Revert to default mount behaviour for xtables.lock

The xtables.lock mount was fixed to specify its type: it must exist as
a file, or be created as a file.

xtables.lock is only used with legacy iptables. On platforms using
iptables-nft, the file isn't used and doesn't exist. As a result,
previous versions of Submariner created it as a directory (this is the
default behaviour for volume mounts in Kubernetes: if the mount
doesn't exist, it is created as a directory). When the volume mount
type is specified as a file, the existence of a directory causes the
mount to fail and the corresponding pod is never scheduled.

To avoid this, revert to the default behaviour. On systems where the
lock is important, it already exists so the directory isn't created
and the correct behaviour is guaranteed. On systems where the lock
isn't needed, it is created as a directory but that doesn't matter.

Future releases of Submariner will have to deal with this correctly,
and handle upgrades, ideally without mounting all of /run
permanently.

Signed-off-by: Stephen Kitt <[email protected]>

controllers/submariner/globalnet_resources.go

@@ -72,7 +72,7 @@ func newGlobalnetDaemonSet(cr *v1alpha1.Submariner, name string) *appsv1.DaemonS
 				Spec: corev1.PodSpec{
 					Volumes: []corev1.Volume{
 						{Name: "host-run-xtables-lock", VolumeSource: corev1.VolumeSource{HostPath: &corev1.HostPathVolumeSource{
-							Path: "/run/xtables.lock", Type: ptr.To(corev1.HostPathFileOrCreate),
+							Path: "/run/xtables.lock",
 						}}},
 					},
 					Containers: []corev1.Container{

controllers/submariner/route_agent_resources.go

@@ -75,7 +75,7 @@ func newRouteAgentDaemonSet(cr *v1alpha1.Submariner, name string) *appsv1.Daemon
 					Volumes: []corev1.Volume{
 						// Share /run/xtables.lock with the host for iptables
 						{Name: "host-run-xtables-lock", VolumeSource: corev1.VolumeSource{HostPath: &corev1.HostPathVolumeSource{
-							Path: "/run/xtables.lock", Type: ptr.To(corev1.HostPathFileOrCreate),
+							Path: "/run/xtables.lock",
 						}}},
 						// Share /run/openvswitch/db.sock and /run/openvswitch/ovnnb_db.sock with the host for OVS/OVN
 						{Name: "host-run-openvswitch", VolumeSource: corev1.VolumeSource{HostPath: &corev1.HostPathVolumeSource{