Clarify kubelet/kube-proxy iptables rule skew constraints

pkg/proxy/ipvs/proxier.go

@@ -1734,7 +1734,12 @@ func (proxier *Proxier) writeIptablesRules() {
 	// Install the kubernetes-specific postrouting rules. We use a whole chain for
 	// this so that it is easier to flush and change, for example if the mark
 	// value should ever change.
-	// NB: THIS MUST MATCH the corresponding code in the kubelet
+
+	// NOTE: kubelet creates identical copies of these rules. If you want to change
+	// these rules in the future, you MUST do so in a way that will interoperate
+	// correctly with skewed versions of the rules created by kubelet. (Remove this
+	// comment once IPTablesOwnershipCleanup is GA.)
+
 	proxier.natRules.Write(
 		"-A", string(kubePostroutingChain),
 		"-m", "mark", "!", "--mark", fmt.Sprintf("%s/%s", proxier.masqueradeMark, proxier.masqueradeMark),