/0x1000000 -j RETURN\r\n-A cali-fw-cali760497f1014 -m comment --comment \"cali:Jcijcqe-Qk-gm2jL\" -m comment --comment \"Drop if no profiles matched\" -j DROP\r\n-A cali-fw-cali8594ba11505 -m comment --comment \"cali:jS52NYKbyiOC3qME\" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT\r\n-A cali-fw-cali8594ba11505 -m comment --comment \"cali:lTtF738vxqFewrMG\" -m conntrack --ctstate INVALID -j DROP\r\n-A cali-fw-cali8594ba11505 -m comment --comment \"cali:O2aRve9PmrvmKDjK\" -j MARK --set-xmark 0x0/0x1000000\r\n-A cali-fw-cali8594ba11505 -m comment --comment \"cali:zGEL7My6RCPoIX85\" -j cali-pro-kns.default\r\n-A cali-fw-cali8594ba11505 -m comment --comment \"cali:ZQPTSS2mHPuxY26L\" -m comment --comment \"Return if profile accepted\" -m mark --mark 0x1000000/0x1000000 -j RETURN\r\n-A cali-fw-cali8594ba11505 -m comment --comment \"cali:6pzOMDX7P27iWW5s\" -m comment --comment \"Drop if no profiles matched\" -j DROP\r\n-A cali-fw-calicf8e623ea43 -m comment --comment \"cali:D3I3OjhrL7qQqzwR\" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT\r\n-A cali-fw-calicf8e623ea43 -m comment --comment \"cali:4JGZ_4cc7H-I3gtS\" -m conntrack --ctstate INVALID -j DROP\r\n-A cali-fw-calicf8e623ea43 -m comment --comment \"cali:aarFMNHyZ7MCf_Xb\" -j MARK --set-xmark 0x0/0x1000000\r\n-A cali-fw-calicf8e623ea43 -m comment --comment \"cali:5Kk0gGSPW5lTjnzS\" -j cali-pro-kns.kube-system\r\n-A cali-fw-calicf8e623ea43 -m comment --comment \"cali:lJBOWbwmrxOkuWDS\" -m comment --comment \"Return if profile accepted\" -m mark --mark 0x1000000/0x1000000 -j RETURN\r\n-A cali-fw-calicf8e623ea43 -m comment --comment \"cali:L4660BXZuZR_FU3S\" -m comment --comment \"Drop if no profiles matched\" -j DROP\r\n-A cali-pri-kns.default -m comment --comment \"cali:5yVkkQ7pBcxxkSaE\" -j MARK --set-xmark 0x1000000/0x1000000\r\n-A cali-pri-kns.default -m comment --comment \"cali:pZi5w5MrTl3DghSD\" -m mark --mark 0x1000000/0x1000000 -j RETURN\r\n-A cali-pri-kns.kube-system -m comment --comment \"cali:jVs-zlYSX3OG8546\" -j MARK --set-xmark 0x1000000/0x1000000\r\n-A cali-pri-kns.kube-system -m comment --comment \"cali:wbS84vjWKVIcWiCG\" -m mark --mark 0x1000000/0x1000000 -j RETURN\r\n-A cali-pro-kns.default -m comment --comment \"cali:gbqtfAKh_VXndzz6\" -j MARK --set-xmark 0x1000000/0x1000000\r\n-A cali-pro-kns.default -m comment --comment \"cali:JMure-l4CiemFMIB\" -m mark --mark 0x1000000/0x1000000 -j RETURN\r\n-A cali-pro-kns.kube-system -m comment --comment \"cali:B_J-7WG5VtOu-bQy\" -j MARK --set-xmark 0x1000000/0x1000000\r\n-A cali-pro-kns.kube-system -m comment --comment \"cali:_Xu55_wPL7ogYHes\" -m mark --mark 0x1000000/0x1000000 -j RETURN\r\n-A cali-to-wl-dispatch -o cali760497f1014 -m comment --comment \"cali:SgH8SZ2p7yHU21J5\" -g cali-tw-cali760497f1014\r\n-A cali-to-wl-dispatch -o cali8594ba11505 -m comment --comment \"cali:_2M9Z9a9p18n7wQX\" -g cali-tw-cali8594ba11505\r\n-A cali-to-wl-dispatch -o calicf8e623ea43 -m comment --comment \"cali:sNxqIDmwZi4H7tq-\" -g cali-tw-calicf8e623ea43\r\n-A cali-to-wl-dispatch -m comment --comment \"cali:JHgjJgzanocMZ1mf\" -m comment --comment \"Unknown interface\" -j DROP\r\n-A cali-tw-cali760497f1014 -m comment --comment \"cali:zrThrogfCh8Y2nYo\" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT\r\n-A cali-tw-cali760497f1014 -m comment --comment \"cali:AXdlwjDUaY2pTO3g\" -m conntrack --ctstate INVALID -j DROP\r\n-A cali-tw-cali760497f1014 -m comment --comment \"cali:PP8JFDh8KlAI3KKK\" -j MARK --set-xmark 0x0/0x1000000\r\n-A cali-tw-cali760497f1014 -m comment --comment \"cali:fHkZrXsYWnCA_5Wz\" -j cali-pri-kns.kube-system\r\n-A cali-tw-cali760497f1014 -m comment --comment \"cali:Elr81ubmQg_TKLO-\" -m comment --comment \"Return if profile accepted\" -m mark --mark 0x1000000/0x1000000 -j RETURN\r\n-A cali-tw-cali760497f1014 -m comment --comment \"cali:Xvdfce-QzGRHIVod\" -m comment --comment \"Drop if no profiles matched\" -j DROP\r\n-A cali-tw-cali8594ba11505 -m comment --comment \"cali:_-IvXbRS5Zv8ZD1w\" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT\r\n-A cali-tw-cali8594ba11505 -m comment --comment \"cali:_ZefvJfhlYH0SWeq\" -m conntrack --ctstate INVALID -j DROP\r\n-A cali-tw-cali8594ba11505 -m comment --comment \"cali:d3RTUJsAwhQo41gp\" -j MARK --set-xmark 0x0/0x1000000\r\n-A cali-tw-cali8594ba11505 -m comment --comment \"cali:-vul7suSFRHeXrEq\" -j cali-pri-kns.default\r\n-A cali-tw-cali8594ba11505 -m comment --comment \"cali:EmlzY4reMNRb3UZ7\" -m comment --comment \"Return if profile accepted\" -m mark --mark 0x1000000/0x1000000 -j RETURN\r\n-A cali-tw-cali8594ba11505 -m comment --comment \"cali:BNNJOWy9OOI_tKnw\" -m comment --comment \"Drop if no profiles matched\" -j DROP\r\n-A cali-tw-calicf8e623ea43 -m comment --comment \"cali:iPQfnGZvq-6vWckM\" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT\r\n-A cali-tw-calicf8e623ea43 -m comment --comment \"cali:dK4AfsX0qQOjoETY\" -m conntrack --ctstate INVALID -j DROP\r\n-A cali-tw-calicf8e623ea43 -m comment --comment \"cali:DqtECX--DEsSgCUo\" -j MARK --set-xmark 0x0/0x1000000\r\n-A cali-tw-calicf8e623ea43 -m comment --comment \"cali:Ys68MMb9Q8rXxCj3\" -j cali-pri-kns.kube-system\r\n-A cali-tw-calicf8e623ea43 -m comment --comment \"cali:Rw3g-Sg47oS_qcnU\" -m comment --comment \"Return if profile accepted\" -m mark --mark 0x1000000/0x1000000 -j RETURN\r\n-A cali-tw-calicf8e623ea43 -m comment --comment \"cali:tSV75lL-CSxHUNeP\" -m comment --comment \"Drop if no profiles matched\" -j DROP\r\n-A cali-wl-to-host -m comment --comment \"cali:Ee9Sbo10IpVujdIY\" -j cali-from-wl-dispatch\r\n-A cali-wl-to-host -m comment --comment \"cali:nSZbcOoG1xPONxb8\" -m comment --comment \"Configured