https://linen.dev logo
Hey, me again. I don't think this is the
# mirrord-help
b
Hey, me again. I don't think this is the same issue but similar to above. The first time a pod boots up, mirrord works. After the second time I try to connect, it logs something about IP tables, I'll post in thread. There is still another agent Running in the pod according to k8. However said running agent has logged several close messages, so I'm confused why it's still running.
Copy code
{
  "timestamp": "2025-07-21T07:04:44.738188Z",
  "level": "ERROR",
  "fields": {
    "message": "Detected dirty iptables. Either some other mirrord agent is running or the previous agent failed to clean up before exit. If no other mirrord agent is targeting this pod, please delete the pod. If you'd like to have concurrent work consider using the operator available in mirrord for Teams.",
    "leftover_rules": "[\"-N MIRRORD_EXCLUDE_FROM_MESH\", \"-N MIRRORD_INPUT\", \"-N MIRRORD_OUTPUT\", \"-A PREROUTING -j MIRRORD_EXCLUDE_FROM_MESH\", \"-A PREROUTING -j MIRRORD_INPUT\", \"-A OUTPUT -j MIRRORD_OUTPUT\", \"-A MIRRORD_EXCLUDE_FROM_MESH -p tcp -m tcp --dport 39763 -j ACCEPT\", \"-A MIRRORD_EXCLUDE_FROM_MESH -j RETURN\", \"-A MIRRORD_INPUT -p tcp -m multiport ! --dports 15008 -j RETURN\", \"-A MIRRORD_INPUT -p tcp -m multiport ! --dports 15090 -j RETURN\", \"-A MIRRORD_INPUT -p tcp -m multiport ! --dports 15021 -j RETURN\", \"-A MIRRORD_INPUT -p tcp -m multiport ! --dports 15020 -j RETURN\", \"-A MIRRORD_INPUT -j RETURN\", \"-A MIRRORD_OUTPUT ! -s 100.116.10.12/32 -p tcp -m owner --gid-owner 14602 -j RETURN\", \"-A MIRRORD_OUTPUT -j RETURN\"]"
  },
  "target": "mirrord_agent::entrypoint",
  "span": {
    "args": "Args { mode: Ephemeral { mesh: None }, communicate_port: 37880, communication_timeout: 360, network_interface: None, metrics: None, test_error: false, operator_tls_cert_pem: None, is_mesh: true, ipv6: false }",
    "name": "start_agent"
  },
  "spans": [
    {
      "args": "Args { mode: Ephemeral { mesh: None }, communicate_port: 37880, communication_timeout: 360, network_interface: None, metrics: None, test_error: false, operator_tls_cert_pem: None, is_mesh: true, ipv6: false }",
      "name": "start_agent"
    }
  ],
  "threadId": "ThreadId(1)"
}
(We are on mirrord for teams with the operator).
a
can you share your values.yaml (exc. secrets) and mirrord.json? also operator version + chart version
a
I'd like to schedule support call with our team to help you get this sorted - tomorrow this time works?
@razz4780
b
Yep I'll post those details
Yep that time works
Some details for later: Stopped happening when I disabled
exclude_from_mesh
Cluster: EKS (pretty much latest version) ServiceMesh: Istio
a
Why did you use that flag to begin with?
b
You suggested it when I was attempting to improve connection stability in the thread above this one
a
Right, and you chose ephemeral because you had issues the other way?
b
Yeah we had a lot of issues with pod limits on nodes, I reckon another reason but can't remember