{"id":918,"date":"2017-12-24T17:47:41","date_gmt":"2017-12-24T09:47:41","guid":{"rendered":"https:\/\/www.ipcpu.com\/?p=918"},"modified":"2017-12-24T17:47:41","modified_gmt":"2017-12-24T09:47:41","slug":"kube-proxy-nf_conntrack-max-131072","status":"publish","type":"post","link":"https:\/\/c.ipcpu.com\/2017\/12\/kube-proxy-nf_conntrack-max-131072\/","title":{"rendered":"Kube-proxy\u4f1a\u81ea\u52a8\u5c06nf_conntrack_max\u6539\u4e3a131072"},"content":{"rendered":"<p><img decoding=\"async\" src=\"\/\/www.ipcpu.com\/wp-content\/uploads\/2018\/01\/wpid-07564f9d088b36659fd51324aca81e4d_2018-01-10_184942.jpg\" style=\"vertical-align: bottom; max-width: 100%;\"><\/p>\n<h2 id=\"\u4e00\u3001\u53d1\u73b0\u95ee\u9898\">\u4e00\u3001\u53d1\u73b0\u95ee\u9898<\/h2>\n<p>\u65b0\u642d\u5efa\u4e86Kubernetes1.8.1\uff0c\u60f3\u5bf9ingress\u548cnodeport\u6027\u80fd\u8fdb\u884c\u6d4b\u8bd5\u3002\u7ed3\u679cab\u8dd1\u4e86\u6ca1\u51e0\u4e2a\u8bf7\u6c42\uff0cK8S\u7684\u673a\u5668\u5c31\u62a5\u9519\u4e86\u3002<\/p>\n<div>\n<pre><code>kernel: nf_conntrack: table full, dropping packet<\/code><\/pre>\n<\/div>\n<h2 id=\"\u4e8c\u3001\u6392\u67e5\u5b9a\u4f4d\">\u4e8c\u3001\u6392\u67e5\u5b9a\u4f4d<\/h2>\n<p>\u8fd9\u4e5f\u7b97\u7ecf\u5178\u7684\u9519\u8bef\u4e86\uff0c\u67e5\u4e86\u4e0bnf_conntrack_max\u53ea\u6709131072\uff0c\u80af\u5b9a\u662f\u4e0d\u591f\u7684\uff0cCentOS7.3\u9ed8\u8ba4\u5e94\u8be5\u662f65536*4=262144\u3002\u80af\u5b9a\u662f\u6709\u5730\u65b9\u6539\u52a8\u8fd9\u4e2a\u503c\u4e86\uff0c\u67e5\u4e86\u4e00\u5708\u6ca1\u627e\u5230\uff0c\u6700\u540e\u770b\u4e86\u4e0bKube-proxy\u7684\u65e5\u5fd7\uff0c\u7ed3\u679c\u8fd8\u771f\u662f\u5b83\u6539\u7684\uff01<\/p>\n<div>\n<pre><code>[root@k8s-m-1 ~]# kubectl logs kube-proxy-q2s4h -n kube-system\nW0110 09:32:36.679540      1 server_others.go:263] Flag proxy-mode=\"\" unknown, assuming iptables proxy\nI0110 09:32:36.681946      1 server_others.go:117] Using iptables Proxier.\nI0110 09:32:36.699112      1 server_others.go:152] Tearing down inactive rules.\nI0110 09:32:36.860064      1 conntrack.go:98] Set sysctl 'net\/netfilter\/nf_conntrack_max' to 131072\nI0110 09:32:36.860138      1 conntrack.go:52] Setting nf_conntrack_max to 131072\nI0110 09:32:36.860192      1 conntrack.go:98] Set sysctl 'net\/netfilter\/nf_conntrack_tcp_timeout_established' to 86400\nI0110 09:32:36.860230      1 conntrack.go:98] Set sysctl 'net\/netfilter\/nf_conntrack_tcp_timeout_close_wait' to 3600\nI0110 09:32:36.860480      1 config.go:102] Starting endpoints config controller<\/code><\/pre>\n<\/div>\n<h2 id=\"\u4e09\u3001\u5bfb\u627e\u7f6a\u9b41\u7978\u9996\">\u4e09\u3001\u5bfb\u627e\u7f6a\u9b41\u7978\u9996<\/h2>\n<p>\u7ffb\u770b\u4e86\u4e00\u4e0b\u6e90\u4ee3\u7801\uff0c\u53d1\u73b0\u8fd9\u662f\u4e00\u4e2a\u9884\u8bbe\u503c\uff0c\u5728kube-proxy\u7684\u53c2\u6570\u91cc\u53ef\u4ee5\u627e\u5230\u3002<\/p>\n<div>\n<pre><code>--conntrack-max-per-core int32                Maximum number of NAT connections to track per CPU core (0 to leave the limit as-is and ignore conntrack-min). (default 32768)\n#@\u6bcf\u4e2a\u6838\u9ed8\u8ba432768\u4e2a\uff0c\u603b\u6570\u5c31\u662f32768*CPU\u6838\u6570\n--conntrack-min int32                          Minimum number of conntrack entries to allocate, regardless of conntrack-max-per-core (set conntrack-max-per-core=0 to leave the limit as-is). (default 131072)\n#@\u6700\u5c0f\u503c\u662f131072\u4e2a\uff0cCPU\u6838\u6570\u4f4e\u4e8e\u6216\u8005\u7b49\u4e8e4\uff0c\u9ed8\u8ba4\u662f131072<\/code><\/pre>\n<\/div>\n<h2 id=\"\u56db\u3001\u89e3\u51b3\">\u56db\u3001\u89e3\u51b3<\/h2>\n<p>\u627e\u5230\u539f\u56e0\u4e86\uff0c\u5982\u4f55\u4fee\u6539kube-proxy\u7684\u53c2\u6570\u5462\uff1f<\/p>\n<p>\u6211\u7684K8S\u4f7f\u7528kubeadm\u5b89\u88c5\u7684\uff0ckube-proxy\u662f\u8fd0\u884c\u5728\u5bb9\u5668\u91cc\u7684\uff0c\u53ea\u80fd\u53bbdashboard\u91cc\u9762\u53bb\u4fee\u6539YAML\u6587\u4ef6\u4e86\u3002<\/p>\n<div>\n<pre><code>            \"command\": [\n              \"\/usr\/local\/bin\/kube-proxy\",\n              \"--kubeconfig=\/var\/lib\/kube-proxy\/kubeconfig.conf\",\n              \"--cluster-cidr=10.96.0.0\/12\",\n              \"--conntrack-min=524288\"\n            ],<\/code><\/pre>\n<\/div>\n<p>\u6539\u5b8c\u5c31\u81ea\u52a8\u751f\u6548\u4e86\u3002<\/p>\n<p>\u770b\u6765Kubernetes\u7684\u9884\u8bbe\u503c\u8fd8\u6709\u5f88\u591a\u5751\uff0c\u5f97\u4ed4\u7ec6\u770b\u770b\u3002<\/p>\n<h2 id=\"\u4e94\u3001\u53c2\u8003\u8d44\u6599\">\u4e94\u3001\u53c2\u8003\u8d44\u6599<\/h2>\n<p><a href=\"https:\/\/kubernetes.io\/docs\/reference\/generated\/kube-proxy\/\">https:\/\/kubernetes.io\/docs\/reference\/generated\/kube-proxy\/<\/a><\/p>\n<p><wiz_tmp_tag id=\"wiz-table-range-border\" contenteditable=\"false\" style=\"display: none;\"><\/p>\n<div id=\"wiz-table-col-line\" style=\"display: none;\"><\/div>\n<div id=\"wiz-table-row-line\" style=\"display: none;\"><\/div>\n<div id=\"wiz-table-range-border_start\" style=\"display: none;\">\n<div id=\"wiz-table-range-border_start_top\"><\/div>\n<div id=\"wiz-table-range-border_start_right\"><\/div>\n<div id=\"wiz-table-range-border_start_bottom\"><\/div>\n<div id=\"wiz-table-range-border_start_left\"><\/div>\n<div id=\"wiz-table-range-border_start_dot\"><\/div>\n<\/div>\n<div id=\"wiz-table-range-border_range\" style=\"display: none;\">\n<div id=\"wiz-table-range-border_range_top\"><\/div>\n<div id=\"wiz-table-range-border_range_right\"><\/div>\n<div