apiVersion: apps/v1 kind: Deployment metadata: name: tomcat-v1-deployment spec: replicas: 2 selector: matchLabels: app: tomcat-v1 template: metadata: labels: app: tomcat-v1 spec: containers: - name: tomcat image: tomcat ports: - containerPort: 8080 hostPort: 9000
# 堆代码 duidaima.com [root@master1 ~]# kubectl get nodes -o wide NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME master1 Ready control-plane,master 19d v1.21.14 10.20.32.201 <none> Kylin Linux Advanced Server V10 (Lance) 4.19.90-52.22.v2207.ky10.x86_64 docker://20.10.9 master2 Ready control-plane,master 19d v1.21.14 10.20.32.202 <none> Kylin Linux Advanced Server V10 (Lance) 4.19.90-52.22.v2207.ky10.x86_64 docker://20.10.9 master3 Ready control-plane,master 19d v1.21.14 10.20.32.203 <none> Kylin Linux Advanced Server V10 (Lance) 4.19.90-52.22.v2207.ky10.x86_64 docker://20.10.9 worker1 Ready worker 19d v1.21.14 10.20.32.204 <none> Kylin Linux Advanced Server V10 (Lance) 4.19.90-52.22.v2207.ky10.x86_64 docker://20.10.9 worker2 Ready worker 19d v1.21.14 10.20.32.205 <none> Kylin Linux Advanced Server V10 (Lance) 4.19.90-52.22.v2207.ky10.x86_64 docker://20.10.9当前集群kube-proxy模式为ipvs:
[root@master1 ~]# kubectl get configmaps -n=kube-system kube-proxy -o yaml|grep mode mode: ipvs(2)示例
POSTROUTING 链(iptables): 流量最终经过 POSTROUTING 链(位于 nat 表),这是 NAT 处理的最后一步。你可以在这里进行出站流量的地址转换等处理。
[root@worker1 ~]# docker ps|grep http-request-printer 267f462be8b6 25585bdfb0f7 "/usr/local/bin/pilo…" About an hour ago Up About an hour k8s_istio-proxy_http-request-printer-v1-856959f7d9-kxx6g_tracing_fa8a0a82-e233-4757-ba28-f16eb2d311f4_0 e60564d42fc6 6246a84777e8 "./http_request_prin…" About an hour ago Up About an hour k8s_container-rr19ea_http-request-printer-v1-856959f7d9-kxx6g_tracing_fa8a0a82-e233-4757-ba28-f16eb2d311f4_0 432a811e77e1 10.20.32.201:80/library/pause:3.4.1 "/pause" About an hour ago Up About an hour k8s_POD_http-request-printer-v1-856959f7d9-kxx6g_tracing_fa8a0a82-e233-4757-ba28-f16eb2d311f4_0 [root@worker1 ~]# nsenter -n -t 308222 nsenter: cannot open /proc/308222/ns/net: No such file or directory [root@worker1 ~]# docker ps|grep http-request-printer 267f462be8b6 25585bdfb0f7 "/usr/local/bin/pilo…" About an hour ago Up About an hour k8s_istio-proxy_http-request-printer-v1-856959f7d9-kxx6g_tracing_fa8a0a82-e233-4757-ba28-f16eb2d311f4_0 e60564d42fc6 6246a84777e8 "./http_request_prin…" About an hour ago Up About an hour k8s_container-rr19ea_http-request-printer-v1-856959f7d9-kxx6g_tracing_fa8a0a82-e233-4757-ba28-f16eb2d311f4_0 432a811e77e1 10.20.32.201:80/library/pause:3.4.1 "/pause" About an hour ago Up About an hour k8s_POD_http-request-printer-v1-856959f7d9-kxx6g_tracing_fa8a0a82-e233-4757-ba28-f16eb2d311f4_0 [root@worker1 ~]# docker inspect --format "{{.State.Pid}}" 267f462be8b6 145003 [root@worker1 ~]# nsenter -n -t 145003 [root@worker1 ~]# ifconfig eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1450 inet 10.233.1.133 netmask 255.255.255.0 broadcast 10.233.1.255 ether 2e:2c:82:08:eb:8e txqueuelen 0 (Ethernet) RX packets 15372 bytes 9093248 (8.6 MiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 14493 bytes 23701690 (22.6 MiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536 inet 127.0.0.1 netmask 255.0.0.0 loop txqueuelen 1000 (Local Loopback) RX packets 8483 bytes 37018407 (35.3 MiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 8483 bytes 37018407 (35.3 MiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 [root@worker1 ~]#抓包来确定进入容器中的包没有进行源地址转换(抓包时客户端 10.20.32.201 通过 curl http://10.20.32.204:80 命令访问此服务)。
[root@worker1 ~]# tcpdump -i eth0 host 10.233.1.133 and dst port 80 -w svc_host_port.pcap dropped privs to tcpdump tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes ^C6 packets captured 6 packets received by filter 0 packets dropped by kernel将抓的包下载到本地通过并使用 wireshark 软件进行分析,可以看到当节点外客户端通过 hostPort 访问容器时,进入容器中的包没有进行源地址转换。
OUTPUT -> IPVS -> POSTROUTING3.2.1)分析 OUTPUT 链规则