Enhance operational efficiency of K8s cluster in user's IDC #2157
Conversation
|
It is draft now and will be finished soon. |
huangchenzhao
force-pushed
the
locallb
branch
from
7a5ff36 to
45a5329
Compare
pkg/yurthub/locallb/locallb.go
Outdated
| } | ||
| m.iptablesManager.addIptablesRules(m.cloudIP, m.apiserverIPs) | ||
|
|
||
| podInformer := informerFactory.Core().V1().Pods() |
There was a problem hiding this comment.
It is not a good idea to list/watch pod for monitoring kube-apiserver IPs, because we want to narrow the permission of informer.
maybe we can use an endpoints(like tenant-kas-svc) for storing the address of kube-apiserver, so we only need to list/watch this endpoints for getting address of kube-apiserver.
huangchenzhao
force-pushed
the
locallb
branch
2 times, most recently
from
dc085a7 to
1d57850
Compare
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #2157 +/- ##
==========================================
+ Coverage 58.93% 59.00% +0.06%
==========================================
Files 210 211 +1
Lines 18968 19105 +137
==========================================
+ Hits 11179 11273 +94
- Misses 6707 6745 +38
- Partials 1082 1087 +5
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
huangchenzhao
force-pushed
the
locallb
branch
2 times, most recently
from
9efea83 to
5157fcf
Compare
pkg/yurthub/locallb/iptables.go
Outdated
| ramdomBalancingProbability := im.getRamdomBalancingProbability(len(ips)) | ||
| for index, ip := range ips { | ||
| // All packets (from kubelet, kubeproxy, pods, etc.) are loadbalanced to multiple addresses of apiservers deployed in daemonset, except packets which are sent to host control plane. | ||
| err := im.ipt.Append("nat", "OUTPUT", "! -d", tenantKasService, "-p", "tcp", "-m", "statistic", "--mode", "random", "--probability", strconv.FormatFloat(ramdomBalancingProbability[index], 'f', -1, 64), "-j", "DNAT", "--to-destination", ip) |
There was a problem hiding this comment.
we need to add port for the iptables rule, because source port and dest port maybe different.
pkg/yurthub/locallb/iptables.go
Outdated
| } | ||
|
|
||
| func (im *IptablesManager) updateIptablesRules(tenantKasService string, ips []string) error { | ||
| if err := im.cleanIptablesRules(tenantKasService, ips); err != nil { |
There was a problem hiding this comment.
If ips are changed, the new ips can not be used for finding the old iptables rule, so the old iptables rule will be leaked.
huangchenzhao
force-pushed
the
locallb
branch
2 times, most recently
from
02114bd to
a8acacd
Compare
|
/rerun |
… K8s cluster in user's IDC (openyurtio#2156)
huangchenzhao
force-pushed
the
locallb
branch
from
54e2b70 to
3a4d21e
Compare
|
|
/rerun |
|
/LGTM |
What type of PR is this?
What this PR does / why we need it:
#2124
Which issue(s) this PR fixes:
Fixes #2156