跳到主要内容

EKS 的 kube-proxy

概述

EKS 的 Auto Mode 和 Fargate 都看不到 kube-proxy,但实际背后应该有 kube-proxy 在运行,因为可以正常访问 Service,对于用户来说是黑盒。

只有在安装了 kube-proxy 插件,并创建了节点组时,由节点组创建出来的节点才会部署 kube-proxy DaemonSet,通过 nodeAffinity 来排除掉 Fargate 和 Auto Mode 节点:

affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: eks.amazonaws.com/compute-type
operator: NotIn
values:
- fargate
- auto

如何设置转发模式

安装 kube-proxy 插件,默认是 iptables 转发模式,可通过插件配置来自定义,比如设置为 ipvs 转发模式:

组件部署 YAML

apiVersion: apps/v1
kind: DaemonSet
metadata:
labels:
eks.amazonaws.com/component: kube-proxy
k8s-app: kube-proxy
name: kube-proxy
namespace: kube-system
spec:
revisionHistoryLimit: 10
selector:
matchLabels:
k8s-app: kube-proxy
template:
metadata:
creationTimestamp: null
labels:
k8s-app: kube-proxy
spec:
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: kubernetes.io/os
operator: In
values:
- linux
- key: kubernetes.io/arch
operator: In
values:
- amd64
- arm64
- key: eks.amazonaws.com/compute-type
operator: NotIn
values:
- fargate
- auto
containers:
- command:
- kube-proxy
- --v=2
- --config=/var/lib/kube-proxy-config/config
- --hostname-override=$(NODE_NAME)
env:
- name: NODE_NAME
valueFrom:
fieldRef:
apiVersion: v1
fieldPath: spec.nodeName
image: 602401143452.dkr.ecr.us-east-2.amazonaws.com/eks/kube-proxy:v1.33.3-minimal-eksbuild.6
imagePullPolicy: IfNotPresent
name: kube-proxy
resources:
requests:
cpu: 100m
securityContext:
privileged: true
terminationMessagePath: /dev/termination-log
terminationMessagePolicy: File
volumeMounts:
- mountPath: /var/log
name: varlog
- mountPath: /run/xtables.lock
name: xtables-lock
- mountPath: /lib/modules
name: lib-modules
readOnly: true
- mountPath: /var/lib/kube-proxy/
name: kubeconfig
- mountPath: /var/lib/kube-proxy-config/
name: config
dnsPolicy: ClusterFirst
hostNetwork: true
priorityClassName: system-node-critical
restartPolicy: Always
schedulerName: default-scheduler
serviceAccount: kube-proxy
serviceAccountName: kube-proxy
terminationGracePeriodSeconds: 30
tolerations:
- operator: Exists
volumes:
- hostPath:
path: /var/log
type: ""
name: varlog
- hostPath:
path: /run/xtables.lock
type: FileOrCreate
name: xtables-lock
- hostPath:
path: /lib/modules
type: ""
name: lib-modules
- configMap:
defaultMode: 420
name: kube-proxy
name: kubeconfig
- configMap:
defaultMode: 420
name: kube-proxy-config
name: config
updateStrategy:
rollingUpdate:
maxSurge: 0
maxUnavailable: 10%
type: RollingUpdate