Hi all,
So I just finished deploying a rancher HA cluster using the below
RKE version: 1.10
Kubernetes version: 1.17.4
Docker: 19.03.6
Centos 7.7 - kernel - 3.10.0-1062.12.1.el7.x86_64
3 nodes with all roles each
Firewalld enabled ports allowed as per documentation
I was making sure everything was working as expected and was going through the log files when I noticed the messages log was being flooded with the below. This is happening on all 3 nodes
kernel: STATE_INVALID_DROP: IN=ens192 OUT= MAC= SRC= DST= LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=634 DF PROTO=TCP SPT=60552 DPT=2380 WINDOW=0 RES=0x00 RST URGP=0
The DST port 2380 indicates etcd and after checking the etcd container logs and etcd cluster health could not find any issues.
These seem to be RST Packets which are marked invalid by conntrack and blocked by IPTables - can see the rule as per below.
I doubt this is normal behavour can somebody shed light to this ?
Thanks