gcp-routes had a rule "so that existing flows (with an entry in
conntrack) continue to be balanced, even if the DNAT entry is
removed". The only way this iptables rule would actually be needed is
if (a) your masters have an iptables-based firewall (which they
shouldn't, on OCP), and (b) the firewall is so aggressive that it even
drops packets from established connections (which no firewall should
do anyway).

At any rate, even if the rule *was* necessary in some clusters, it
won't work in future nftables-only versions of RHCOS anyway, because
nftables doesn't let "accept" rules in one table override
"drop"/"reject" rules in another table; if your firewall is broken and
dropping packets that it shouldn't, you have to actually fix your
firewall rules, not hack around them somewhere else.

IPTables is going away in RHEL 10 so everything needs to be done with nftables.

https://issues.redhat.com/browse/OCPSTRAT-940