clean up iptables/ipvs proxy mode descriptions a bit #44110

danwinship · 2023-11-27T20:36:46Z

Noticed while adding the nftables documentation.

filing this against dev-1.29 because @sftim said to but nothing in here is new in 1.29.

The iptables kube-proxy documentation notes that it has "lower system overhead", but doesn't mention what it's lower than; it's talking about the userspace proxy, which no longer exists, and which no current documentation readers would think to compare the iptables proxy mode to. Likewise, there is no point in explaining how iptables mode endpoint selection differs from userspace mode endpoint selection, because the iptables mode behaves in the way that everyone would consider normal. It was the userspace proxy that was weird, and so we had to document the *change* in behavior when we introduced the iptables proxy, but there's no reason to keep documenting "we don't do something you wouldn't have expected us to do" now.

netlify · 2023-11-27T20:37:30Z

👷 Deploy Preview for kubernetes-io-vnext-staging processing.

Name	Link
🔨 Latest commit	`d5c5300`
🔍 Latest deploy log	https://app.netlify.com/sites/kubernetes-io-vnext-staging/deploys/656a07b19412c50008e0baee

Shubham82 · 2023-11-28T05:19:27Z

/sig network

sftim

My thoughts - hope these make sense?

content/en/docs/reference/networking/virtual-ips.md

sftim · 2023-11-29T00:16:33Z

content/en/docs/reference/networking/virtual-ips.md

@@ -266,7 +255,7 @@ the node before starting kube-proxy.

 When kube-proxy starts in IPVS proxy mode, it verifies whether IPVS
 kernel modules are available. If the IPVS kernel modules are not detected, then kube-proxy
-falls back to running in iptables proxy mode.
+will exit with an error.


Suggested change

will exit with an error.

exits with an error. Kubernetes does offer you some features that you can use to help

with that; for example, you can define an

{{< glossary_tooltip text="init container" term_id="init-container" >}} that ensures the relevant

modules are loaded before starting the container for `kube-proxy`.

?

That's a separate thing really; this is about if you try to run the ipvs proxy on a system that doesn't have the relevant kernel modules available at all. (Like if you try to specify a fancy new ipvs scheduler mode on an older kernel.)

Can we document the minimum Linux kernel version for IPVS mode (maybe for different flavors, if that matters)?

I'd assumed it was 2.2.0 or something venerable, that we could assume everyone has.

katcosgrove · 2023-11-30T13:24:00Z

Hey @danwinship! If we can land this before I freeze the website on Monday, it's good to go in with dev-1.29.

sftim

/lgtm

A review from SIG Network would be welcome.

content/en/docs/reference/networking/virtual-ips.md

k8s-ci-robot · 2023-11-30T18:21:57Z

LGTM label has been added.

Git tree hash: ac8339c8a74e3ec97f8db9866ecd8cecf0413205

Move the "watches Services and EndpointSlices" and "control loop" text to the top level, since that applies to all proxy modes. Likewise, the allegedly iptables-specific graphic is actually sufficiently abstract to apply to any possible proxy. Also fix an out-of-date claim about ipvs mode falling back to iptables mode.

danwinship · 2023-11-30T18:48:01Z

/assign @aojea

jihoon-seo · 2023-12-01T00:37:52Z

/label tide/merge-method-squash

Shubham82 · 2023-12-01T08:30:56Z

@danwinship The test cases failed due to Netlify build timeout failures.
please re-push the commit.

git reset
git commit --amend --no-edit
git push --force-with-lease

sftim · 2023-12-01T12:36:23Z

No need to squash for 3 commits.
/remove-label tide/merge-method-squash

aojea · 2023-12-01T16:21:16Z

/lgtm

k8s-ci-robot · 2023-12-01T16:21:23Z

LGTM label has been added.

