support kube-proxy nftables mode

[aojea]

/hold

wait until 1.31 graduates it to beta

Fixes: #3434

[aojea]

/cc @danwinship

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: aojea

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [aojea]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[aojea]

@BenTheElder the problem with this option is to keep compatibility with old version, as it only will work with new versions ... I can't remember if we have some precedent like this

[BenTheElder]

@BenTheElder the problem with this option is to keep compatibility with old version, as it only will work with new versions ... I can't remember if we have some precedent like this

This is true with feature gates, not exactly the same as those are totally user supplied strings.

[BenTheElder]

Actually, we will need to internally version-check at cluster config time anyhow and enable NFTablesProxyMode feature gate? Or do we expect the user to do this?

It's new that we have our own config option for an alpha feature.

[danwinship]

It's new that we have our own config option for an alpha feature.

no, you missed:

wait until 1.31 graduates it to beta

[BenTheElder]

Sorry, yes, SGTM.

I think we should just document that it's 1.31+, we allow clusters with mixed versions and only advanced users will be setting this field anyhow.

[aojea]

/hold cancel

K/K PR is already merged and this will allow to set up CI without having to use additional scripting kubernetes/kubernetes#124383

[danwinship]

/lgtm