[MESOS-9125] Port mapper CNI plugin might fail with "Resource temporarily unavailable"

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.4.1, 1.5.1, 1.6.1
• Fix Version/s: 1.4.2, 1.5.2, 1.6.2, 1.7.0
• Component/s: network
• Labels: mesosphere
• Target Version/s: 1.4.2, 1.5.2, 1.6.2, 1.7.0
• Sprint: Mesosphere Sprint 2018-25, Mesosphere Sprint 2018-26
• Story Points: 1
• Assignee: Greg Mann
• Reporter: Jie Yu
• Shepherd: Jie Yu
• Created: 01/Aug/18 19:04
• Updated: 03/Aug/18 23:38
• Resolved: 03/Aug/18 21:19

Description

https://github.com/apache/mesos/blob/master/src/slave/containerizer/mesos/isolators/network/cni/plugins/port_mapper/port_mapper.cpp#L345

Looks like we're missing a `-w` for the iptable command. This will lead to issues like

The CNI plugin '/opt/mesosphere/active/mesos/libexec/mesos/mesos-cni-port-mapper' failed to attach container a710dc89-7b22-493b-b8bb-fb80a99d5321 to CNI network 'mesos-bridge': stdout='{"cniVersion":"0.3.0","code":103,"msg":"Failed to add DNAT rule with tag: Resource temporarily unavailable"}

This becomes more likely if there are many concurrent launches of Mesos contianers that uses port mapper on the box.