I assigned cluster IPs to K8S pods through Flannel. Recently, I found that when some pods were deleted, their host did not remove their cluster IPs from the iptables. This resulted in non-existent IPs such as ping or telnet still being accessible, while the nacos registry registered these non-existent IPs, but they cannot provide external services.
I tested it with other applications in the same k8s cluster, and when I stop a pod, I observe the iptable of the host where it is located, and the rules corresponding to the cluster IP will be removed.
172.25.163.11 used to be a pod’s cluster ip,but when the pod dies,it still exists in host’s iptable,i dont know if it is normal ?
iptable -t nat -L -n -V
Chain POSTROUTING (policy ACCEPT 20 packets, 1964 bytes)
pkts bytes target prot opt in out source destination
1235K 77M MASQUERADE all -- * !docker0 172.25.163.0/24 0.0.0.0/0
11M 770M KUBE-POSTROUTING all -- * * 0.0.0.0/0 0.0.0.0/0 /* kubernetes postrouting rules */
0 0 MASQUERADE tcp -- * * 172.25.163.2 172.25.163.2 tcp dpt:10086
0 0 MASQUERADE tcp -- * * 172.25.163.2 172.25.163.2 tcp dpt:10010
0 0 MASQUERADE tcp -- * * 172.25.163.2 172.25.163.2 tcp dpt:7700
0 0 MASQUERADE tcp -- * * 172.25.163.3 172.25.163.3 tcp dpt:9100
0 0 MASQUERADE tcp -- * * 172.25.163.5 172.25.163.5 tcp dpt:9256
0 0 MASQUERADE tcp -- * * 172.25.163.11 172.25.163.11 tcp dpt:8090
0 0 MASQUERADE tcp -- * * 172.25.163.9 172.25.163.9 tcp dpt:8090
0 0 MASQUERADE tcp -- * * 172.25.163.4 172.25.163.4 tcp dpt:9081
0 0 MASQUERADE tcp -- * * 172.25.163.8 172.25.163.8 tcp dpt:9081
0 0 MASQUERADE tcp -- * * 172.25.163.12 172.25.163.12 tcp dpt:18848
0 0 MASQUERADE tcp -- * * 172.25.163.12 172.25.163.12 tcp dpt:9849
0 0 MASQUERADE tcp -- * * 172.25.163.12 172.25.163.12 tcp dpt:9848
0 0 MASQUERADE tcp -- * * 172.25.163.12 172.25.163.12 tcp dpt:8848
0 0 MASQUERADE tcp -- * * 172.25.163.12 172.25.163.12 tcp dpt:7848
0 0 MASQUERADE tcp -- * * 172.25.163.10 172.25.163.10 tcp dpt:8080
0 0 MASQUERADE tcp -- * * 172.25.163.2 172.25.163.2 tcp dpt:8090
0 0 MASQUERADE tcp -- * * 172.25.163.3 172.25.163.3 tcp dpt:8090
0 0 MASQUERADE tcp -- * * 172.25.163.4 172.25.163.4 tcp dpt:8090
0 0 MASQUERADE tcp -- * * 172.25.163.8 172.25.163.8 tcp dpt:10086
0 0 MASQUERADE tcp -- * * 172.25.163.8 172.25.163.8 tcp dpt:10010
0 0 MASQUERADE tcp -- * * 172.25.163.8 172.25.163.8 tcp dpt:7700
0 0 MASQUERADE tcp -- * * 172.25.163.9 172.25.163.9 tcp dpt:9100
0 0 MASQUERADE tcp -- * * 172.25.163.10 172.25.163.10 tcp dpt:9256
0 0 MASQUERADE tcp -- * * 172.25.163.12 172.25.163.12 tcp dpt:80
0 0 MASQUERADE tcp -- * * 172.25.163.13 172.25.163.13 tcp dpt:9081
0 0 MASQUERADE tcp -- * * 172.25.163.5 172.25.163.5 tcp dpt:8090
0 0 MASQUERADE tcp -- * * 172.25.163.7 172.25.163.7 tcp dpt:8081
New contributor
busishe is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.