whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update source-ip doc with new ESIPP fields

Browse Source
This commit is contained in:
Zihong Zheng
2017-07-05 11:48:36 -07:00
committed by Andrew Chen
parent e4a74467bf
commit 47ace3ac71
1 changed files with 23 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/tutorials/services/source-ip.md
+23 -24
View File
@@ -157,19 +157,20 @@ Visually:
``` ```
To avoid this, Kubernetes 1.5 has a beta feature triggered by the To avoid this, Kubernetes has a feature to preserve the client source IP
`service.beta.kubernetes.io/external-traffic` [annotation](/docs/user-guide/load-balancer/#loss-of-client-source-ip-for-external-traffic). [(check here for feature availability)](/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip).
Setting it to the value `OnlyLocal` will only proxy requests to local endpoints, Setting `service.spec.externalTrafficPolicy` to the value `Local` will only
never forwarding traffic to other nodes and thereby preserving the original proxy requests to local endpoints, never forwarding traffic to other nodes
source IP address. If there are no local endpoints, packets sent to the node and thereby preserving the original source IP address. If there are no
are dropped, so you can rely on the correct source-ip in any packet processing local endpoints, packets sent to the node are dropped, so you can rely
rules you might apply a packet that make it through to the endpoint. on the correct source-ip in any packet processing rules you might apply a
packet that make it through to the endpoint.
Set the annotation as follows: Set the `service.spec.externalTrafficPolicy` field as follows:
```console ```console
$ kubectl annotate service nodeport service.beta.kubernetes.io/external-traffic=OnlyLocal $ kubectl patch svc nodeport -p '{"spec":{"externalTrafficPolicy":"Local"}}'
service "nodeport" annotated service "nodeport" patched
``` ```
Now, re-run the test: Now, re-run the test:
@@ -230,11 +231,10 @@ client_address=10.240.0.5
... ...
``` ```
However, if you're running on GKE/GCE, setting the same `service.beta.kubernetes.io/external-traffic` However, if you're running on GKE/GCE, setting the same `service.spec.externalTrafficPolicy`
annotation to `OnlyLocal` forces nodes *without* Service endpoints to remove field to `Local` forces nodes *without* Service endpoints to remove
themselves from the list of nodes eligible for loadbalanced traffic by themselves from the list of nodes eligible for loadbalanced traffic by
deliberately failing health checks. We expect to roll this feature out across a deliberately failing health checks.
wider range of providers before GA (see next section).
Visually: Visually:
@@ -253,23 +253,22 @@ health check ---> node 1 node 2 <--- health check
You can test this by setting the annotation: You can test this by setting the annotation:
```console ```console
$ kubectl annotate service loadbalancer service.beta.kubernetes.io/external-traffic=OnlyLocal $ kubectl patch svc loadbalancer -p '{"spec":{"externalTrafficPolicy":"Local"}}'
``` ```
You should immediately see a second annotation allocated by Kubernetes: You should immediately see the `service.spec.healthCheckNodePort` field allocated
by Kubernetes:
```console ```console
$ kubectl get svc loadbalancer -o yaml | grep -i annotations -A 2 $ kubectl get svc loadbalancer -o yaml | grep -i healthCheckNodePort
annotations: healthCheckNodePort: 32122
service.beta.kubernetes.io/external-traffic: OnlyLocal
service.beta.kubernetes.io/healthcheck-nodeport: "32122"
``` ```
The `service.beta.kubernetes.io/healthcheck-nodeport` annotation points to The `service.spec.healthCheckNodePort` field points to a port on every node
a port on every node serving the health check at `/healthz`. You can test this: serving the health check at `/healthz`. You can test this:
``` ```
$ kubectl get po -o wide -l run=source-ip-app $ kubectl get pod -o wide -l run=source-ip-app
NAME READY STATUS RESTARTS AGE IP NODE NAME READY STATUS RESTARTS AGE IP NODE
source-ip-app-826191075-qehz4 1/1 Running 0 20h 10.180.1.136 kubernetes-minion-group-6jst source-ip-app-826191075-qehz4 1/1 Running 0 20h 10.180.1.136 kubernetes-minion-group-6jst
@@ -313,7 +312,7 @@ such as the HTTP [X-FORWARDED-FOR](https://en.wikipedia.org/wiki/X-Forwarded-For
header, or the [proxy protocol](http://www.haproxy.org/download/1.5/doc/proxy-protocol.txt). header, or the [proxy protocol](http://www.haproxy.org/download/1.5/doc/proxy-protocol.txt).
Loadbalancers in the second category can leverage the feature described above Loadbalancers in the second category can leverage the feature described above
by simply creating a HTTP health check pointing at the port stored in by simply creating a HTTP health check pointing at the port stored in
the `service.beta.kubernetes.io/healthcheck-nodeport` annotation on the Service. the `service.spec.healthCheckNodePort` field on the Service.
{% endcapture %} {% endcapture %}