Change:
A new flag indicating how kube-proxy gets the number of CPUs, either from goruntime or . In kube-proxy, we can use to set node's , the resulting is . We have nodes where pods with none CPU policy and static CPU policy are running together. Pods like kube-proxy are running in none CPU policy by default, and they only gets CPUs left by static CPU policy pods. If static CPU policy pods take away most CPUs cores, kube-proxy can only get one or two cores, then will be set to a very small values. In this case, a lot packet failure can occur. When we set kube-proxy to work in static CPU policy, kube-proxy only gets the number of CPUs selected by the CPU policy, not the number of total CPUs on the node. This may surprise users who are only trying to limit kube-proxy's CPU usages, but resulting in some conntrack fulls faults. Please let me know if this enhancement is reasonable, so I can send a pr later. Thanks!
/sig network
Is it refer to deploy order of kube-proxy? If kube-proxy deploy first in node, will it get just one or two core?
By one or two I mean kube-proxy gets a small number of CPU cores, because most of CPU cores are allocated to static policy pods, sorry for the misunderstanding. The number of conntrack-max depends on the CPU cores when kube-proxy started, even kube-proxy was first deployed, it can get restarted or redeployed by some reasons. Then the conntrack-max will change.
yeah, when kube-proxy deploy firstly, Maybe it can see the whole cpu nums from shared cpu(/var/lib/kubelet/cpumanagestate when kubelet start with static cpu policy). But I think it is a bug for kube-proxy. The cpu info can also get from node resource info. So will it be suitable to add a flag to set cpu num?
Maybe, or we can add a flag for user to choose where kube-proxy should get CPU informations from. There maybe some multi-tenant scenarios where kube-proxy are deployed for per tenant so they would like to limit conntrack-max by CPU cores allocated to each tenant.
I think the simple fix is to replace with something that counts /proc/cpuinfo. I don't know of anyone running multiple proxies, and I don't think it would work well. The intention was "all the CPUs on the node". PRs welcome!
/triage accepted

Discussion:
"io/ioutil" "net/http" "os" <del> goruntime "runtime" </del> "strings" "time"

if config.Min != nil { floor = int(*config.Min) } <del> scaled := int(*config.MaxPerCore) * goruntime.NumCPU() </del> <ins> scaled := int(*config.MaxPerCore) * detectNumCPU() </ins> if scaled > floor { klog.V(3).Infof("getConntrackMax: using scaled conntrack-max-per-core") return scaled, nil

"errors" "fmt" "net" <ins> goruntime "runtime" </ins> "strings" "time" <ins> "github.com/google/cadvisor/machine" "github.com/google/cadvisor/utils/sysfs" </ins> "k8s.io/apimachinery/pkg/watch" "k8s.io/apimachinery/pkg/runtime"

return nodeIP } <ins> func detectNumCPU() int { // try get numCPU from /sys firstly due to a known issue (https://github.com/kubernetes/kubernetes/issues/99225) _, numCPU, err := machine.GetTopology(sysfs.NewRealSysFs()) if err != nil || numCPU < 1 { return goruntime.NumCPU() } return numCPU } </ins> func getDetectLocalMode(config *proxyconfigapi.KubeProxyConfiguration) (proxyconfigapi.LocalMode, error) { mode := config.DetectLocalMode switch mode {

"errors" "fmt" "net" <ins> goruntime "runtime" </ins> // Enable pprof HTTP handlers. _ "net/http/pprof"

return proxyModeUserspace } <ins> func detectNumCPU() int { return goruntime.NumCPU() } </ins> func tryWinKernelSpaceProxy(kcompat winkernel.KernelCompatTester) string { // Check for Windows Kernel Version if we can support Kernel Space proxy // Check for Windows Version