Git tree hash: fb5979179156812011815469b12df77bd41d4ae5

sftim · 2023-12-01T16:46:23Z

/approve

k8s-ci-robot · 2023-12-01T16:46:32Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: sftim

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~content/en/OWNERS~~ [sftim]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot added this to the 1.29 milestone Nov 27, 2023

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Nov 27, 2023

k8s-ci-robot requested a review from nate-double-u November 27, 2023 20:37

k8s-ci-robot added the language/en Issues or PRs related to English language label Nov 27, 2023

k8s-ci-robot requested a review from tengqm November 27, 2023 20:37

k8s-ci-robot added sig/docs Categorizes an issue or PR as relevant to SIG Docs. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Nov 27, 2023

k8s-ci-robot added the sig/network Categorizes an issue or PR as relevant to SIG Network. label Nov 28, 2023

sftim reviewed Nov 29, 2023

View reviewed changes

danwinship force-pushed the proxy-refactor branch from eea8460 to fb0220c Compare November 30, 2023 18:10

sftim reviewed Nov 30, 2023

View reviewed changes

content/en/docs/reference/networking/virtual-ips.md Outdated Show resolved Hide resolved

k8s-ci-robot assigned sftim Nov 30, 2023

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 30, 2023

danwinship force-pushed the proxy-refactor branch from fb0220c to f5d05dc Compare November 30, 2023 18:47

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 30, 2023

k8s-ci-robot requested a review from sftim November 30, 2023 18:47

k8s-ci-robot assigned aojea Nov 30, 2023

k8s-ci-robot added the tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges. label Dec 1, 2023

k8s-ci-robot removed the tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges. label Dec 1, 2023

Clarify iptables performance slightly

d5c5300

danwinship force-pushed the proxy-refactor branch from f5d05dc to d5c5300 Compare December 1, 2023 16:19

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Dec 1, 2023

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Dec 1, 2023

k8s-ci-robot merged commit ce56b7a into kubernetes:dev-1.29 Dec 1, 2023
6 checks passed

danwinship deleted the proxy-refactor branch September 12, 2024 20:38

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

clean up iptables/ipvs proxy mode descriptions a bit #44110

clean up iptables/ipvs proxy mode descriptions a bit #44110

danwinship commented Nov 27, 2023

netlify bot commented Nov 27, 2023 •

edited

Loading

Shubham82 commented Nov 28, 2023

sftim left a comment

sftim Nov 29, 2023 •

edited

Loading

danwinship Nov 30, 2023

sftim Nov 30, 2023

katcosgrove commented Nov 30, 2023

sftim left a comment

k8s-ci-robot commented Nov 30, 2023

danwinship commented Nov 30, 2023

jihoon-seo commented Dec 1, 2023

Shubham82 commented Dec 1, 2023

sftim commented Dec 1, 2023

aojea commented Dec 1, 2023

k8s-ci-robot commented Dec 1, 2023

sftim commented Dec 1, 2023

k8s-ci-robot commented Dec 1, 2023

-will exit with an error.
+exits with an error. Kubernetes does offer you some features that you can use to help
+with that; for example, you can define an
+{{< glossary_tooltip text="init container" term_id="init-container" >}} that ensures the relevant
+modules are loaded before starting the container for `kube-proxy`.

clean up iptables/ipvs proxy mode descriptions a bit #44110

clean up iptables/ipvs proxy mode descriptions a bit #44110

Conversation

danwinship commented Nov 27, 2023

netlify bot commented Nov 27, 2023 • edited Loading

👷 Deploy Preview for kubernetes-io-vnext-staging processing.

Shubham82 commented Nov 28, 2023

sftim left a comment

Choose a reason for hiding this comment

sftim Nov 29, 2023 • edited Loading

Choose a reason for hiding this comment

danwinship Nov 30, 2023

Choose a reason for hiding this comment

sftim Nov 30, 2023

Choose a reason for hiding this comment

katcosgrove commented Nov 30, 2023

sftim left a comment

Choose a reason for hiding this comment

k8s-ci-robot commented Nov 30, 2023

danwinship commented Nov 30, 2023

jihoon-seo commented Dec 1, 2023

Shubham82 commented Dec 1, 2023

sftim commented Dec 1, 2023

aojea commented Dec 1, 2023

k8s-ci-robot commented Dec 1, 2023

sftim commented Dec 1, 2023

k8s-ci-robot commented Dec 1, 2023

netlify bot commented Nov 27, 2023 •

edited

Loading

sftim Nov 29, 2023 •

edited

Loading