Set iptables backend to NFT for Canal and Calico VXLAN on Flatcar clusters

[xmudrii]

What this PR does / why we need it:

It happens that after upgrading Canal/Calico to a newer minor version, the pod network connectivity stops working for some reason. This mostly happens on Flatcar-based clusters and not always, but from time to time. This is a known upstream Calico issue and it's being tracked here: projectcalico/calico#5760

As mentioned in projectcalico/calico#5760 (comment), the solution is to set FELIX_IPTABLESBACKEND to NFT.

If there's a Flatcar control plane node in the cluster, KubeOne will set FELIX_IPTABLESBACKEND to NFT. Otherwise, KubeOne will set FELIX_IPTABLESBACKEND to Auto, which is the current default value and results in Calico automatically determining the iptables backend.

This can be overridden by setting the iptablesBackend parameter on Canal or Calico VXLAN addon. For example:

apiVersion: kubeone.k8c.io/v1beta2
kind: KubeOneCluster
...
addons:
  enable: true
  addons:
    - name: cni-canal # or calico-vxlan if cluster is running Calico VXLAN
      params:
        iptablesBackend: "Auto"

This might also affect RHEL, but from our testing, it's much less frequent than for Flatcar. To reduce the scope of changes before the release, we'll revisit this after releasing KubeOne 1.5.

What type of PR is this?

/kind bug

Does this PR introduce a user-facing change? Then add your Release Note here:

Set iptables backend (`FELIX_IPTABLESBACKEND`) to `NFT` for Canal and Calico VXLAN on clusters running Flatcar Linux. For non Flatcar clusters, iptables backend is set to Auto, which is the default value and results in Calico determining the iptables backend automatically. The value can be overridden by setting the `iptablesBackend` addon parameter (see the PR description for an example).

Documentation:

NONE

[kubermatic-bot]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[xmudrii]

/retest

[rastislavs]

/lgtm

[kubermatic-bot]

LGTM label has been added.

Git tree hash: 14cb46982cce48c5032a6e31dbd10888284c91b0

[moadqassem]

/approve
/lgtm

[kubermatic-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: moadqassem

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [moadqassem]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment