Persist the bridge-nf-call-iptables across rke2 restart

[mingshuoqiu]

The bridge-nf-call-iptables should be disabled by network-controller. But rke2 will toggle it back to enable. Need to make sure it stays at disabled.

Problem:
harvester/harvester#7041

Solution:
persist the bridge-nf-call-iptables across rke2 restart

Related Issue:
harvester/harvester#3960

Test plan:

1. Install Harvester on any Node
2. Make sure the value is 0 of command sysctl -a | grep net.bridge.bridge-nf-call-iptables
3. do systemctl restart rke2-server on management node
4. do systemctl restart rke2-agent on worker node
5. verify the value of step 2 and make sure it's still zero

[w13915984028]

How about another 2 options? thanks.

sysctl -a | grep bridge
net.bridge.bridge-nf-call-arptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 0

https://wiki.libvirt.org/Net.bridge.bridge-nf-call_and_sysctl.conf.html

[starbops]

Looks like this is the only way to cope with the issue right now. The kernel tunable is hardcoded to 1 in k3s: https://github.com/k3s-io/k3s/blob/55cda2200e0f3e670970b044871f9ea09134cff6/pkg/agent/syssetup/setup.go#L48

LGTM, thank you.

[mingshuoqiu]

How about another 2 options? thanks.

sysctl -a | grep bridge
net.bridge.bridge-nf-call-arptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 0

https://wiki.libvirt.org/Net.bridge.bridge-nf-call_and_sysctl.conf.html

The ip6tables doesn't take effect since we support IPv4 only now.
the arptables is for ARP packet which won't affect the HTTP(s) traffic in this case.
I'll leave them as-is.

[mingshuoqiu]

How about another 2 options? thanks.

sysctl -a | grep bridge
net.bridge.bridge-nf-call-arptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 0

https://wiki.libvirt.org/Net.bridge.bridge-nf-call_and_sysctl.conf.html

The ip6tables doesn't take effect since we support IPv4 only now. the arptables is for ARP packet which won't affect the HTTP(s) traffic in this case. I'll leave them as-is.

@w13915984028 gentle ping. What do you think about it? Thanks

[w13915984028]

LGTM, thanks.

[bk201]

@mingshuoqiu The PR needs to be backported to the v1.4/v1.3 branch before moving the issue to ready for testing.