為什么我的 Kubernetes pod 網絡流量不通過 iptables NAT 表？

Question

我需要在 K8s pod 中根據某些條件將 iptables 規則寫入 SNAT 數據包，但網絡流量永遠不會通過 NAT 表

Answer 1

為什么我的 Kubernetes pod 網絡流量不通過 iptables NAT 表？

答：

因為 Kubernetes 對所有 CNI 都有這樣的規定。 以下來自Kubernetes 文檔

Kubernetes imposes the following fundamental requirements on any networking 
implementation (barring any intentional network segmentation policies):

- pods on a node can communicate with all pods on all nodes without NAT
- agents on a node (e.g. system daemons, kubelet) can communicate with all pods on 
  that node. 
  Note: For those platforms that support Pods running in the host network 
  (e.g. Linux):
  - pods in the host network of a node can communicate with all pods on all nodes 
    without NAT