Unable to connect because of xtables lock

[SteveCurran]

Describe Bug
Unable to connect to pod because another process has an xtables lock

"Bridge to Kubernetes initialization (VS Code v1.76.2 - Extension v2.0.120230310)
Logs: /home/steve/.config/Code/logs/20230329T125341/window1/exthost/mindaro.mindaro/mindaro-vscode-2023-03-29T17-53-45.566Z.txt
Waiting for 'cspbatch-746df866f9-rpt74' in namespace 'k8sdev' to reach running state...
Deployment 'k8sdev/cspbatch' patched to run agent.
Remote agent deployed in container 'cspbatch' in pod 'cspbatch-746df866f9-rpt74'.
Preparing to run Bridge To Kubernetes configured as pod k8sdev/cspbatch-746df866f9-rpt74 ...
Connection established.
Running 'iptables' failed with exit code '4': 'Waiting for process 942159
Another app is currently holding the xtables lock. Perhaps you want to use the -w option?
Process has exited with exit code 4
'
Stopping workload and cleaning up...
Restore: Deployment 'cspbatch' restored to original state with image 'localhost:5000/batch:latest'.
Failed to establish a connection. Error: Running 'iptables' failed with exit code '4': 'Waiting for process 942159
Another app is currently holding the xtables lock. Perhaps you want to use the -w option?
Process has exited with exit code 4"

I am able to successfully connect after restarting the ubuntu vm.

Mention the platform you are using
I am running b2k on ubuntu 20.04, vscode, and local k3s

mindaro-vscode-2023-03-29T17-53-45.566Z.txt

[hsubramanianaks]

@SteveCurran Thanks for raising this issue. are you facing this problem every time you use Bridge, or it is intermittent? Can you check and send the output screenshot here if you see any process running for PID 942159 in your machine and what is that process ? As far as I know when bridge tries to run the iptables command, it fails due to another app ex: firewalld has the xtables locked.

I can improvise on this by adding wait time with command -w but wanted to know if this is happening always. :)

[SteveCurran]

@hsubramanianaks I spent a lot of time trying to identify the offending process. The process starts and stops very quickly, so its impossible to see in the monitor app in ubuntu. I ran atop with an interval of 0 and entered "t" to take a snap shot of processes and finally got one. Unfortunately, atop shows "?" for the cid "command identifier", but it is another iptables command. I see a lot of iptable commands when first launching the debugger and establishing a connection. The issue is intermittent, sometimes if occurs repeatedly. Of course if I use the option of keeping the connection open, I don't run into this problem. I suspect this is related to running k3s locally. I do notice that the dsc and kubectl processes seem to appear and disappear with this problem.

[hsubramanianaks]

@SteveCurran I tried with kind, minikube and aks clusters, I didn't face this issue. Maybe it is related to k3s or version of linux OS you are running. Since there is workaround, is it okay to leave this comment and close this issue, please let me know, thank you.

[SteveCurran]

@hsubramanianaks It would be great if you could add the -w option when trying to obtain the xtables lock, it seems as if a process has a lock and waiting should solve the problem.

[hsubramanianaks]

@SteveCurran waiting for 60 seconds should be suffice right ? I will be doing a PR soon for it. Thanks.