Known issues

MKE 3.5.1 issues for which there are available workaround solutions include:

[MKE-8538] Limited Windows support bundle availability

CLI-based support bundles are unavailable on Windows worker nodes.


For Swarm-orchestrated Windows nodes, use the MKE web UI to obtain a support bundle. For Kubernetes-orchestrated Windows nodes, you must manually collect the logs.

[FIELD-4200] Reloading firewalld can disable docker ingress routing mesh

The calico-node firewalld-policy init container can disable the docker ingress routing mesh when reloading firewalld.


  1. Prevent the issue from recurring by disabling firewalld:

    sudo systemctl disable --now firewalld
  2. Restore missing iptables chains by restarting dockerd:

    sudo systemctl restart docker


    Restarting dockerd stops all containers on the corresponding node. The node capacity will not be available to the cluster until the node returns to a healthy state in MKE. You must restart dockerd on manager nodes one node at a time, confirming the health of each one in MKE before moving on to the next.

  3. Confirm issue resolution by checking for the presence of the DOCKER-INGRESS iptables chain:

    sudo iptables --list DOCKER-INGRESS

    Expected output:

    Chain DOCKER-INGRESS (2 references)
    target     prot opt source               destination