-w option? • ��� ��������������������������� Iptables������ ��������k�service�kube-services��1�chain ��Iptables����� • ����ON� Ø ����������)���(�-�������(�-���-������� Ø �������������������(�-��� ������� ü �prerouting, postrouting, forward, input, output�������� ���� • IPVS ü �����(hash vs. chain) ü ��������� - rr, wrr, lc, wlc, ip hash… ü ���� - IPVS service������������ ü ������� - nf_conntrack_ipv4

Major modes • Iptables • IPVS Iptables mode • How it works • DNAT at PREROUTING chain • SNAT at POSTROUTING chain • Pros • Iptables is widely adopted in popular Linux distributions • Cons • O(N^2)

this is exceeded • Unmanaged by default • Mechanisms exist to allow a cloud provider or admin to supply a default and over-ride container specification outside an allowed range • Supplemental “Metering”

this is exceeded • Unmanaged by default • Mechanisms exist to allow a cloud provider or admin to supply a default and over-ride container specification outside an allowed range • Supplemental “Metering”

gRPC监控 长连接分布 请求分布 限流 Authorization Authenticatio n 序列化 压缩 版本转换 Admission Cache Storage Filter Chain API 存储 Kube-APIServer Webhook ETCD 数据构建 压测场景 压测环境 压测报告 压测平台 监控&大盘• APIServer & ETCD & Webhook

★默认还加了DOCKER-USER这个forward链，默认全部return，导致不通，也得 放开，具体得看下iptables规则），以下操作目的为 在系统启动后等待60秒待 k8s把iptables规则设置完毕再在以下几个chain里放通所有流量，如果对防火墙 有自定义规则或对安全性要求较高场景无需配置以下这段，防火墙相关操作自 行按需处理！ # cat >> /etc/rc.d/rc.local <

0 码力 | 126 页 | 4.33 MB | 1 年前

3