Adolfo Delorenzo
7e46f8fdc2
Some checks failed
ARM64 Build / Build generic ARM64 disk image (push) Failing after 6s
CI / Go Tests (push) Successful in 2m40s
CI / Shellcheck (push) Successful in 1m39s
CI / Build Go Binaries (amd64, linux, linux-amd64) (push) Failing after 10s
CI / Build Go Binaries (arm64, linux, linux-arm64) (push) Failing after 7s
Third KubeSolo crash from the QEMU validation loop:
nft add table ip kubesolo-masq: exit status 1
Error: Could not process rule: Operation not supported
That's EOPNOTSUPP from netlink. nf_tables core is loaded (the binary
even runs cleanly now after the previous dual-glibc fix), but no address
families are registered with it — so any `nft add table ip ...`,
`add table inet ...`, etc. is rejected.
In modern Linux (5.x / 6.x) the nftables address families are gated by
separate BOOL Kconfigs:
CONFIG_NF_TABLES_IPV4 "ip" family
CONFIG_NF_TABLES_IPV6 "ip6" family
CONFIG_NF_TABLES_INET "inet" family (both)
CONFIG_NF_TABLES_NETDEV "netdev" family
These are bool (not tristate) — they must be built into the kernel; no
module to load at runtime. Our shared kernel-container.fragment had
CONFIG_NF_TABLES=m (the core) but none of the family Kconfigs, and the
arm64 defconfig leaves them off.
Fix: enable all four families as =y in kernel-container.fragment.
Also pin the NFT expression modules KubeSolo v1.1.4+'s masquerade
ruleset depends on (NFT_NAT, NFT_MASQ, NFT_CT, NFT_REDIR, NFT_REJECT,
NFT_REJECT_INET, NFT_COMPAT, NFT_FIB + FIB_IPV4/6) as =m — they're
already in modules-arm64.list / modules.list and get modprobed at boot,
this just makes sure olddefconfig doesn't strip them when applied on
top of a minimal defconfig.
NF_NAT_MASQUERADE pinned =y because NFT_MASQ select-depends on it; on
some kernels it would get auto-selected, on others it gets dropped by
olddefconfig if not pinned.
This change requires a kernel rebuild — the configs are bool / module
defs, not runtime knobs. On the Odroid:
rm -rf build/cache/kernel-arm64-generic
sudo make kernel-arm64 # ~30-60 min from scratch
sudo make rootfs-arm64 disk-image-arm64
x86 needs the same treatment when we cut v0.3.1.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
3.1 KiB
3.1 KiB