使用ipvs

從k8s的1.8版本開始，kube-proxy引入了IPVS模式，IPVS模式與iptables同樣基于Netfilter，但是采用的hash表，因此當(dāng)service數(shù)量達到一定規(guī)模時，hash查表的速度優(yōu)勢就會顯現(xiàn)出來，從而提高service的服務(wù)性能。

開啟內(nèi)核參數(shù)

cat >> /etc/sysctl.conf << EOF
net.ipv4.ip_forward = 1
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
EOF

sysctl -p

開啟ipvs支持

yum -y install ipvsadm  ipset

# 臨時生效
modprobe -- ip_vs
modprobe -- ip_vs_rr
modprobe -- ip_vs_wrr
modprobe -- ip_vs_sh
modprobe -- nf_conntrack_ipv4

# 永久生效
cat > /etc/sysconfig/modules/ipvs.modules <<EOF
modprobe -- ip_vs
modprobe -- ip_vs_rr
modprobe -- ip_vs_wrr
modprobe -- ip_vs_sh
modprobe -- nf_conntrack_ipv4
EOF

配置kube-proxy

# 添加下面兩行
  --proxy-mode=ipvs  \
  --masquerade-all=true \

# 修改服務(wù)文件
vim /usr/lib/systemd/system/kube-proxy.service
[Unit]
Description=Kubernetes Kube-Proxy Server
Documentation=https://github.com/GoogleCloudPlatform/kubernetes
After=network.target

[Service]
WorkingDirectory=/data/k8s/kube-proxy
ExecStart=/data/k8s/bin/kube-proxy \
  --bind-address=192.168.1.145 \
  --hostname-override=192.168.1.145 \
  --cluster-cidr=10.254.0.0/16 \
  --kubeconfig=/etc/kubernetes/kube-proxy.kubeconfig \
  --logtostderr=true \
  --proxy-mode=ipvs  \
  --masquerade-all=true \
  --v=2
Restart=on-failure
RestartSec=5
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target 

重啟kube-proxy

systemctl daemon-reload
systemctl restart kube-proxy
systemctl status kube-proxy

測試是否生效

[root@k8sNode01 docker]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
  -> RemoteAddress:Port           Forward Weight ActiveConn InActConn
TCP  10.254.0.1:443 rr
  -> 192.168.1.142:6443           Masq    1      0          0         
  -> 192.168.1.143:6443           Masq    1      1          0         
  -> 192.168.1.144:6443           Masq    1      1          0         
TCP  10.254.27.38:80 rr
  -> 172.30.36.4:9090             Masq    1      0          0         
TCP  10.254.72.60:80 rr
  -> 172.30.90.4:8080             Masq    1      0          0         
TCP  10.254.72.247:80 rr
  -> 172.30.36.5:3000             Masq    1      0          0         
TCP  127.0.0.1:27841 rr
  -> 172.30.36.2:80               Masq    1      0          0         
  -> 172.30.90.2:80               Masq    1      0          0         
TCP  127.0.0.1:28453 rr
  -> 172.30.36.5:3000             Masq    1      0          0         
TCP  127.0.0.1:36018 rr
  -> 172.30.36.4:9090             Masq    1      0          0         
TCP  172.30.90.0:27841 rr
  -> 172.30.36.2:80               Masq    1      0          0         
  -> 172.30.90.2:80               Masq    1      0          0