Calico Node Failure on EKS Due to Read-Only File System for IPv4 Forwarding

[smerlos]

Calico nodes deployed on EKS experience failures related to iptables-legacy-save and setting IPv4 forwarding due to read-only file system access. Logs show repeated errors:

[ERROR] felix/int_dataplane.go: Failed to set IPv4 forwarding sysctl error=open /proc/sys/net/ipv4/ip_forward: read-only file system
[PANIC] felix/table.go: iptables-legacy-save command failed after retries

The issue was resolved by disabling non-privileged mode in Calico’s configuration for EKS:

apiVersion: operator.tigera.io/v1
kind: Installation
metadata:
  name: default
spec:
  nonPrivileged: Disabled
  kubernetesProvider: EKS

This configuration allows proper access to system-level settings and resolves the errors.