Why can’t I access the service if the externalTrafficPolicy to Local parameter in the kubernetes cluster

Question

I follow this guide to apply the source ip function to my kubernetes cluster.

First, I created pod by running:

$ kubectl run source-ip-app --image=gcr.io/google_containers/echoserver:1.4

Then output it as a NodePort service:

kubectl expose deployment source-ip-app --name=nodeport --port=80 --target-port=8080 --type=NodePort

At this point, I can access the service from outside the cluster and get the correct client_address:

$ curl 10.74.68.49:16860 | grep client
% Total% Received% Xferd Average Speed ​​Time Time Time Current
Download Dload Total left speeds
100 296 0 296 0 0 43167 0 -: -: - -:: -: - -: -: - 49333
client_address = 10.168.193.130

But if you use the ip function of the source:

kubectl patch svc nodeport -p '{"spec":{"externalTrafficPolicy":"Local"}}'

I will get a timeout:

$ curl 10.74.68.49:16860 | grep client
% Total% Received% Xferd Average Speed ​​Time Time Time Current
Download Dload Total left speeds
0 0 0 0 0 0 0 0 0 -: -: - 0:01:14 -: -: - 0curl: (7) Could not connect to port 10.74.68.49 16860: work timeout

I wonder what the reason for this is and how to solve it.

My env information:

$ kubectl version
Client version: version.Info {Major: "1", Minor: "7", GitVersion: "v1.7.3", GitCommit: "2c2fe6e8278a5db2d15a013987b53968c743f2a1", GitTreeState: "clean", BuildDate: "2017-08-03T07: 00 21Z ", GoVersion:" go1.8.3 ", Compiler:" gc ", Platform:" linux / amd64 "}
Server Version: version.Info {Major: "1", Minor: "7", GitVersion: "v1.7.3", GitCommit: "2c2fe6e8278a5db2d15a013987b53968c743f2a1", GitTreeState: "clean", BuildDate: "2017-08-03T06: 43: 48Z ", GoVersion:" go1.8.3 ", Compiler:" gc ", Platform:" linux / amd64 "}

Update:

There are 2 nodes in my cluster, I get a timeout problem regardless of which node ip is accessing.

Answer 1

Create kube-proxy.yaml

kubectl get ds -n kube-system kube-proxy -o yaml > kube-proxy.yaml

Modify kube-proxy.yaml to include the HOST_IP argument

 # ... spec: containers: - command: - ./hyperkube - proxy - --cluster-cidr=10.2.0.0/16 - --hostname-override=$(HOST_IP) - --kubeconfig=/etc/kubernetes/kubeconfig - --proxy-mode=iptables env: - name: HOST_IP valueFrom: fieldRef: apiVersion: v1 fieldPath: status.hostIP #... 

Package Update:

kubectl apply -f kube-proxy.yaml

This will apply the fix mentioned in https://github.com/kubernetes/kubernetes/issues/48437 , resolving the problem of dropped packets.