在 GKE 中配置 kube-proxy

Question

Is there a way to configure kube-proxy in GKE?

I can see the pods creating from the daemonset, but I cannot see the daemonset itself.

Thanks for your help.

Answer 1

At the node level, the system is managed by Kubernetes K8s, whereas, at the master level, the system is managed by GKE . The master operates and runs the Kubernetes API server, core resources controllers and the scheduler.

Even though the kube-proxy resides within the node, the cluster is responsible for the kube-proxy, and, please bear in mind that in GKE the cluster master is inaccessible.

While it is possible to configure the proxy in Kubernetes k8s , it is not possible to do so in GKE.

For the daemonset, please make sure that you are looking through all namespaces.

$ kubectl get ds --all-namespaces

Answer 2

kube-proxy pod in k8s (not only in GKE) is created as Static Pod .

Kubelet automatically creates so-called mirror pod on Kubernetes API server for each static pod, so the pods are visible there, but they cannot be controlled from the API server. 2

That's why you cannot edit and configure it as a usual API object.

However, you can edit kube-proxy manifest on the nodes and kubelet applies a new configuration. Static pod manifest located on each node in

/etc/kubernetes/manifests//etc/kubernetes/manifests/kube-proxy.manifest

You can ssh into node and manually change it but we can automate it using cilium approach for removing kube-proxy 3 with DaemonSet and modify it a little bit 4 .

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: kube-proxy-configurator
  namespace: kube-system
spec:
  selector:
    matchLabels:
      name: kube-proxy-configurator
  template:
    metadata:
      labels:
        name: kube-proxy-configurator
    spec:
      initContainers:
        - command:
            - /bin/sh
            - -c
            - |
              echo 'Changing kube-proxy iptables-min-sync-period'

              sed -i 's/iptables-min-sync-period=10s/iptables-min-sync-period=2s/g' /etc/kubernetes/manifests/kube-proxy.manifest

              echo 'All Done!'

          image: alpine:latest
          name: kube-proxy-configurator
          securityContext:
            privileged: true
          volumeMounts:
            - mountPath: /etc/kubernetes
              name: kubernetes-configs
      containers:
        - image: k8s.gcr.io/pause
          name: pause
      terminationGracePeriodSeconds: 0
      volumes:
        - hostPath:
            path: /etc/kubernetes
            type: Directory
          name: kubernetes-configs

Just apply it and kube-proxy configuration will be changed on each node (even on newly created by autoscaler).

kubectl apply -f kube-proxy-configurator.yml