这个故障源起来在k8s上同时安装ceph群集(测试的时候机器不多啊)
当这两者都OK之后,原来k8s上的服务实例,则有的通,有的不通了。
====================
所有可能的故障点,flannel,kubelet,kubeproxy都排查过之后,
定位在Iptable,
但net.ipv4.ip_forward = 1这种配置我是有的。
====================
我同时输出一份正常和不正常的iptables配置。
发现了一个点:
在不通的机器上,IPTABLES将FORWARD转发DROP掉了。
于是启用之后,一切都平静了。。
但。。。这个规则是啥时加入的呢?
ceph自已加入的???
看来,以后不能混锅炖了?
====================
iptables -L
Chain FORWARD (policy DROP) target prot opt source destination DOCKER-ISOLATION all -- anywhere anywhere ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED DOCKER all -- anywhere anywhere ACCEPT all -- anywhere anywhere ACCEPT all -- anywhere anywhere ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED DOCKER all -- anywhere anywhere ACCEPT all -- anywhere anywhere DROP all -- anywhere anywhere
运行命令:
iptables -P FORWARD ACCEPT
搞定。本来正常时的设置。
Chain FORWARD (policy ACCEPT) target prot opt source destination DOCKER-ISOLATION all -- anywhere anywhere ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED DOCKER all -- anywhere anywhere ACCEPT all -- anywhere anywhere ACCEPT all -- anywhere anywhere