Enable nf_conntrack kernel module on Rocky 9

[rifelpet]

Rocky 9 disables this by default, causing kube-proxy to fail to be come healthy.

https://storage.googleapis.com/kubernetes-ci-logs/logs/e2e-kops-grid-kubenet-rocky9-k34/2022582081854377984/artifacts/cluster-info/kube-system/kube-proxy-i-055bfe0498b9d2084/kube-proxy.log

https://storage.googleapis.com/kubernetes-ci-logs/logs/e2e-kops-grid-kopeio-rocky9-k33/2020996617997389824/artifacts/cluster-info/kube-system/kube-proxy-i-0cab5b7a433a4752c/kube-proxy.log

I0214 08:27:13.607072      11 conntrack.go:121] "Set sysctl" entry="net/netfilter/nf_conntrack_max" value=262144
E0214 08:27:13.607103      11 server.go:135] "Error running ProxyServer" err="open /proc/sys/net/netfilter/nf_conntrack_max: no such file or directory"
E0214 08:27:13.607120      11 run.go:72] "command failed" err="open /proc/sys/net/netfilter/nf_conntrack_max: no such file or directory"
2026/02/14 08:27:13 running command: exit status 1

List of kernel modules in Rocky9:

https://storage.googleapis.com/kubernetes-ci-logs/logs/e2e-kops-grid-kubenet-rocky9-k34/2022582081854377984/artifacts/i-055bfe0498b9d2084/modules

This is the only distro i could find that has this problem. Rocky10 has it enabled by default:

https://storage.googleapis.com/kubernetes-ci-logs/logs/e2e-kops-aws-nftables-rocky10arm64/2023390069586399232/artifacts/i-07843a6f3ac28d1db/modules

nf_conntrack 188416 6 nf_conntrack_netlink,nft_nat,nft_masq,nft_ct,nf_nat,ip_vs, Live 0x0000000000000000

[k8s-ci-robot]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[rifelpet]

/test pull-kops-aws-kindnet-rocky9

[ameukam]

/lgtm

[rifelpet]

/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: rifelpet

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [rifelpet]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment