노드마다 iptables가 다릅니까?

iptables 차이가 있는지 없는지 봅시다.
이번에는 옵션--enable-addons monitoring이 부착된 AKS로 여분이 있을 수 있습니다.kube-dns 10.0.0.10으로 이동해 쫓아보자.

$ kubectl get svc kube-dns -n kube-system
NAME       TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)         AGE
kube-dns   ClusterIP   10.0.0.10    <none>        53/UDP,53/TCP   104m

corednsaks-nodepool1-1068416-vms000001과aks-nodepool1-1068416-vms000002로 이동한다.
aks-nodepool1-1068416-vms억 달러는 이동하지 않았습니다.

$ kubectl get po -l k8s-app=kube-dns -n kube-system -o wide
NAME                     READY   STATUS    RESTARTS   AGE   IP           NODE                                NOMINATED NODE   READINESS GATES
coredns-69c47794-4kplx   1/1     Running   0          93m   10.244.1.3   aks-nodepool1-10688416-vmss000002   <none>           <none>
coredns-69c47794-mgr58   1/1     Running   0          96m   10.244.2.6   aks-nodepool1-10688416-vmss000001   <none>           <none>

kube-proxy의node와 관련이 있습니다.

$ kubectl get po -l component=kube-proxy -n kube-system -o wide
NAME               READY   STATUS    RESTARTS   AGE    IP           NODE                                NOMINATED NODE   READINESS GATES
kube-proxy-kngbq   1/1     Running   0          101m   10.224.0.6   aks-nodepool1-10688416-vmss000002   <none>           <none>
kube-proxy-n4w2k   1/1     Running   0          101m   10.224.0.5   aks-nodepool1-10688416-vmss000001   <none>           <none>
kube-proxy-pj49z   1/1     Running   0          101m   10.224.0.4   aks-nodepool1-10688416-vmss000000   <none>           <none>

aks-nodepool1-1068416-vms000001과aks-nodepool1-1068416-vms000002가 이동하는 것은kube-proxy-n4w2k와kube-proxy-kngbq이다.
Clutter IP는 iptables 의 KUBE-SERVICES chain을 사용했기 때문에 분리되었기 때문에 그것만 우선.

$ kubectl exec kube-proxy-n4w2k -n kube-system -- iptables -nL KUBE-SERVICES -t nat --line-numbers
Chain KUBE-SERVICES (2 references)
num  target     prot opt source               destination
1    KUBE-SVC-NPX46M4PTMTKRN6Y  tcp  --  0.0.0.0/0            10.0.0.1             /* default/kubernetes:https cluster IP */ tcp dpt:443
2    KUBE-SVC-ERIFXISQEP7F7OF4  tcp  --  0.0.0.0/0            10.0.0.10            /* kube-system/kube-dns:dns-tcp cluster IP */ tcp dpt:53
3    KUBE-SVC-TCOU7JCQXEZGVUNU  udp  --  0.0.0.0/0            10.0.0.10            /* kube-system/kube-dns:dns cluster IP */ udp dpt:53
4    KUBE-SVC-QMWWTXBG7KFJQKLO  tcp  --  0.0.0.0/0            10.0.60.35           /* kube-system/metrics-server cluster IP */ tcp dpt:443
5    KUBE-SVC-WT3SFWJ44Q74XUPR  tcp  --  0.0.0.0/0            10.0.36.18           /* kube-system/healthmodel-replicaset-service cluster IP */ tcp dpt:25227
6    KUBE-NODEPORTS  all  --  0.0.0.0/0            0.0.0.0/0            /* kubernetes service nodeports; NOTE: this must be the last rule in this chain */ ADDRTYPE match dst-type LOCAL

$ kubectl exec kube-proxy-kngbq -n kube-system -- iptables -nL KUBE-SERVICES -t nat --line-numbers
Chain KUBE-SERVICES (2 references)
num  target     prot opt source               destination
1    KUBE-SVC-QMWWTXBG7KFJQKLO  tcp  --  0.0.0.0/0            10.0.60.35           /* kube-system/metrics-server cluster IP */ tcp dpt:443
2    KUBE-SVC-WT3SFWJ44Q74XUPR  tcp  --  0.0.0.0/0            10.0.36.18           /* kube-system/healthmodel-replicaset-service cluster IP */ tcp dpt:25227
3    KUBE-SVC-NPX46M4PTMTKRN6Y  tcp  --  0.0.0.0/0            10.0.0.1             /* default/kubernetes:https cluster IP */ tcp dpt:443
4    KUBE-SVC-TCOU7JCQXEZGVUNU  udp  --  0.0.0.0/0            10.0.0.10            /* kube-system/kube-dns:dns cluster IP */ udp dpt:53
5    KUBE-SVC-ERIFXISQEP7F7OF4  tcp  --  0.0.0.0/0            10.0.0.10            /* kube-system/kube-dns:dns-tcp cluster IP */ tcp dpt:53
6    KUBE-NODEPORTS  all  --  0.0.0.0/0            0.0.0.0/0            /* kubernetes service nodeports; NOTE: this must be the last rule in this chain */ ADDRTYPE match dst-type LOCAL

에서aks-nodepool1-1068416-vms는kube-proxy-pj49z이다.

$ kubectl exec kube-proxy-pj49z -n kube-system -- iptables -nL KUBE-SERVICES -t nat --line-numbers
Chain KUBE-SERVICES (2 references)
num  target     prot opt source               destination
1    KUBE-SVC-ERIFXISQEP7F7OF4  tcp  --  0.0.0.0/0            10.0.0.10            /* kube-system/kube-dns:dns-tcp cluster IP */ tcp dpt:53
2    KUBE-SVC-QMWWTXBG7KFJQKLO  tcp  --  0.0.0.0/0            10.0.60.35           /* kube-system/metrics-server cluster IP */ tcp dpt:443
3    KUBE-SVC-WT3SFWJ44Q74XUPR  tcp  --  0.0.0.0/0            10.0.36.18           /* kube-system/healthmodel-replicaset-service cluster IP */ tcp dpt:25227
4    KUBE-SVC-NPX46M4PTMTKRN6Y  tcp  --  0.0.0.0/0            10.0.0.1             /* default/kubernetes:https cluster IP */ tcp dpt:443
5    KUBE-SVC-TCOU7JCQXEZGVUNU  udp  --  0.0.0.0/0            10.0.0.10            /* kube-system/kube-dns:dns cluster IP */ udp dpt:53
6    KUBE-NODEPORTS  all  --  0.0.0.0/0            0.0.0.0/0            /* kubernetes service nodeports; NOTE: this must be the last rule in this chain */ ADDRTYPE match dst-type LOCAL

순서가 조금 미묘하게 다른 건 신경 쓰이지만 큰 차이가 나지 않는 게 좋을 것 같아요.
그리고 이렇게 말하지만 Cluster IP는 각자iptables에 등록되어 있습니다.
좀 더 효율적일 수 있을 것 같지만 nodes/pods가 있는subnet부터 IP 주소를 사용하지 않고 실현하면 이렇게 될까요.