add support for nftables counter objects

[aroradaman]

This PR adds support for native named nftables counters.
https://wiki.nftables.org/wiki-nftables/index.php/Counters

Fixes: #20

Sample Usage:
kubernetes/kubernetes#129505

Output (kind):

root@kind-worker:/# nft list counters
table ip kube-proxy {
	counter traffic-to-invalid-ports {
		comment "tarck packets sent to invalid ports of cluster ips"
		packets 0 bytes 0
	}
}
table ip6 kube-proxy {
	counter traffic-to-invalid-ports {
		comment "tarck packets sent to invalid ports of cluster ips"
		packets 0 bytes 0
	}
}


root@kind-worker:/# for i in {1..100}; do curl --silent 10.96.0.10:12345; done;


root@kind-worker:/# nft list counters
table ip kube-proxy {
	counter traffic-to-invalid-ports {
		comment "tarck packets sent to invalid ports of cluster ips"
		packets 100 bytes 6000
	}
}
table ip6 kube-proxy {
	counter traffic-to-invalid-ports {
		comment "tarck packets sent to invalid ports of cluster ips"
		packets 0 bytes 0
	}
}

[aroradaman]

/assign @aojea @danwinship

[danwinship]

I agree with the idea in principle but it would be good to see how it's actually going to get used (ie, not just a WIP/PoC) to make sure we've got it right.

[aroradaman]

I agree with the idea in principle but it would be good to see how it's actually going to get used (ie, not just a WIP/PoC) to make sure we've got it right.

I have tried to expose a metric using nftables counter, which tracks the number of reject packets destined for invalid ports of the ClusterIPs.
kubernetes/kubernetes#129505

[danwinship]

are we giving up on nfacct due to lack of support on some platforms?

[aojea]

are we giving up on nfacct due to lack of support on some platforms?

it seems counters is the replacement of nfacct in nftables https://wiki.nftables.org/wiki-nftables/index.php/Supported_features_compared_to_xtables#nfacct

[aroradaman]

We can still use nfacct for iptables ( just in case we want to track something ).

[danwinship]

/lgtm
/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: aroradaman, danwinship

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [danwinship]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment