Fix TCP_CLOSE_WAIT test to use agnhost rather than distroless-iptables

Originally, this test used the conntrack binary to check the conntrack
state, so it used the distroless-iptables image (the base of the
kube-proxy image) as a helper, since that contained the conntrack
binary. But later, we removed conntrack from that image after
kube-proxy no longer needed it, and the test got updated to read
/proc/net/nf_conntrack directly. Thus, there is no longer any reason
to be using distroless-iptables (and forcing the distroless-iptables
image to contain "sleep", "cat", and "grep").

(The test still had code to use the conntrack binary if
/proc/net/nf_conntrack was unavailable, but this fallback would never
be used because the image it was using never contained that binary.)

build/dependencies.yaml

@@ -163,8 +163,6 @@ dependencies:
     refPaths:
     - path: build/common.sh
       match: __default_distroless_iptables_version=
-    - path: test/utils/image/manifest.go
-      match: configs\[DistrolessIptables\] = Config{list\.BuildImageRegistry, "distroless-iptables", "v([0-9]+)\.([0-9]+)\.([0-9]+)"}
 
   - name: "registry.k8s.io/go-runner: dependents"
     version: v2.4.0-go1.27.3-trixie.0

test/e2e/network/kube_proxy.go

@@ -43,7 +43,6 @@ import (
 	e2epodoutput "k8s.io/kubernetes/test/e2e/framework/pod/output"
 	e2eskipper "k8s.io/kubernetes/test/e2e/framework/skipper"
 	"k8s.io/kubernetes/test/e2e/network/common"
-	imageutils "k8s.io/kubernetes/test/utils/image"
 	admissionapi "k8s.io/pod-security-admission/api"
 	netutils "k8s.io/utils/net"
 )
@@ -109,31 +108,10 @@ var _ = common.SIGDescribe("KubeProxy", func() {
 			nodeIP: ips[0],
 		}
 
-		// Create a pod to check the conntrack entries on the host node
-		privileged := true
-
-		hostExecPod := &v1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      "e2e-net-exec",
-				Namespace: fr.Namespace.Name,
-				Labels:    map[string]string{"app": "e2e-net-exec"},
-			},
-			Spec: v1.PodSpec{
-				HostNetwork: true,
-				NodeName:    clientNodeInfo.name,
-				Containers: []v1.Container{
-					{
-						Name:            "e2e-net-exec",
-						Image:           imageutils.GetE2EImage(imageutils.DistrolessIptables),
-						ImagePullPolicy: v1.PullIfNotPresent,
-						Command:         []string{"sleep", "600"},
-						SecurityContext: &v1.SecurityContext{
-							Privileged: &privileged,
-						},
-					},
-				},
-			},
-		}
+		// Create a pod to check the conntrack entries on the host node. We need
+		// a privileged pod because /proc/net/nf_conntrack is not world-readable.
+		hostExecPod := e2epod.NewExecPodSpec(fr.Namespace.Name, "e2e-net-exec", true)
+		hostExecPod.Spec.Containers[0].SecurityContext.Privileged = new(true)
 		e2epod.NewPodClient(fr).CreateSync(ctx, hostExecPod)
 
 		// Create the client and server pods
@@ -201,12 +179,8 @@ var _ = common.SIGDescribe("KubeProxy", func() {
 			cmd = fmt.Sprintf("cat /proc/net/nf_conntrack | grep -m 1 -E 'CLOSE_WAIT.*dst=%s.*dport=%d'", procIP, testDaemonTCPPort)
 			dumpCmd = "cat /proc/net/nf_conntrack"
 			timeoutIdx = 4 // ipv4 2 tcp 6 <timeout> CLOSE_WAIT ...
-		} else if _, err := e2epodoutput.RunHostCmd(fr.Namespace.Name, "e2e-net-exec", "which conntrack"); err == nil {
-			cmd = fmt.Sprintf("conntrack -L -f %s -d %s 2>/dev/null | grep -m 1 'CLOSE_WAIT.*dport=%d'", ipFamily, ip, testDaemonTCPPort)
-			dumpCmd = "conntrack -L 2>/dev/null"
-			timeoutIdx = 2 // tcp 6 <timeout> CLOSE_WAIT ...
 		} else {
-			e2eskipper.Skipf("Neither /proc/net/nf_conntrack nor conntrack binary available")
+			e2eskipper.Skipf("/proc/net/nf_conntrack not available")
 		}
 
 		if err := wait.PollImmediate(2*time.Second, epsilonSeconds*time.Second, func() (bool, error) {

test/images/.permitted-images

@@ -9,7 +9,6 @@
 #       private image pulls
 gcr.io/k8s-authenticated-test/agnhost
 invalid.registry.k8s.io/invalid/alpine
-registry.k8s.io/build-image/distroless-iptables
 registry.k8s.io/cloud-provider-gcp/gcp-compute-persistent-disk-csi-driver
 registry.k8s.io/e2e-test-images/agnhost
 registry.k8s.io/e2e-test-images/apparmor-loader

test/utils/image/manifest.go

@@ -161,8 +161,6 @@ const (
 	AppArmorLoader
 	// BusyBox image
 	BusyBox
-	// DistrolessIptables Image
-	DistrolessIptables
 	// Etcd image
 	Etcd
 	// InvalidRegistryImage image
@@ -216,7 +214,6 @@ func initImageConfigs(list RegistryList) (map[ImageID]Config, map[ImageID]Config
 	configs[APIServer] = Config{list.PromoterE2eRegistry, "sample-apiserver", "1.33.8"}
 	configs[AppArmorLoader] = Config{list.PromoterE2eRegistry, "apparmor-loader", "1.6.0"}
 	configs[BusyBox] = Config{list.PromoterE2eRegistry, "busybox", "1.37.0-2"}
-	configs[DistrolessIptables] = Config{list.BuildImageRegistry, "distroless-iptables", "v0.11.2"}
 	configs[Etcd] = Config{list.GcEtcdRegistry, "etcd", "3.7.1-0"}
 	configs[InvalidRegistryImage] = Config{list.InvalidRegistry, "alpine", "3.1"}
 	configs[IpcUtils] = Config{list.PromoterE2eRegistry, "ipc-utils", "1.4"}