0

few days ago, i am facing a strange issue which is "a pod can not reach another pod running in the same minion/host through servide ClusterIP whereas they can reach each other skipping going through service clusterIP"

i am running kubernetes 1.9.6 on top of openstack (ubuntu 16.04 hosts) with:

  • cni 0.7.0
  • cri-containerd 1.0.0-beta
  • flannel 0.9.1
  • etcd 3.0.13

the other scenarios were working fine. even between pods running in different hosts, they can reach each other through service clusterIP.

what is going on here !!! any support will be more than welcome

Improve this question
2
  • what you mean by "do not try to do it !!" it was working with me like a charm. i upgraded to 1.10 but still not working. the behavior happens randomly(in some minions not all). do you have an idea about the issue described above. i need to know the RC. – mootez Jul 29 '18 at 11:05
  • stackoverflow.com/a/43283363/747579 – Abdennour TOUMI Jul 31 '18 at 3:27
0

The response from the called service is not DNAT'ed back to set src to the service clusterIP. So the response packet is going directly via cni0 bridge and not getting into iptables, preserving pod's IP.

to fix this i added the following option to kube-proxy and issue was gone.

--masquerade-all=true

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.