为什么我的 Kubernetes pod 网络流量不通过 iptables NAT 表？

Question

我需要在 K8s pod 中根据某些条件将 iptables 规则写入 SNAT 数据包，但网络流量永远不会通过 NAT 表

Answer 1

为什么我的 Kubernetes pod 网络流量不通过 iptables NAT 表？

答：

因为 Kubernetes 对所有 CNI 都有这样的规定。 以下来自Kubernetes 文档

Kubernetes imposes the following fundamental requirements on any networking 
implementation (barring any intentional network segmentation policies):

- pods on a node can communicate with all pods on all nodes without NAT
- agents on a node (e.g. system daemons, kubelet) can communicate with all pods on 
  that node. 
  Note: For those platforms that support Pods running in the host network 
  (e.g. Linux):
  - pods in the host network of a node can communicate with all pods on all nodes 
    without NAT