iptables 通常就是指linux上的防火墙,主要分为netfilter和iptables两个组件。netfilter为内核空间的组件，iptables为用户空间的组件，提供添加，删除查询防火墙规则的功能。

kubernetes的service通过iptables来做后端pod的转发和路由，下面来跟踪具体的规则。

service

有如下的映射关系

clusterip:port	podip:port
10.96.125.27:8080	10.254.20.8:8080

[root@master-192 st]# kubectl describe svc heketi
Name:                     heketi
Namespace:                default
Labels:                   app=heketi
Annotations:              <none>
Selector:                 app=heketi
Type:                     NodePort
IP:                       10.96.125.27
Port:                     <unset>  8080/TCP
TargetPort:               8080/TCP
NodePort:                 <unset>  31131/TCP
Endpoints:                10.254.20.8:8080
Session Affinity:         None
External Traffic Policy:  Cluster
Events:                   <none>

---

[root@master-192 st]# kubectl get pod -o wide
NAME                      READY   STATUS    RESTARTS   AGE   IP            NODE
heketi-5bb88f8854-7hpgx   1/1     Running   0          1d    10.254.20.8   master-192

iptables

先看DNAT

[nat]->[PREROUTING]->[KUBE-SERVICES]

[root@master-192 st]# iptables -t nat -nvL
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
   61  8106 cali-PREROUTING  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:6gwbT8clXdHdC1b1 */
   63  8226 KUBE-SERVICES  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* kubernetes service portals */

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 16 packets, 960 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 1858  112K cali-OUTPUT  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:tVnHkvAo15HuiPy0 */
 1888  113K KUBE-SERVICES  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* kubernetes service portals */

[KUBE-SERVICES]->[KUBE-SVC-7RUAH544RSSBQYKK]

Chain KUBE-SERVICES (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 KUBE-MARK-MASQ  udp  --  *      *      !10.254.0.0/16        10.96.0.10           /* kube-system/kube-dns:dns cluster IP */ udp dpt:53
    0     0 KUBE-SVC-TCOU7JCQXEZGVUNU  udp  --  *      *       0.0.0.0/0            10.96.0.10           /* kube-system/kube-dns:dns cluster IP */ udp dpt:53
    0     0 KUBE-MARK-MASQ  tcp  --  *      *      !10.254.0.0/16        10.96.0.10           /* kube-system/kube-dns:dns-tcp cluster IP */ tcp dpt:53
    0     0 KUBE-SVC-ERIFXISQEP7F7OF4  tcp  --  *      *       0.0.0.0/0            10.96.0.10           /* kube-system/kube-dns:dns-tcp cluster IP */ tcp dpt:53
    0     0 KUBE-MARK-MASQ  tcp  --  *      *      !10.254.0.0/16        10.96.125.27         /* default/heketi: cluster IP */ tcp dpt:8080
    0     0 KUBE-SVC-7RUAH544RSSBQYKK  tcp  --  *      *       0.0.0.0/0            10.96.125.27         /* default/heketi: cluster IP */ tcp dpt:8080
    0     0 KUBE-MARK-MASQ  tcp  --  *      *      !10.254.0.0/16        10.96.0.1            /* default/kubernetes:https cluster IP */ tcp dpt:443
    0     0 KUBE-SVC-NPX46M4PTMTKRN6Y  tcp  --  *      *       0.0.0.0/0            10.96.0.1            /* default/kubernetes:https cluster IP */ tcp dpt:443
    0     0 KUBE-MARK-MASQ  tcp  --  *      *      !10.254.0.0/16        10.96.232.136        /* kube-system/calico-etcd: cluster IP */ tcp dpt:6666
    0     0 KUBE-SVC-NTYB37XIWATNM25Y  tcp  --  *      *       0.0.0.0/0            10.96.232.136        /* kube-system/calico-etcd: cluster IP */ tcp dpt:6666
   17  1020 KUBE-NODEPORTS  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* kubernetes service nodeports; NOTE: this must be the last rule in this chain */ ADDRTYPE match dst-type LOCAL

[KUBE-SVC-7RUAH544RSSBQYKK]->[KUBE-SEP-IWORYNCAYHBSQHXU

Chain KUBE-SVC-7RUAH544RSSBQYKK (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 KUBE-SEP-IWORYNCAYHBSQHXU  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* default/heketi: */

[KUBE-SEP-IWORYNCAYHBSQHXU]->[DNAT ]

Chain KUBE-SEP-IWORYNCAYHBSQHXU (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 KUBE-MARK-MASQ  all  --  *      *       10.254.20.8          0.0.0.0/0            /* default/heketi: */
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* default/heketi: */ tcp to:10.254.20.8:8080

再看SNAT

[POSTROUTING ]->[KUBE-POSTROUTING]

Chain POSTROUTING (policy ACCEPT 31 packets, 1860 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 2011  121K cali-POSTROUTING  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* cali:O3lYWMrLQYEMJtB5 */
 2055  123K KUBE-POSTROUTING  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* kubernetes postrouting rules */

[KUBE-POSTROUTING ]->[MASQUERADE]

Chain KUBE-POSTROUTING (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 MASQUERADE  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* kubernetes service traffic requiring SNAT */ mark match 0x4000/0x4000