2 ms·
Good that they didn't, then. No, seriously, there is no L7 reverse proxy implemented using kube-proxy mechanism (aforementioned DNAT) - It's L4 proxy for suppo
by p_l 4y ago
Good that they didn't, then.
No, seriously, there is no L7 reverse proxy implemented using kube-proxy mechanism (aforementioned DNAT) - It's L4 proxy for supporting legacy code that doesn't support intelligently querying for endpoints (by SRV record, k8s API, or other service discovery protocol).
It's not even required to use it, Services can be declared to not need it (common example is using service mesh or ingress controller with http)
- crabbone 4y agoWe are talking about Kubernetes ingress controllers, in particular, ngnix-based one.
- p_l 4y agoWhich doesn't use DNAT unless you explicitly configure it to do so. nginx-ingress will read Service Endpoints through k8s API and resolve connections to specific pod IPs so long as your network is properly deployed. Of course it's also possible to make it go through serviceIP (which by default is still implemented using DNAT in kube-proxy), but it's not recommended. NodePorts like the example given earlier exist for dealing with external traffic from hosts unaware of (possibly unroutable) serviceIP and podIP ranges. I had lots of !FUN! with nginx-ingress, but that's not one of its faults.