id=\"wiz-table-range-border_range_bottom\"><\/div>\n<div id=\"wiz-table-range-border_range_left\"><\/div>\n<div id=\"wiz-table-range-border_range_dot\"><\/div>\n<\/div>\n<p><\/wiz_tmp_tag><\/p>\n<p>\u8f6c\u8f7d\u8bf7\u6ce8\u660e\uff1a<a href=\"https:\/\/c.ipcpu.com\">IPCPU-\u7f51\u7edc\u4e4b\u8def<\/a> &raquo; <a href=\"https:\/\/c.ipcpu.com\/2017\/12\/kube-proxy-nf_conntrack-max-131072\/\">Kube-proxy\u4f1a\u81ea\u52a8\u5c06nf_conntrack_max\u6539\u4e3a131072<\/a><\/p>","protected":false},"excerpt":{"rendered":"<p>\u4e00\u3001\u53d1\u73b0\u95ee\u9898 \u65b0\u642d\u5efa\u4e86Kubernetes1.8.1\uff0c\u60f3\u5bf9ingress\u548cnodeport\u6027\u80fd\u8fdb\u884c\u6d4b\u8bd5\u3002\u7ed3\u679cab\u8dd1\u4e86\u6ca1\u51e0\u4e2a\u8bf7\u6c42\uff0cK8S\u7684\u673a\u5668\u5c31\u62a5\u9519\u4e86\u3002 kernel: nf_conntrack: table full, dropping packet \u4e8c\u3001\u6392\u67e5\u5b9a\u4f4d \u8fd9\u4e5f\u7b97\u7ecf\u5178\u7684\u9519\u8bef\u4e86\uff0c\u67e5\u4e86\u4e0bnf_conntrack_max\u53ea\u6709131072\uff0c\u80af\u5b9a\u662f\u4e0d\u591f\u7684\uff0cCentOS7.3\u9ed8\u8ba4\u5e94\u8be5\u662f65536*4=262144\u3002\u80af\u5b9a\u662f\u6709\u5730\u65b9\u6539\u52a8\u8fd9\u4e2a\u503c\u4e86\uff0c\u67e5\u4e86\u4e00\u5708\u6ca1\u627e\u5230\uff0c\u6700\u540e\u770b\u4e86\u4e0bKube-proxy\u7684\u65e5\u5fd7\uff0c\u7ed3\u679c\u8fd8\u771f\u662f\u5b83\u6539\u7684\uff01 [root@k8s-m-1 ~]# kubectl logs kube-proxy-q2s4h -n kube-system W0110 09:32:36.679540 1 server_others.go:263] Flag proxy-mode=&#8221;&#8221; unknown, assuming iptables proxy I0110 09:32:36.681946 1 server_others.go:117] Using iptables Proxier. I0110 09:32:36.699112 1 server_others.go:152] Tearing down inactive rules. I0110 09:32:36.860064 1 conntrack.go:98] Set sysctl &#8216;net\/netfilter\/nf_conntrack_max&#8217; to 131072 I0110 09:32:36.860138 1 conntrack.go:52] [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[3,13],"tags":[54,135,129,136],"_links":{"self":[{"href":"https:\/\/c.ipcpu.com\/wp-json\/wp\/v2\/posts\/918"}],"collection":[{"href":"https:\/\/c.ipcpu.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/c.ipcpu.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/c.ipcpu.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/c.ipcpu.com\/wp-json\/wp\/v2\/comments?post=918"}],"version-history":[{"count":0,"href":"https:\/\/c.ipcpu.com\/wp-json\/wp\/v2\/posts\/918\/revisions"}],"wp:attachment":[{"href":"https:\/\/c.ipcpu.com\/wp-json\/wp\/v2\/media?parent=918"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/c.ipcpu.com\/wp-json\/wp\/v2\/categories?post=918"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/c.ipcpu.com\/wp-json\/wp\/v2\/tags?post=918"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}