Missing xt_recent kernel module resulting in inability to run Kubernetes with Session Affinity #7124

Windows Build Number

Microsoft Windows [Version 10.0.19042.1055]

WSL Version

• WSL 2
• WSL 1

Kernel Version

No response

Distro Version

Ubuntu 20.04

Other Software

Kind, v0.11.1
Kubernetes, v1.20.7
Docker Desktop (Windows), version 3.4.0

Repro Steps

1. Install Docker Desktop (link)
2. Get Kind (link)

   go get sigs.k8s.io/kind@v0.11.1

3. Create a Kubernetes cluster

   kind create cluster

4. Create a Service in Kubernetes with sessionAffinity: ClientIP (kubectl apply -f service.yaml).

   # service.yaml
   ---
   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: session-affinity-test
   spec:
     selector:
       matchLabels:
         app: session-affinity-test
     template:
       metadata:
         labels:
           app: session-affinity-test
       spec:
         containers:
         - name: session-affinity-test
           image: mendhak/http-https-echo
           resources:
             limits:
               memory: "128Mi"
               cpu: "500m"
           ports:
           - containerPort: 8080
             name: web
   ---
   apiVersion: v1
   kind: Service
   metadata:
     name: session-affinity-service
     namespace: default
   spec:
     ports:
     - name: web
       port: 9093
       targetPort: web
     selector:
       app: session-affinity-test
     sessionAffinity: ClientIP    

5. Try to access the service, or view Kube Proxy logs

Expected Behavior

Kube Proxy should have successfully applied iptables rules and Kubernetes service is accessible.

Some discussion about this issue: kubernetes-sigs/kind#1740.

Yes, it looks like the current WSL2 Kernel is built without xt_recent, needed by iptables -m recent ... which kube-proxy uses to implement sessionAffinity: ClientIP. Custom Kernel built with CONFIG_NETFILTER_XT_MATCH_RECENT=y fixed it for me. Submitted microsoft/WSL2-Linux-Kernel#198 (4.19.y) and microsoft/WSL2-Linux-Kernel#199 (5.4.y)

Actual Behavior

Service is inaccessible and any other service created afterwards is inaccessible. Which is caused by inability to apply iptables rules.

The following log is present in Kube Proxy:

E0720 14:29:10.934607       1 proxier.go:1507] Failed to execute iptables-restore: exit status 2 (iptables-restore v1.8.3 (legacy): Couldn't load match `recent':No such file or directory

Error occurred at line: 96
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
)
I0720 14:29:10.934636       1 proxier.go:779] Sync failed; retrying in 30s

Diagnostic Logs

No response