{"action":"created","issue":{"url":"https://api.github.com/repos/coreos/coreos-kubernetes/issues/140","labels_url":"https://api.github.com/repos/coreos/coreos-kubernetes/issues/140/labels{/name}","comments_url":"https://api.github.com/repos/coreos/coreos-kubernetes/issues/140/comments","events_url":"https://api.github.com/repos/coreos/coreos-kubernetes/issues/140/events","html_url":"https://github.com/coreos/coreos-kubernetes/issues/140","id":116273200,"number":140,"title":"kube-proxy fails to start on node complaining about iptables","user":{"login":"utahcon","id":89753,"avatar_url":"https://avatars.githubusercontent.com/u/89753?v=3","gravatar_id":"","url":"https://api.github.com/users/utahcon","html_url":"https://github.com/utahcon","followers_url":"https://api.github.com/users/utahcon/followers","following_url":"https://api.github.com/users/utahcon/following{/other_user}","gists_url":"https://api.github.com/users/utahcon/gists{/gist_id}","starred_url":"https://api.github.com/users/utahcon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/utahcon/subscriptions","organizations_url":"https://api.github.com/users/utahcon/orgs","repos_url":"https://api.github.com/users/utahcon/repos","events_url":"https://api.github.com/users/utahcon/events{/privacy}","received_events_url":"https://api.github.com/users/utahcon/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-11-11T06:12:02Z","updated_at":"2015-11-12T22:39:44Z","closed_at":"2015-11-12T22:39:44Z","body":"Posted this in Kubernetes too, but they suggested I post here.\r\n\r\nWas following the CoreOS Kubernetes guide and when I got to booting the nodes, I ran into this error. Everything else is working swell.\r\n\r\nRan into this error on the CoreOS Alpha image today.\r\n\r\n### OS Version\r\n```\r\nLinux infraops-kubenode-004.iad.prod.zulily.com 4.2.0-coreos-r1 #2 SMP Thu Sep 17 04:31:47 UTC 2015 x86_64 Intel(R) Xeon(R) CPU E5-2670 0 @ 2.60GHz GenuineIntel GNU/Linux\r\n```\r\n\r\n### Error\r\n```\r\nNov 11 04:23:47 infraops-kubenode-005.iad.prod.zulily.com docker[4192]: W1111 04:23:47.127429       1 server.go:86] Failed to start in resource-only container \"/kube-proxy\": mkdir /sys/fs/cgroup/blkio/kube-proxy: read-only file system\r\nNov 11 04:23:47 infraops-kubenode-005.iad.prod.zulily.com docker[4192]: F1111 04:23:47.129901       1 server.go:101] Unable to create proxer: failed to initialize iptables: error creating chain \"KUBE-PORTALS-CONTAINER\": exit status 3: iptables v1.4.21: can't initialize iptables table `nat': Permission denied (you must be root)\r\nNov 11 04:23:47 infraops-kubenode-005.iad.prod.zulily.com docker[4192]: Perhaps iptables or your kernel needs to be upgraded\r\n```\r\n\r\n### Container Definition\r\n```\r\napiVersion: v1\r\nkind: Pod\r\nmetadata:\r\nname: kube-proxy\r\nnamespace: kube-system\r\nspec:\r\nhostNetwork: true\r\ncontainers:\r\n- name: kube-proxy\r\n  image: gcr.io/google_containers/hyperkube:v1.0.6\r\n  command:\r\n  - /hyperkube\r\n  - proxy\r\n  - --master=https://infraops-kubemaster-001.iad.prod.zulily.com\r\n  - --kubeconfig=/etc/kubernetes/worker-kubeconfig.yaml\r\n  securityContext:\r\n    priviledged: true\r\n  volumeMounts:\r\n    - mountPath: /etc/ssl/certs\r\n      name: ssl-certs\r\n    - mountPath: /etc/kubernetes/work-kubeconfig.yaml\r\n      name: kubeconfig\r\n      readOnly: true\r\n    - mountPath: /etc/kubernetes/ssl\r\n      name: etc-kube-ssl\r\n      readOnly: true\r\nvolumes:\r\n  - name: ssl-certs\r\n    hostPath:\r\n      path: /usr/share/ca-certificates\r\n  - name: kubeconfig\r\n    hostPath:\r\n      path: /etc/kubernetes/worker-kubeconfig.yaml\r\n  - name: etc-kube-ssl\r\n    hostPath:\r\n        path: /etc/kubernetes/ssl\r\n```"},"comment":{"url":"https://api.github.com/repos/coreos/coreos-kubernetes/issues/comments/156259874","html_url":"https://github.com/coreos/coreos-kubernetes/issues/140#issuecomment-156259874","issue_url":"https://api.github.com/repos/coreos/coreos-kubernetes/issues/140","id":156259874,"user":{"login":"utahcon","id":89753,"avatar_url":"https://avatars.githubusercontent.com/u/89753?v=3","gravatar_id":"","url":"https://api.github.com/users/utahcon","html_url":"https://github.com/utahcon","followers_url":"https://api.github.com/users/utahcon/followers","following_url":"https://api.github.com/users/utahcon/following{/other_user}","gists_url":"https://api.github.com/users/utahcon/gists{/gist_id}","starred_url":"https://api.github.com/users/utahcon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/utahcon/subscriptions","organizations_url":"https://api.github.com/users/utahcon/orgs","repos_url":"https://api.github.com/users/utahcon/repos","events_url":"https://api.github.com/users/utahcon/events{/privacy}","received_events_url":"https://api.github.com/users/utahcon/received_events","type":"User","site_admin":false},"created_at":"2015-11-12T22:39:44Z","updated_at":"2015-11-12T22:39:44Z","body":"Turned out the problem was a typo in my securityContext. Thanks for looking!"}}