前言：
kubernetes的网络系统主要由kube-proxy负责，其支持iptables和ipvs以及userspace三种网络负载均衡，在更新负载均衡策略为ipvs后，查看kube-proxy的日志，发现如下警告：
Jul 16 09:32:09 k8s-node1 kube-proxy: I0716 09:32:09.536704 7242 proxier.go:1848] \
Not using `--random-fully` in the MASQUERADE rule for iptables because \
the local version of iptables does not support it
可以看出，此警告仅仅是警告，好像不影响kubernetes集群的运行，但本着万一的原则，还是尽量消除此警告。
此警告表示iptables不支持本地升级，也就是iptables的版本过低，查询iptables的版本如下：
因此，计划升级iptables到1.6.2，现将iptables的升级过程记录下来，以免后面的人踩坑。
一，
安装依赖
配置阿里云epel源（centos7的）：
wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo
yum install gcc make libnftnl-devel libmnl-devel autoconf automake libtool bison flex libnetfilter_conntrack-devel libnetfilter_queue-devel libpcap-devel
这里要注意一哈，libmnl-devel，libnftnl-devel等等几个包需要配置epel源才可以安装，如果有依赖没有安装，比如libmnl-devel，那么编译的时候会报错：
checking for libmnl... no
*** Error: No suitable libmnl found. ***
Please install the 'libmnl' package
Or consider --disable-nftables to skip
iptables-compat over nftables support.
如果libnetfilter_conntrack-devel没有安装，将会报模块connlabel 没找到。
二，
解压源码包，并进入解压目录，准备编译
wget https://www.netfilter.org/projects/iptables/files/iptables-1.6.2.tar.bz2 --no-check-certificate
tar jxf iptables-1.6.2.tar.bz2
cd iptables-1.6.2
./autogen.sh #此命令输出如下：
#libtoolize: putting auxiliary files in AC_CONFIG_AUX_DIR, `build-aux'.
libtoolize: copying file `build-aux/ltmain.sh'
libtoolize: putting macros in AC_CONFIG_MACRO_DIR, `m4'.
libtoolize: copying file `m4/libtool.m4'
libtoolize: copying file `m4/ltoptions.m4'
libtoolize: copying file `m4/ltsugar.m4'
libtoolize: copying file `m4/ltversion.m4'
libtoolize: copying file `m4/lt~obsolete.m4'
三，
开始编译
这里说明一哈，都是使用的默认编译，编译产物在/usr/local/sbin目录下
输出如下：
config.status: creating include/iptables/internal.h
config.status: creating utils/nfnl_osf.8
config.status: creating config.h
config.status: executing depfiles commands
config.status: executing libtool commands
Iptables Configuration:
IPv4 support: yes
IPv6 support: yes
Devel support: yes
IPQ support: no
Large file support: yes
BPF utils support: no
nfsynproxy util support: no
nftables support: yes
connlabel support: yes
Build parameters:
Put plugins into executable (static): no
Support plugins via dlopen (shared): yes
Installation prefix (--prefix): /usr/local
Xtables extension directory: /usr/local/lib/xtables
Pkg-config directory: /usr/local/lib/pkgconfig
Xtables lock file: /run/xtables.lock
Host: x86_64-unknown-linux-gnu
GCC binary: gcc
安装：
输出如下：
/usr/bin/mkdir -p '/usr/local/share/man/man1'
/usr/bin/install -c -m 644 iptables-xml.1 '/usr/local/share/man/man1'
/usr/bin/mkdir -p '/usr/local/share/man/man8'
/usr/bin/install -c -m 644 iptables.8 iptables-restore.8 iptables-save.8 ip6tables.8 ip6tables-restore.8 ip6tables-save.8 iptables-extensions.8 '/usr/local/share/man/man8'
/usr/bin/mkdir -p '/usr/local/lib/pkgconfig'
/usr/bin/install -c -m 644 xtables.pc '/usr/local/lib/pkgconfig'
make[3]: Leaving directory `/root/iptables-1.6.2/iptables'
make[2]: Leaving directory `/root/iptables-1.6.2/iptables'
make[1]: Leaving directory `/root/iptables-1.6.2/iptables'
make[1]: Entering directory `/root/iptables-1.6.2'
make[2]: Entering directory `/root/iptables-1.6.2'
make[2]: Nothing to be done for `install-exec-am'.
/usr/bin/mkdir -p '/usr/local/etc'
/usr/bin/install -c -m 644 etc/ethertypes '/usr/local/etc'
make[2]: Leaving directory `/root/iptables-1.6.2'
make[1]: Leaving directory `/root/iptables-1.6.2'
四，
拷贝文件并检测成果
[root@master iptables-1.6.2]# cp /usr/local/sbin/{iptables,iptables-restore,iptables-save} /sbin/
cp: overwrite ‘/sbin/iptables’? y
cp: overwrite ‘/sbin/iptables-restore’? y
cp: overwrite ‘/sbin/iptables-save’? y
[root@master iptables-1.6.2]# lsmod |grep iptable
iptable_mangle 16384 1
iptable_filter 16384 1
iptable_nat 16384 1
nf_nat 49152 2 iptable_nat,xt_MASQUERADE
ip_tables 28672 3 iptable_filter,iptable_nat,iptable_mangle
重启kubelet和kube-proxy这两个服务，并查看日志，在也没有警告了，完美解决：
systemctl restart kubelet kube-proxy
0926 17:55:30.579345 10995 server_others.go:183] DetectLocalMode: 'ClusterCIDR'
I0926 17:55:30.579358 10995 server_others.go:259] Using ipvs Proxier.
I0926 17:55:30.580050 10995 proxier.go:426] nodeIP: 192.168.217.16, isIPv6: false
I0926 17:55:30.580518 10995 server.go:583] Version: v1.18.3
I0926 17:55:30.581269 10995 conntrack.go:52] Setting nf_conntrack_max to 262144
I0926 17:55:30.581794 10995 config.go:133] Starting endpoints config controller
I0926 17:55:30.581882 10995 shared_informer.go:223] Waiting for caches to sync for endpoints config
I0926 17:55:30.581882 10995 config.go:315] Starting service config controller
I0926 17:55:30.582000 10995 shared_informer.go:223] Waiting for caches to sync for service config
I0926 17:55:30.583390 10995 reflector.go:175] Starting reflector *v1.Service (15m0s) from k8s.io/client-go/informers/factory.go:135
I0926 17:55:30.586917 10995 reflector.go:175] Starting reflector *v1.Endpoints (15m0s) from k8s.io/client-go/informers/factory.go:135
I0926 17:55:30.682204 10995 shared_informer.go:230] Caches are synced for endpoints config
I0926 17:55:30.682313 10995 proxier.go:997] Not syncing ipvs rules until Services and Endpoints have been received from master
I0926 17:55:30.682462 10995 shared_informer.go:230] Caches are synced for service config
I0926 17:55:30.683027 10995 service.go:379] Adding new service port "default/kubernetes:https" at 10.0.0.1:443/TCP
I0926 17:55:30.683152 10995 service.go:379] Adding new service port "kube-system/coredns:dns-tcp" at 10.0.0.2:53/TCP
I0926 17:55:30.683165 10995 service.go:379] Adding new service port "kube-system/coredns:dns" at 10.0.0.2:53/UDP
I0926 17:55:30.683246 10995 proxier.go:1028] Stale udp service kube-system/coredns:dns -> 10.0.0.2
