0

For my Kubernetes nodes, I see following entry with a star under the interface column. I do not see this mentioned in "route" command's documentation. The only star mentioned there is for gateway. This entry has been created by Calico for the gateway on current VM.

Destination Gateway Genmask Flags Metric Ref Use Iface

192.168.0.0 --- 0.0.0.0 --- 255.255.255.0 --- U --- 0 --- 0 --- 0 --- *

I have attached the output of route and "ip route" commands.

enter image description here

Improve this question
7
  • Where did all those hyphens come from? What command did you run to generate this output?
    – Michael Hampton
    May 23, 2019 at 1:25
  • I added the hyphens to the output of "route -n"
    – user6317694
    May 23, 2019 at 11:19
  • 2
    That's really confusing. It's best to just paste command output without modification, and format it with the code format button {} in the editor. Also, you should run ip route instead of the deprecated and sometimes wrong route.
    – Michael Hampton
    May 23, 2019 at 14:36
  • 1
    This is a side effect of route output. Some types of routes (unreachable in your case) don't require the interface specification. So, the route tool uses * as flag of empty interface attribute.
    – Anton Danilov
    May 24, 2019 at 13:41
  • Thanks for suggesting the "ip route" comand @MichaelHampton. he output of that shows the entry as "blackhole". Further looking at Calico documentation, I see that one purpose of blackhole route is to prevent DDoS attacks, though more relevant to IPV6. I am still trying to find the exact purpose of that routing rule.
    – user6317694
    May 24, 2019 at 13:59

1 Answer 1

Reset to default
0

An * under the interface column in output of route command denotes a blackhole destination. In this particular case of a route created by Calico, it causes BIRD to export that route to its BGP peers(on other worker VMs), so that those peers think they can reach the CIDR via this node. For local routing it's not supposed to come into play, because we expect that iptables rules programmed by kube-proxy will DNAT to an actual pod IP.

Source : https://github.com/projectcalico/calico/issues/2457#issuecomment-468767265

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .