From 905492223b99a070709c3d6d9375d2c249ab6339 Mon Sep 17 00:00:00 2001
From: Dan Winship <danwinship@redhat.com>
Date: Mon, 15 Sep 2025 13:38:30 -0400
Subject: [PATCH] Remove workaround for an old bug.

Kubernetes no longer supports containerd 1.7, and the workaround is
not needed with containerd 2.x (or cri-o).
---
 cmd/kube-proxy/app/conntrack.go    | 45 ------------------------------
 cmd/kube-proxy/app/server_linux.go | 10 +------
 2 files changed, 1 insertion(+), 54 deletions(-)

diff --git a/cmd/kube-proxy/app/conntrack.go b/cmd/kube-proxy/app/conntrack.go
index b8a9eda6011..2250cbe92a0 100644
--- a/cmd/kube-proxy/app/conntrack.go
+++ b/cmd/kube-proxy/app/conntrack.go
@@ -18,14 +18,12 @@ package app
 
 import (
 	"context"
-	"errors"
 	"os"
 	"strconv"
 	"strings"
 
 	"k8s.io/component-helpers/node/util/sysctl"
 	"k8s.io/klog/v2"
-	"k8s.io/mount-utils"
 )
 
 // Conntracker is an interface to the global sysctl. Descriptions of the various
@@ -50,8 +48,6 @@ type Conntracker interface {
 type realConntracker struct {
 }
 
-var errReadOnlySysFS = errors.New("readOnlySysFS")
-
 func (rct realConntracker) SetMax(ctx context.Context, max int) error {
 	logger := klog.FromContext(ctx)
 	logger.Info("Setting nf_conntrack_max", "nfConntrackMax", max)
@@ -68,20 +64,6 @@ func (rct realConntracker) SetMax(ctx context.Context, max int) error {
 		return nil
 	}
 
-	// sysfs is expected to be mounted as 'rw'. However, it may be unexpectedly
-	// mounted as 'ro' by docker because of known bugs (https://issues.k8s.io/134108).
-	// In that case we return a special error errReadOnlySysFS here, which the caller
-	// should deal with specially.
-	//
-	// TODO: this workaround can go away once we no longer support containerd 1.7.
-	writable, err := rct.isSysFSWritable(ctx)
-	if err != nil {
-		return err
-	}
-	if !writable {
-		return errReadOnlySysFS
-	}
-
 	logger.Info("Setting conntrack hashsize", "conntrackHashsize", max/4)
 	return writeIntStringFile("/sys/module/nf_conntrack/parameters/hashsize", max/4)
 }
@@ -120,33 +102,6 @@ func (rct realConntracker) setIntSysCtl(ctx context.Context, name string, value
 	return nil
 }
 
-// isSysFSWritable checks /proc/mounts to see whether sysfs is 'rw' or not.
-func (rct realConntracker) isSysFSWritable(ctx context.Context) (bool, error) {
-	logger := klog.FromContext(ctx)
-	const permWritable = "rw"
-	const sysfsDevice = "sysfs"
-	m := mount.New("" /* default mount path */)
-	mountPoints, err := m.List()
-	if err != nil {
-		logger.Error(err, "Failed to list mount points")
-		return false, err
-	}
-
-	for _, mountPoint := range mountPoints {
-		if mountPoint.Type != sysfsDevice {
-			continue
-		}
-		// Check whether sysfs is 'rw'
-		if len(mountPoint.Opts) > 0 && mountPoint.Opts[0] == permWritable {
-			return true, nil
-		}
-		logger.Error(nil, "Sysfs is not writable", "mountPoint", mountPoint, "mountOptions", mountPoint.Opts)
-		return false, errReadOnlySysFS
-	}
-
-	return false, errors.New("no sysfs mounted")
-}
-
 func readIntStringFile(filename string) (int, error) {
 	b, err := os.ReadFile(filename)
 	if err != nil {
diff --git a/cmd/kube-proxy/app/server_linux.go b/cmd/kube-proxy/app/server_linux.go
index d75d597dda1..eb3ae2d0820 100644
--- a/cmd/kube-proxy/app/server_linux.go
+++ b/cmd/kube-proxy/app/server_linux.go
@@ -304,15 +304,7 @@ func (s *ProxyServer) setupConntrack(ctx context.Context, ct Conntracker) error
 	if max > 0 {
 		err := ct.SetMax(ctx, max)
 		if err != nil {
-			if err != errReadOnlySysFS {
-				return err
-			}
-			// errReadOnlySysFS means we ran into a known container runtim bug
-			// (https://issues.k8s.io/134108). For historical reasons we ignore
-			// this problem and just alert the admin that it occurred.
-			const message = "CRI error: /sys is read-only: " +
-				"cannot modify conntrack limits, problems may arise later (If running Docker, see docker issue #24000)"
-			s.Recorder.Eventf(s.NodeRef, nil, v1.EventTypeWarning, err.Error(), "StartKubeProxy", message)
+			return err
 		}
 	}