Disable iptables bridge forwarding on initialization

[yaocw2020]

Problem:

In the Harvester cluster whose management network has a VLAN ID, the VM will be unable to access the host port or node port with the host IP where the VM is running.

Solution:

Disable net.bridge.bridge-nf-call-iptables to avoid iptables rules affecting bridge forwarding on vlan.init().

We could not disable net.bridge.bridge-nf-call-iptables in the harvester-installer because RKE2 will enable it after harvester-installer.

Related Issue: https://github.com/harvester/harvester/issues/3960

Test plan:

• Spin up a Harvester whose management network has a VLAN ID
• Create a VM with VLAN network whose VLAN ID is same with the management network.
• Curl nodeIP:443 in the VM.

[iosifnicolae2]

Isn't disabling net.bridge.bridge-nf-call-iptables a security risk?

[bk201]

@mergifyio backport v0.5.x

[mergify[bot]]

backport v0.5.x

✅ Backports have been created

• #120 Disable iptables bridge forwarding on initialization (backport #83) has been created for branch v0.5.x