为什么Kubernetes Service的负载均衡会有模拟丢包率的IPtables条目?

178 阅读1分钟
原文链接: dockone.io

作为测试,我开了一个3个副本的Nginx,开启一个Service。
结果访问Service,一会可以访问一会访问不了,访问三个副本容器的80端口都是没问题,直接访问service,则会偶尔出现无法访问的情况。大概10次有4次是不成功的,查看iptables发现有random的条目,请问这是为何?如何解决?
[root@master ~]# kubectl describe svc nginxsvc
Endpoints: 172.17.67.2:80,172.17.67.4:80,172.17.85.4:80


7FCB4029-7F52-4255-BF96-7076D71461E4.png


查看IPtables发现有random的条目
[root@minion1 ~]# iptables-save | grep nginxsvc
-A KUBE-NODEPORTS -p tcp -m comment --comment "default/nginxsvc:http" -m tcp --dport 32318 -j KUBE-MARK-MASQ
-A KUBE-NODEPORTS -p tcp -m comment --comment "default/nginxsvc:http" -m tcp --dport 32318 -j KUBE-SVC-BGDX6NEIYI3XTOMT
-A KUBE-SEP-3ROCVIBC6LKXILG6 -s 172.17.67.2/32 -m comment --comment "default/nginxsvc:http" -j KUBE-MARK-MASQ
-A KUBE-SEP-3ROCVIBC6LKXILG6 -p tcp -m comment --comment "default/nginxsvc:http" -m tcp -j DNAT --to-destination 172.17.67.2:80
-A KUBE-SEP-C6FAQRSFXOU2ZECN -s 172.17.67.4/32 -m comment --comment "default/nginxsvc:http" -j KUBE-MARK-MASQ
-A KUBE-SEP-C6FAQRSFXOU2ZECN -p tcp -m comment --comment "default/nginxsvc:http" -m tcp -j DNAT --to-destination 172.17.67.4:80
-A KUBE-SEP-T3WD5HFQMH5SLLGH -s 172.17.85.4/32 -m comment --comment "default/nginxsvc:http" -j KUBE-MARK-MASQ
-A KUBE-SEP-T3WD5HFQMH5SLLGH -p tcp -m comment --comment "default/nginxsvc:http" -m tcp -j DNAT --to-destination 172.17.85.4:80
-A KUBE-SERVICES -d 10.0.48.169/32 -p tcp -m comment --comment "default/nginxsvc:http cluster IP" -m tcp --dport 80 -j KUBE-SVC-BGDX6NEIYI3XTOMT

这里

-A KUBE-SVC-BGDX6NEIYI3XTOMT -m comment --comment "default/nginxsvc:http" -m statistic --mode random --probability 0.33332999982 -j KUBE-SEP-3ROCVIBC6LKXILG6
-A KUBE-SVC-BGDX6NEIYI3XTOMT -m comment --comment "default/nginxsvc:http" -m statistic --mode random --probability 0.50000000000 -j KUBE-SEP-C6FAQRSFXOU2ZECN
-A KUBE-SVC-BGDX6NEIYI3XTOMT -m comment --comment "default/nginxsvc:http" -j KUBE-SEP-T3WD5HFQMH5SLLGH