use legacy iptables instead of nftables to match kube-proxy

Dockerfile

@@ -8,6 +8,9 @@ RUN apt-get update && apt-get install --yes --no-install-recommends \
     iproute2 \
     iptables
 
+# k8s.gcr.io/kube-proxy:v1.17.0 uses legacy iptables
+RUN update-alternatives --set iptables /usr/sbin/iptables-legacy
+
 ARG KUBERNETES_VERSION=v1.17.0
 RUN curl --location https://dl.k8s.io/$KUBERNETES_VERSION/kubernetes-node-linux-amd64.tar.gz \
     | tar -xvz --directory=/usr/local/bin --strip-components=3 kubernetes/node/bin/kubelet