DefaultEndpointToHostAction\" -j ACCEPT\r\n```\r\n\r\n**kubeadm version**:\r\n```\r\n$ kubeadm version\r\nkubeadm version: &version.Info{Major:\"1\", Minor:\"7\", GitVersion:\"v1.7.11\", GitCommit:\"b13f2fd682d56eab7a6a2b5a1cab1a3d2c8bdd55\", GitTreeState:\"clean\", BuildDate:\"2017-11-25T17:51:39Z\", GoVersion:\"go1.8.3\", Compiler:\"gc\", Platform:\"linux/amd64\"}\r\n```\r\n\r\n**Environment**:\r\n- **Kubernetes version**:\r\n```\r\n$ kubectl version\r\nClient Version: version.Info{Major:\"1\", Minor:\"7\", GitVersion:\"v1.7.11\", GitCommit:\"b13f2fd682d56eab7a6a2b5a1cab1a3d2c8bdd55\", GitTreeState:\"clean\", BuildDate:\"2017-11-25T18:34:52Z\", GoVersion:\"go1.8.3\", Compiler:\"gc\", Platform:\"linux/amd64\"}\r\nServer Version: version.Info{Major:\"1\", Minor:\"7\", GitVersion:\"v1.7.12\", GitCommit:\"3bda299a6414b4866f179921610d6738206a18fe\", GitTreeState:\"clean\", BuildDate:\"2017-12-29T08:39:49Z\", GoVersion:\"go1.8.3\", Compiler:\"gc\", Platform:\"linux/amd64\"}\r\n```\r\n- **OS**:\r\nUbuntu xenial VM:\r\n```\r\n$ cat /etc/os-release\r\nNAME=\"Ubuntu\"\r\nVERSION=\"16.04.3 LTS (Xenial Xerus)\"\r\nID=ubuntu\r\nID_LIKE=debian\r\nPRETTY_NAME=\"Ubuntu 16.04.3 LTS\"\r\nVERSION_ID=\"16.04\"\r\nHOME_URL=\"http://www.ubuntu.com/\"\r\nSUPPORT_URL=\"http://help.ubuntu.com/\"\r\nBUG_REPORT_URL=\"http://bugs.launchpad.net/ubuntu/\"\r\nVERSION_CODENAME=xenial\r\nUBUNTU_CODENAME=xenial\r\n```\r\n- **Kernel**:\r\n```\r\n$ uname -a\r\nLinux vhosakot-aci-1-m3710102e28 4.4.0-112-generic #135-Ubuntu SMP Fri Jan 19 11:48:36 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux\r\n```\r\n- **Others**:\r\n\r\n`iptables` version is `v1.6.0`.\r\n\r\nDocker version:\r\n```\r\n$ sudo docker info\r\nsudo: unable to resolve host vhosakot-aci-1-m3710102e28\r\nContainers: 0\r\n Running: 0\r\n Paused: 0\r\n Stopped: 0\r\nImages: 11\r\nServer Version: 1.13.1\r\nStorage Driver: aufs\r\n Root Dir: /var/lib/docker/aufs\r\n Backing Filesystem: extfs\r\n Dirs: 35\r\n Dirperm1 Supported: true\r\nLogging Driver: json-file\r\nCgroup Driver: cgroupfs\r\nPlugins: \r\n Volume: local\r\n Network: bridge host macvlan null overlay\r\nSwarm: inactive\r\nRuntimes: runc\r\nDefault Runtime: runc\r\nInit Binary: docker-init\r\ncontainerd version:  (expected: aa8187dbd3b7ad67d8e5e3a15115d3eef43a7ed1)\r\nrunc version: N/A (expected: 9df8b306d01f59d3a8029be411de015b7304dd8f)\r\ninit version: N/A (expected: 949e6facb77383876aeff8a6944dde66b3089574)\r\nSecurity Options:\r\n apparmor\r\n seccomp\r\n  Profile: default\r\nKernel Version: 4.4.0-112-generic\r\nOperating System: Ubuntu 16.04.3 LTS\r\nOSType: linux\r\nArchitecture: x86_64\r\nCPUs: 3\r\nTotal Memory: 15.67 GiB\r\nName: vhosakot-aci-1-m3710102e28\r\nID: EPSU:SV6W:HQOG:QHFI:CZRJ:WMEJ:TADP:PSSY:BP5T:7X6U:Y6A6:PGNC\r\nDocker Root Dir: /var/lib/docker\r\nDebug Mode (client): false\r\nDebug Mode (server): false\r\nRegistry: https://index.docker.io/v1/\r\nWARNING: No swap limit support\r\nExperimental: false\r\nInsecure Registries:\r\n 127.0.0.0/8\r\nLive Restore Enabled: false\r\n\r\n$ sudo docker version\r\nsudo: unable to resolve host vhosakot-aci-1-m3710102e28\r\nClient:\r\n Version:      1.13.1\r\n API version:  1.26\r\n Go version:   go1.6.2\r\n Git commit:   092cba3\r\n Built:        Thu Nov  2 20:40:23 2017\r\n OS/Arch:      linux/amd64\r\n\r\nServer:\r\n Version:      1.13.1\r\n API version:  1.26 (minimum version 1.12)\r\n Go version:   go1.6.2\r\n Git commit:   092cba3\r\n Built:        Thu Nov  2 20:40:23 2017\r\n OS/Arch:      linux/amd64\r\n Experimental: false\r\n```\r\n\r\nCalico CNI image versions:\r\n```\r\nregistry.ci.dfj.io/cpsg_ccp/quay.io/calico/typha:v0.6.0-5-g08e8985\r\nregistry.ci.dfj.io/cpsg_ccp/quay.io/calico/node:v3.0.1-65-g4d78be07\r\nregistry.ci.dfj.io/cpsg_ccp/quay.io/calico/cni:v2.0.0-4-g26ec250\r\n```\r\n\r\n## What happened?\r\nStale iptables rules were seen on all the nodes after `kubeadm reset` was done on all the nodes.\r\n\r\n## What you expected to happen?\r\nNo stale iptables rules and `kubeadm reset` must delete all the iptables rules installed by kubernetes and the CNI.\r\n\r\n## How to reproduce it (as minimally and precisely as possible)?\r\n`kubeadm reset` (see steps above)"},"comment":{"url":"https://api.github.com/repos/kubernetes/kubeadm/issues/comments/429040622","html_url":"https://github.com/kubernetes/kubeadm/issues/689#issuecomment-429040622","issue_url":"https://api.github.com/repos/kubernetes/kubeadm/issues/689","id":429040622,"node_id":"MDEyOklzc3VlQ29tbWVudDQyOTA0MDYyMg==","user":{"login":"timothysc","id":169553,"node_id":"MDQ6VXNlcjE2OTU1Mw==","avatar_url":"https://avatars0.githubusercontent.com/u/169553?v=4","gravatar_id":"","url":"https://api.github.com/users/timothysc","html_url":"https://github.com/timothysc","followers_url":"https://api.github.com/users/timothysc/followers","following_url":"https://api.github.com/users/timothysc/following{/other_user}","gists_url":"https://api.github.com/users/timothysc/gists{/gist_id}","starred_url":"https://api.github.com/users/timothysc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/timothysc/subscriptions","organizations_url":"https://api.github.com/users/timothysc/orgs","repos_url":"https://api.github.com/users/timothysc/repos","events_url":"https://api.github.com/users/timothysc/events{/privacy}","received_events_url":"https://api.github.com/users/timothysc/received_events","type":"User","site_admin":false},"created_at":"2018-10-11T17:13:38Z","updated_at":"2018-10-11T17:13:38Z","author_association":"MEMBER","body":"/assign @timothysc @liztio @rosti   \r\n/cc @rdodev @neolit123 \r\n"}}
{"actor":{"display_login":"timothysc"}}