堆栈内存溢出
  繁体   English   中英

为什么某些kube-system Pod（例如kube-proxy）与它们所在的节点具有相同的Pod IP？

[英]Why do certain kube-system Pods such as kube-proxy have the same Pod IP as the node that they are on?

 原文  2019-02-19 18:47:56  5   1    kubernetes

问题描述

我注意到了某些我没想到的事情，并且在我的一个集群中找不到今天的解释。 许多kube-system Pod的Pod IP与它们所在的节点相同。 我想了解为什么会这样，但是我找不到关于此事的任何文档或其他地方的讨论。 这是我看到的： 

k get nodes -o wide
NAME                       STATUS   ROLES   AGE   VERSION   INTERNAL-IP   EXTERNAL-IP   OS-IMAGE             KERNEL-VERSION      CONTAINER-RUNTIME
aks-agentpool-14855512-0   Ready    agent   47m   v1.12.5   10.240.0.66   <none>        Ubuntu 16.04.5 LTS   4.15.0-1037-azure   docker://3.0.4
aks-agentpool-14855512-1   Ready    agent   47m   v1.12.5   10.240.0.4    <none>        Ubuntu 16.04.5 LTS   4.15.0-1037-azure   docker://3.0.4
aks-agentpool-14855512-2   Ready    agent   47m   v1.12.5   10.240.0.35   <none>        Ubuntu 16.04.5 LTS   4.15.0-1037-azure   docker://3.0.4

 k get po -n kube-system -o wide | grep '10.240.0.4 '
azure-cni-networkmonitor-rqs8q       1/1     Running   0          48m   10.240.0.4    aks-agentpool-14855512-1   <none>
azure-ip-masq-agent-dj8w5            1/1     Running   0          48m   10.240.0.4    aks-agentpool-14855512-1   <none>
kube-proxy-jpjjc                     1/1     Running   0          48m   10.240.0.4    aks-agentpool-14855512-1   <none>
kube-svc-redirect-bfvlk              2/2     Running   0          48m   10.240.0.4    aks-agentpool-14855512-1   <none>

我的理解是，Pods应该具有与其所在节点不同的IP。 要公开Pod，应使用服务。 但是，我没有看到这种情况： 

k get svc -n kube-system
NAME                   TYPE        CLUSTER-IP    EXTERNAL-IP   PORT(S)         AGE
heapster               ClusterIP   10.0.0.57     <none>        80/TCP          55m
kube-dns               ClusterIP   10.0.0.10     <none>        53/UDP,53/TCP   55m
kubernetes-dashboard   ClusterIP   10.0.105.92   <none>        80/TCP          55m
metrics-server         ClusterIP   10.0.179.25   <none>        443/TCP         55m

