2

Our network team says there an IP address in a subnet is being claimed and released seemingly at random. They are wondering if Kubernetes could be doing it.

I know that Pods, Services and Nodes can have IP addresses in Kubernetes. I have checked all of those and none of them are doing it.

Is there anything else that can have an IP address in Kubernetes?

I am running an on premises Kuberentes cluster using Istio with node port services. Is there anything else that could be attempting to get an IP address?

Improve this question
2
  • Is there a MAC address associated with the ip? Can you track that to a particular machine? Is there a regular period associated with the address, or is it happening at random intervals? In general, Kubernetes shouldn't be acquiring any addresses that you haven't explicitly told it to use.
    – larsks
    Commented Oct 5, 2021 at 18:12
  • @larsks - I assume that they are checking those things. I just need to be sure that there are no other resources in Kubernetes that get IP addresses. As long as Pods, Services and Nodes are the only resources that get IP addresses, then I can leave them to figure it out. (I imagine they will figure it out eventually, I just don't want it to end up being a part of Kubernetes that I did not realize needed IP addresses.)
    – Vaccano
    Commented Oct 5, 2021 at 19:02

1 Answer 1

Reset to default
1

The IP addresses that are in your kubernetes cluster are internal to the cluster. There is nothing that would get an IP Address outside of your k8s cluster, like a dhcp from your router/dhcp server. K8s creates virtual adapters depending on the CNI runtime that you have implemented and it also creates domains for the objects inside. Anything inside k8s goes out through forwarding via the NodePort service type, so unless your network team specify which IP it is and which subnet they are tracking, I would suggest that you send them a large tcpdump to go through.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.