-w option? • ��� ��������������������������� Iptables������ ��������k�service�kube-services��1�chain ��Iptables����� • ����ON� Ø ����������)���(�-�������(�-���-������� Ø �������������������(�-��� ��iptables������� IPVS��Service���� Iptables vs. IPVS Iptables vs. IPVS ������ Service�� 1 5000 20000 Rules�� 8 40000 160000 ��1�Iptablesv� 50 us 11 min 5 hours ��1�IPVSv� 30 us 50 us 70 us ��s�� ü ���� ������� ü �prerouting, postrouting, forward, input, output�������� ���� • IPVS ü �����(hash vs. chain) ü ��������� - rr, wrr, lc, wlc, ip hash… ü ���� - IPVS service������������ ü ������� - nf_conntrack_ipv4

Major modes • Iptables • IPVS Iptables mode • How it works • DNAT at PREROUTING chain • SNAT at POSTROUTING chain • Pros • Iptables is widely adopted in popular Linux distributions • Cons • O(N^2) O(N^2) in control plane / O(N) in data plane • Poor in scheduling algorithm • Iptables rules are difficult to debug IPVS mode • Services are organized in hash table • IPVS DNAT • conntrack/iptables SNAT

★默认还加了DOCKER-USER这个forward链，默认全部return，导致不通，也得 放开，具体得看下iptables规则），以下操作目的为 在系统启动后等待60秒待 k8s把iptables规则设置完毕再在以下几个chain里放通所有流量，如果对防火墙 有自定义规则或对安全性要求较高场景无需配置以下这段，防火墙相关操作自 行按需处理！ # cat >> /etc/rc.d/rc.local <rules: #以下是各转发规则，根据匹配的hostName去转发 - host: "web.xxx.com" h�p: paths: - default annota�ons: #资源注解，仅起提示作用 kubernetes.io/ingress.class: "nginx" spec: rules: #以下是各转发规则，根据匹配的hostName去转发 - host: "web.xxx.com" h�p: paths: -

gRPC监控 长连接分布 请求分布 限流 Authorization Authenticatio n 序列化 压缩 版本转换 Admission Cache Storage Filter Chain API 存储 Kube-APIServer Webhook ETCD 数据构建 压测场景 压测环境 压测报告 压测平台 监控&大盘• APIServer & ETCD & Webhook

configurable with a default list (e.g. zones) 9 Scheduling modifiers Node selector Pod can define rules based on node labels, or based on placement of other pods constrain which nodes your pod is eligible to meet time constraints - included in published deck for reference 23 Configuring VM affinity rules Quorum dictates design VM Fault Domain A VM VM VM VM VM VM VM VM K8S Prod VM K8S Prod V K8S (Worker) VM K8S Prod (Master) (Worker) VM K8S Prod (Worker) (Worker) (VM Anti-Affinity) Host-VM Rules 24 Extending Kubernetes with vSphere HA What is HA? A least 2 hypervisor hosts are required. HA

configurable with a default list (e.g. zones) 9 Scheduling modifiers Node selector Pod can define rules based on node labels, or based on placement of other pods constrain which nodes your pod is eligible not work when deployed across Zones with zone-local Storage #67703 24 Configuring VM affinity rules Quorum dictates design VM Fault Domain A VM VM VM VM VM VM VM VM K8S Prod VM K8S Prod V K8S (Worker) VM K8S Prod (Master) (Worker) VM K8S Prod (Worker) (Worker) (VM Anti-Affinity) Host-VM Rules 25 Extending Kubernetes with vSphere HA What is HA? A least 2 hypervisor hosts are required. HA

configuration: settings: compression/case/method: zstd ● Zoned deployment, Affinity rules ● AntiAffinity rules ● Service templates Operator Administration: ClickHouse defaults Можно собрать желаемую

mode • 在netfilter pre-routing阶段做DNAT • 在netfilter post-routing阶段做SNAT • 每个service 添加一条或多条rules。使用数组管理rules。 • 仅支持随机的调度算法 • kube-proxy代码实现比较简单 • iptables 在linux 已经广泛部署 优势 iptables mode 不足之处

metadata: name: test-ingress annotations: ingress.kubernetes.io/rewrite-target: / spec: rules: - http: paths: - path: /testpath backend: serviceName: test Ingress metadata: name: test annotations: ingress.kubernetes.io/rewrite-target: / spec: rules: - host: foo.bar.com http: paths: - path: /foo backend: header 进⾏路由请求。 apiVersion: extensions/v1beta1 kind: Ingress metadata: name: test spec: rules: - host: foo.bar.com http: paths: - backend: serviceName: s1

apiVersion: rbac.authorization.k8s.io/v1beta1 metadata: name: traefik-ingress-controller rules: - apiGroups: [""] resources: ["services","endpoints","secrets"] verbs: ["get","list"