起初，我认为此实现特定于AKS，但是，对于GKE来说，同样的结果也适用。

恐怕我可能错过了一个非常基本的概念，使我无法更好地理解这一概念。 任何援助将不胜感激。

更新：这是因为在Pod YAML hostNetworking: true设置为hostNetworking: true 。

您可以通过运行以下内容进行观察： 

k get po kube-proxy-jpjjc  -n kube-system -o yaml
apiVersion: v1
kind: Pod
metadata:
  annotations:
    aks.microsoft.com/release-time: 'seconds:1550597164 nanos:675278758 '
  creationTimestamp: "2019-02-19T17:29:15Z"
  generateName: kube-proxy-
  labels:
    component: kube-proxy
    controller-revision-hash: 68c8cf5db6
    pod-template-generation: "1"
    tier: node
  name: kube-proxy-jpjjc
  namespace: kube-system
  ownerReferences:
  - apiVersion: apps/v1
    blockOwnerDeletion: true
    controller: true
    kind: DaemonSet
    name: kube-proxy
    uid: 75df85c8-346b-11e9-a1db-667e55a73bba
  resourceVersion: "693"
  selfLink: /api/v1/namespaces/kube-system/pods/kube-proxy-jpjjc
  uid: e1004b3e-346b-11e9-a1db-667e55a73bba
spec:
  affinity:
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
        - matchFields:
          - key: metadata.name
            operator: In
            values:
            - aks-agentpool-14855512-1
  containers:
  - command:
    - /hyperkube
    - proxy
    - --kubeconfig=/var/lib/kubelet/kubeconfig
    - --cluster-cidr=10.240.0.0/16
    - --feature-gates=ExperimentalCriticalPodAnnotation=true
    env:
    - name: KUBERNETES_PORT_443_TCP_ADDR
      value: nodeport-test-cni-87e6d01c.hcp.westus2.azmk8s.io
    - name: KUBERNETES_PORT
      value: tcp://nodeport-test-cni-87e6d01c.hcp.westus2.azmk8s.io:443
    - name: KUBERNETES_PORT_443_TCP
      value: tcp://nodeport-test-cni-87e6d01c.hcp.westus2.azmk8s.io:443
    - name: KUBERNETES_SERVICE_HOST
      value: nodeport-test-cni-87e6d01c.hcp.westus2.azmk8s.io
    image: k8s.gcr.io/hyperkube-amd64:v1.12.5
    imagePullPolicy: IfNotPresent
    name: kube-proxy
    resources:
      requests:
        cpu: 100m
    securityContext:
      privileged: true
      procMount: Default
    terminationMessagePath: /dev/termination-log
    terminationMessagePolicy: File
    volumeMounts:
    - mountPath: /var/lib/kubelet
      name: kubeconfig
      readOnly: true
    - mountPath: /etc/kubernetes/certs
      name: certificates
      readOnly: true
    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
      name: default-token-7m959
      readOnly: true
  dnsPolicy: ClusterFirst
  hostNetwork: true
  nodeName: aks-agentpool-14855512-1
  nodeSelector:
    beta.kubernetes.io/os: linux
  priority: 1000000
  priorityClassName: high-priority
  restartPolicy: Always
  schedulerName: default-scheduler
  securityContext: {}
  serviceAccount: default
  serviceAccountName: default
  terminationGracePeriodSeconds: 30
  tolerations:
  - effect: NoSchedule
    key: node-role.kubernetes.io/master
    operator: Equal
    value: "true"
  - effect: NoExecute
    key: node.kubernetes.io/not-ready
    operator: Exists
  - effect: NoExecute
    key: node.kubernetes.io/unreachable
    operator: Exists
  - effect: NoSchedule
    key: node.kubernetes.io/disk-pressure
    operator: Exists
  - effect: NoSchedule
    key: node.kubernetes.io/memory-pressure
    operator: Exists
  - effect: NoSchedule
    key: node.kubernetes.io/unschedulable
    operator: Exists
  - effect: NoSchedule
    key: node.kubernetes.io/network-unavailable
    operator: Exists
  volumes:
  - hostPath:
      path: /var/lib/kubelet
      type: ""
    name: kubeconfig
  - hostPath:
      path: /etc/kubernetes/certs
      type: ""
    name: certificates
  - name: default-token-7m959
    secret:
      defaultMode: 420
      secretName: default-token-7m959
status:
  conditions:
  - lastProbeTime: null
    lastTransitionTime: "2019-02-19T17:29:18Z"
    status: "True"
    type: Initialized
  - lastProbeTime: null
    lastTransitionTime: "2019-02-19T17:29:29Z"
    status: "True"
    type: Ready
  - lastProbeTime: null
    lastTransitionTime: "2019-02-19T17:29:29Z"
    status: "True"
    type: ContainersReady
  - lastProbeTime: null
    lastTransitionTime: "2019-02-19T17:29:15Z"
    status: "True"
    type: PodScheduled
  containerStatuses:
  - containerID: docker://8934a2ec756bf77ad34b352ab78f70f41c7a52f126e511b235378b65c708ff15
    image: k8s.gcr.io/hyperkube-amd64:v1.12.5
    imageID: docker-pullable://k8s.gcr.io/hyperkube-amd64@sha256:82add6703e6e28b50f2457b3a3e4eec573a2603437cb9df1af5670dd7e640e75
    lastState: {}
    name: kube-proxy
    ready: true
    restartCount: 0
    state:
      running:
        startedAt: "2019-02-19T17:29:28Z"
  hostIP: 10.240.0.4
  phase: Running
  podIP: 10.240.0.4
  qosClass: Burstable
  startTime: "2019-02-19T17:29:18Z"

