pods via VIP using a load balancer • Two types • ClusterIP provides in-cluster access • NodePort provides out-of-cluster access • Major modes • Iptables • IPVS Iptables mode • How it works connection cps Short connection P99 latency Long connection pps ClusterIP +40% -31% not available NodePort +64% -47% +22% Test result • Perf shows number of instructions per request drops by 38% IPVS-BPF IPVS-BPF IPVS 0 20000 40000 60000 80000 100000 120000 140000 160000 180000 Nodeport short connection Instructions/req Lessons from eBPF • No loop support in eBPF verifier (Linux 4.14) • #param