Description

After rebooting to Flatcar stable 3033.2.0, /run/xtables.lock file is no longer present on the host due to iptables upgrade to use nftables backend.

Impact

In my case, I run kubelet in a Docker container, so I have to bind-mount /run/xtables.lock from host into kubelet container to avoid concurrent modification of iptables rules. Because of this and lack of this file after the reboot, Kubernetes node failed to come back after a reboot. Fortunately FLUO did not proceed with upgrading next nodes.

Workaround

The issue can be at least temporarily workaround by executing the following commands before the reboot for upgrade:

sudo mkdir -p /etc/systemd/system/docker.service.d

cat <<EOF | sudo tee /etc/systemd/system/docker.service.d/override.conf
[Unit]
Requries=systemd-tmpfiles-setup.service
After=systemd-tmpfiles-setup.service
EOF

cat << EOF | sudo tee /etc/tmpfiles.d/xtables-workaround.conf
f       /run/xtables.lock       0755    root    root    -       -
EOF

Additional information

Opening mainly for documentation purposes requested by @t-lo.