1 个解决方案

解决方案1
 0  2019-02-19 19:03:54

这是因为在Pod YAML hostNetworking: true中设置为hostNetworking: true 。

您可以通过运行以下内容进行观察： 

k get po kube-proxy-jpjjc  -n kube-system -o yaml
apiVersion: v1
kind: Pod
metadata:
  annotations:
    aks.microsoft.com/release-time: 'seconds:1550597164 nanos:675278758 '
  creationTimestamp: "2019-02-19T17:29:15Z"
  generateName: kube-proxy-
  labels:
    component: kube-proxy
    controller-revision-hash: 68c8cf5db6
    pod-template-generation: "1"
    tier: node
  name: kube-proxy-jpjjc
  namespace: kube-system
  ownerReferences:
  - apiVersion: apps/v1
    blockOwnerDeletion: true
    controller: true
    kind: DaemonSet
    name: kube-proxy
    uid: 75df85c8-346b-11e9-a1db-667e55a73bba
  resourceVersion: "693"
  selfLink: /api/v1/namespaces/kube-system/pods/kube-proxy-jpjjc
  uid: e1004b3e-346b-11e9-a1db-667e55a73bba
spec:
  affinity:
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
        - matchFields:
          - key: metadata.name
            operator: In
            values:
            - aks-agentpool-14855512-1
  containers:
  - command:
    - /hyperkube
    - proxy
    - --kubeconfig=/var/lib/kubelet/kubeconfig
    - --cluster-cidr=10.240.0.0/16
    - --feature-gates=ExperimentalCriticalPodAnnotation=true
    env:
    - name: KUBERNETES_PORT_443_TCP_ADDR
      value: nodeport-test-cni-87e6d01c.hcp.westus2.azmk8s.io
    - name: KUBERNETES_PORT
      value: tcp://nodeport-test-cni-87e6d01c.hcp.westus2.azmk8s.io:443
    - name: KUBERNETES_PORT_443_TCP
      value: tcp://nodeport-test-cni-87e6d01c.hcp.westus2.azmk8s.io:443
    - name: KUBERNETES_SERVICE_HOST
      value: nodeport-test-cni-87e6d01c.hcp.westus2.azmk8s.io
    image: k8s.gcr.io/hyperkube-amd64:v1.12.5
    imagePullPolicy: IfNotPresent
    name: kube-proxy
    resources:
      requests:
        cpu: 100m
    securityContext:
      privileged: true
      procMount: Default
    terminationMessagePath: /dev/termination-log
    terminationMessagePolicy: File
    volumeMounts:
    - mountPath: /var/lib/kubelet
      name: kubeconfig
      readOnly: true
    - mountPath: /etc/kubernetes/certs
      name: certificates
      readOnly: true
    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
      name: default-token-7m959
      readOnly: true
  dnsPolicy: ClusterFirst
  hostNetwork: true
  nodeName: aks-agentpool-14855512-1
  nodeSelector:
    beta.kubernetes.io/os: linux
  priority: 1000000
  priorityClassName: high-priority
  restartPolicy: Always
  schedulerName: default-scheduler
  securityContext: {}
  serviceAccount: default
  serviceAccountName: default
  terminationGracePeriodSeconds: 30
  tolerations:
  - effect: NoSchedule
    key: node-role.kubernetes.io/master
    operator: Equal
    value: "true"
  - effect: NoExecute
    key: node.kubernetes.io/not-ready
    operator: Exists
  - effect: NoExecute
    key: node.kubernetes.io/unreachable
    operator: Exists
  - effect: NoSchedule
    key: node.kubernetes.io/disk-pressure
    operator: Exists
  - effect: NoSchedule
    key: node.kubernetes.io/memory-pressure
    operator: Exists
  - effect: NoSchedule
    key: node.kubernetes.io/unschedulable
    operator: Exists
  - effect: NoSchedule
    key: node.kubernetes.io/network-unavailable
    operator: Exists
  volumes:
  - hostPath:
      path: /var/lib/kubelet
      type: ""
    name: kubeconfig
  - hostPath:
      path: /etc/kubernetes/certs
      type: ""
    name: certificates
  - name: default-token-7m959
    secret:
      defaultMode: 420
      secretName: default-token-7m959
status:
  conditions:
  - lastProbeTime: null
    lastTransitionTime: "2019-02-19T17:29:18Z"
    status: "True"
    type: Initialized
  - lastProbeTime: null
    lastTransitionTime: "2019-02-19T17:29:29Z"
    status: "True"
    type: Ready
  - lastProbeTime: null
    lastTransitionTime: "2019-02-19T17:29:29Z"
    status: "True"
    type: ContainersReady
  - lastProbeTime: null
    lastTransitionTime: "2019-02-19T17:29:15Z"
    status: "True"
    type: PodScheduled
  containerStatuses:
  - containerID: docker://8934a2ec756bf77ad34b352ab78f70f41c7a52f126e511b235378b65c708ff15
    image: k8s.gcr.io/hyperkube-amd64:v1.12.5
    imageID: docker-pullable://k8s.gcr.io/hyperkube-amd64@sha256:82add6703e6e28b50f2457b3a3e4eec573a2603437cb9df1af5670dd7e640e75
    lastState: {}
    name: kube-proxy
    ready: true
    restartCount: 0
    state:
      running:
        startedAt: "2019-02-19T17:29:28Z"
  hostIP: 10.240.0.4
  phase: Running
  podIP: 10.240.0.4
  qosClass: Burstable
  startTime: "2019-02-19T17:29:18Z"

暂无
暂无

声明:本站的技术帖子网页，遵循CC BY-SA 4.0协议，如果您需要转载，请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.

相关问题 在 Kubernetes 集群中，kubelet 只是另一个 pod，如 kube-proxy、core-dns 吗？ 我在 kube-system 命名空间中找不到 kubelet pods？ 防止 kube-system pods 在特定节点上运行 kube-system 命名空间中的 pod 是如何管理的？ Rancher：kube-system pod 卡在 ContainerCreating 上 Kubernetes：将pod链接到kube-proxy 为什么 fluentd/kube-proxy/prometheus 的 GKE 中的 IP 地址等于节点地址 在 K8S 中，每个 kube-proxy（在每个节点上运行）都具有相同的实现吗？ kube-proxy报告错误的IP地址 kube-system：Pod警告失败调度默认调度程序无节点可用于调度Pod 获取除 kube-system 中的 pod 之外的所有 pod
相关标签
 
粤ICP备18138465号  © 2020-2024 STACKOOM.COM