iptables: comment on xt_connmark requirement for EKS rules
iptables: comment on xt_connmark requirement for EKS rules

EKS requires some specific rules for asymmetric routing with multi-node
NodePort traffic. These rules relies on the xt_connmark kernel module,
which is usually loaded by iptables when necessary.

The rules are installed when the selected IPAM is ENI, meaning they are
installed on AWS (but not only EKS). The xt_connmark module should be
loaded in a similar way, unless loading modules after boot has been
disabled, in which case the setup fails and the agent crashes.

Add a comment to at least help debug the issue. Longer term, we may want
to add more explicit hints to the logs if too many users hit the issue,
but that would require parsing iptables' output for the specific error,
so let's see how it goes with a simple comment in the code for now.

Signed-off-by: Quentin Monnet <d6b8e48afb2534b213e391cab43016505747a234@isovalent.com>

cilium/cilium,tgraf/cilium,michi-covalent/cilium,michi-covalent/cilium,tklauser/cilium,tgraf/cilium,michi-covalent/cilium,tklauser/cilium,tklauser/cilium,cilium/cilium,tgraf/cilium,cilium-team/cilium,tgraf/cilium,michi-covalent/cilium,cilium/cilium,tklauser/cilium,cilium/cilium,cilium/cilium,tgraf/cilium,tklauser/cilium,michi-covalent/cilium,tgraf/cilium,cilium-team/cilium