chore(helm)!: change iptables default mode to nft

charts/linkerd-control-plane/values.yaml

@@ -317,7 +317,7 @@ proxyInit:
   # proxy-init can be run either in 'nft' or in 'legacy' mode. The mode will
   # control which utility binary will be called. The host must support
   # whichever mode will be used
-  iptablesMode: "legacy"
+  iptablesMode: "nft"
   # -- Default set of inbound ports to skip via iptables
   # - Galera (4567,4568)
   ignoreInboundPorts: "4567,4568"

charts/linkerd2-cni/values.yaml

@@ -32,7 +32,7 @@ useWaitFlag:      false
 # are 'nft', 'legacy' and 'plain'. They invoke the 'iptables-nft',
 # 'iptables-legacy' and 'iptables' commands respectively. The 'plain' mode is
 # targeted at RHEL, which ships with an nftables-based 'iptables' command.
-iptablesMode: "legacy"
+iptablesMode: "nft"
 # -- Disables adding IPv6 rules on top of IPv4 rules
 disableIPv6: true
 # -- Kubernetes priorityClassName for the CNI plugin's Pods

cli/cmd/testdata/inject-filepath/expected/injected_nginx.yaml

@@ -203,6 +203,10 @@ spec:
           name: http
       initContainers:
       - args:
+        - --firewall-bin-path
+        - iptables-nft
+        - --firewall-save-bin-path
+        - iptables-nft-save
         - --ipv6=false
         - --incoming-proxy-port
         - "4143"

cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.yaml

@@ -203,6 +203,10 @@ spec:
           name: server
       initContainers:
       - args:
+        - --firewall-bin-path
+        - iptables-nft
+        - --firewall-save-bin-path
+        - iptables-nft-save
         - --ipv6=false
         - --incoming-proxy-port
         - "4143"
@@ -453,6 +457,10 @@ spec:
           name: http
       initContainers:
       - args:
+        - --firewall-bin-path
+        - iptables-nft
+        - --firewall-save-bin-path
+        - iptables-nft-save
         - --ipv6=false
         - --incoming-proxy-port
         - "4143"

cli/cmd/testdata/inject-filepath/expected/injected_redis.yaml

@@ -203,6 +203,10 @@ spec:
           name: server
       initContainers:
       - args:
+        - --firewall-bin-path
+        - iptables-nft
+        - --firewall-save-bin-path
+        - iptables-nft-save
         - --ipv6=false
         - --incoming-proxy-port
         - "4143"