[K8S] Service代理模式之iptables
创建deployment和service
三个Pod的IP为
10.244.169.161
10.244.169.163
10.244.169.165
SVC的Cluster IP为10.104.247.10, nodePort为31947
>>>Deployment
[[email protected] ~]# kubectl get deploy -o wide
NAME READY UP-TO-DATE AVAILABLE AGE CONTAINERS IMAGES SELECTOR
web 3/3 3 3 12m nginx nginx:1.21 app=web
>>>Pod
[[email protected] ~]# kubectl get pod -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
web-d779974b6-9zx48 1/1 Running 0 12m 10.244.169.165 k8s-node2 <none> <none>
web-d779974b6-csx2h 1/1 Running 0 12m 10.244.169.161 k8s-node2 <none> <none>
web-d779974b6-hb6kw 1/1 Running 0 12m 10.244.169.163 k8s-node2 <none> <none>
>>>Service
[[email protected] ~]# kubectl get svc -o wide
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE SELECTOR
kubernetes ClusterIP 10.96.0.1 <none> 443/TCP 27d <none>
web NodePort 10.104.247.10 <none> 80:31947/TCP 12m app=web
>>>Endpoint
[[email protected] ~]# kubectl get ep -o wide
NAME ENDPOINTS AGE
kubernetes 192.168.231.121:6443 27d
web 10.244.169.161:80,10.244.169.163:80,10.244.169.165:80 12m
iptables-save | grep <svc name> 查看规则
iptables-save — dump iptables rules to stdout
ip6tables-save — dump iptables rules to stdout
[[email protected] ~]# iptables-save | grep web
-A KUBE-NODEPORTS -p tcp -m comment --comment "default/web" -m tcp --dport 31947 -j KUBE-MARK-MASQ
-A KUBE-NODEPORTS -p tcp -m comment --comment "default/web" -m tcp --dport 31947 -j KUBE-SVC-LOLE4ISW44XBNF3G
-A KUBE-SEP-BJLXVQMD4VVYPI2H -s 10.244.169.161/32 -m comment --comment "default/web" -j KUBE-MARK-MASQ
-A KUBE-SEP-BJLXVQMD4VVYPI2H -p tcp -m comment --comment "default/web" -m tcp -j DNAT --to-destination 10.244.169.161:80
-A KUBE-SEP-G4IDOWJQUQJ6MLO4 -s 10.244.169.165/32 -m comment --comment "default/web" -j KUBE-MARK-MASQ
-A KUBE-SEP-G4IDOWJQUQJ6MLO4 -p tcp -m comment --comment "default/web" -m tcp -j DNAT --to-destination 10.244.169.165:80
-A KUBE-SEP-HPW2WDDZQWHWFYBL -s 10.244.169.163/32 -m comment --comment "default/web" -j KUBE-MARK-MASQ
-A KUBE-SEP-HPW2WDDZQWHWFYBL -p tcp -m comment --comment "default/web" -m tcp -j DNAT --to-destination 10.244.169.163:80
-A KUBE-SERVICES ! -s 10.244.0.0/16 -d 10.104.247.10/32 -p tcp -m comment --comment "default/web cluster IP" -m tcp --dport 80 -j KUBE-MARK-MASQ
-A KUBE-SERVICES -d 10.104.247.10/32 -p tcp -m comment --comment "default/web cluster IP" -m tcp --dport 80 -j KUBE-SVC-LOLE4ISW44XBNF3G
-A KUBE-SVC-LOLE4ISW44XBNF3G -m comment --comment "default/web" -m statistic --mode random --probability 0.33333333349 -j KUBE-SEP-BJLXVQMD4VVYPI2H
-A KUBE-SVC-LOLE4ISW44XBNF3G -m comment --comment "default/web" -m statistic --mode random --probability 0.50000000000 -j KUBE-SEP-HPW2WDDZQWHWFYBL
-A KUBE-SVC-LOLE4ISW44XBNF3G -m comment --comment "default/web" -j KUBE-SEP-G4IDOWJQUQJ6MLO4
[[email protected] ~]#
说明:
Line 2 ......KUBE-MARK-MASQ 跟踪数据包,标记作用
Line 3 集群外部 --> nodePort
-A KUBE-NODEPORTS -p tcp -m comment --comment "default/web" -m tcp --dport 31947 -j KUBE-SVC-LOLE4ISW44XBNF3G
来自于tcp协议,default命名空间,web服务,目标端口31947的流量会重定向到 KUBE-SVC-LOLE4ISW44XBNF3G
Line 11 集群内部(pod,node...) --> Cluster IP
-A KUBE-SERVICES -d 10.104.247.10/32 -p tcp -m comment --comment "default/web cluster IP" -m tcp --dport 80 -j KUBE-SVC-LOLE4ISW44XBNF3G
访问10.104.247.10 (Cluster IP):80 会被重定向到 KUBE-SVC-LOLE4ISW44XBNF3G
可以看到集群内部/外部访问都转发到了同一个规则 KUBE-SVC-LOLE4ISW44XBNF3G
Line 12-14 实现负载均衡 (从上到下匹配规则)
-A KUBE-SVC-LOLE4ISW44XBNF3G -m comment --comment "default/web" -m statistic --mode random --probability 0.33333333349 -j KUBE-SEP-BJLXVQMD4VVYPI2H
-A KUBE-SVC-LOLE4ISW44XBNF3G -m comment --comment "default/web" -m statistic --mode random --probability 0.50000000000 -j KUBE-SEP-HPW2WDDZQWHWFYBL
-A KUBE-SVC-LOLE4ISW44XBNF3G -m comment --comment "default/web" -j KUBE-SEP-G4IDOWJQUQJ6MLO4
Line 12 随机到这条规则的概率是33% --> Line 5
Line 13 如果上一条没有选中，随机到这条规则的概率是50% --> Line 7
Line 14 如果上一条也没有选中，会选择这条规则 --> Line 9
Line 5 当流量转发到这条规则，就会通过DNAT到10.244.169.161 (pod web-d779974b6-csx2h)
-A KUBE-SEP-BJLXVQMD4VVYPI2H -p tcp -m comment --comment "default/web" -m tcp -j DNAT --to-destination 10.244.169.161:80
Line 7 当流量转发到这条规则，就会通过DNAT到10.244.169.165 (pod web-d779974b6-9zx48)
-A KUBE-SEP-G4IDOWJQUQJ6MLO4 -p tcp -m comment --comment "default/web" -m tcp -j DNAT --to-destination 10.244.169.165:80
Line 9 当流量转发到这条规则，就会通过DNAT到10.244.169.163 (pod web-d779974b6-hb6kw)
-A KUBE-SEP-HPW2WDDZQWHWFYBL -p tcp -m comment --comment "default/web" -m tcp -j DNAT --to-destination 10.244.169.163:80