0

I have installed kubernetes on EC2 environment. I want redirect traffic from external port 6600 to 30000 as nodePort. I'm using iptables to do this (cmd below) but this not doing redirection. I have tested command on other environment and redirect working perfectly. In my opinion the kubernetes is source of problem.

iptables -t nat -A PREROUTING -p tcp --dport 6600 -j REDIRECT --to-port 30000

Result from: sudo iptables -t nat -L

Chain PREROUTING (policy ACCEPT)

target         prot opt source               destination 
KUBE-SERVICES  all  --  anywhere             anywhere             /* kubernetes service portals */
DOCKER         all  --  anywhere             anywhere             ADDRTYPE match dst-type LOCAL
REDIRECT       tcp  --  anywhere             anywhere             tcp dpt:6600 redir ports 30000

1 Answer 1

1

When kube-proxy is used in iptables mode (as it is by dafault in kubernetes), routing requests to services continues to work for existing services even when the kube-proxy process dies on the node Kube-proxy binds and listens (on all k8s nodes) to all ports allocated as NodePorts to ensure these ports stay reserved and no other processes can use them Even if a process starts using NodePort, iptables rules (because they are in PRESOUTING chain) ensure that the traffic sent to the NodePort gets routed to the pods.

Under normal circumstances kube-proxy binds and listens on all NodePorts to ensure these ports stay reserved and no other processes can use them. So you don't have to manually configure iptables rules if you have service NodePort.

There’s a KUBE-SERVICES chain in the target that’s created by kube-proxy. List the rules in that chain, see example below:

$ sudo iptables -t nat -L KUBE-SERVICES -n | column -t
...
KUBE-NODEPORTS             all            --   0.0.0.0/0       0.0.0.0/0     /*  kubernetes                                   service  nodeports;  NOTE:  this  must       be  the  last  rule  in  this  chain  */  ADDRTYPE  match  dst-type  LOCAL

As you can see one target in the KUBE-SERVICES chain is the KUBE-NODEPORTS chain. Since the service we created is of type NodePort, let’s list the rules in KUBE-NODEPORTS chain.

$ sudo iptables -t nat -L KUBE-NODEPORTS -n | column -t

You should see that output show that targets are for packets destined to your NodePort 30000.

Then verify kube-proxy is listening on NodePort.

Under normal circumstances kube-proxy binds and listens on all NodePorts to ensure these ports stay reserved and no other processes can use them. You can verify this on the above kubernetes node:

$ sudo lsof -i:30000
$ ps -aef | grep -v grep | grep PID

You should see that kube-proxy is listening on NodePort 6600. In iptables mode, kube-proxy creates iptables rules for kubernetes services which ensure that the request to the service gets routed (and load balanced) to the appropriate pods.

As long as these iptables rules exist, requests to services will get routed to the appropriate pods even if kube-proxy process dies on the node. Endpoints for new services won’t work from this node, however, since kube-proxy process won’t create the iptables rules for it.

Take a look: iptables-kubernetes.

3
  • Thank you for your answer but 6600 this is not node port. It is normal port on instance not bind to any application. Node port range is from 30000 to higher numbers. I need redirection cause I can't change traffic from port 6600 (exist infrastructure issue).
    – Mateusz
    Nov 18, 2020 at 8:35
  • Sorry my bad, I have edited my answer - change value to 30000 from 6600. In your case nodePort: 30000 and targetPort: 6600.
    – Malgorzata
    Nov 18, 2020 at 15:51
  • I am having this issue as well, does this mean we can't add an iptable rule as indicated by OP to redirect traffic to the NodePort? How do we redirect traffic if client needs to make request to a specific ip? Apr 1 at 11:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.