Change:
/kind bug /sig network If I set up a service with a NodePort and set , and try to access it as it works. If I try to access it as , it triggers a martian source error - the packet gets forwarded as 127.0.0.1. We need some masquerade in there. Applies to iptables mode. Maybe ipvs mode, not sure?
If we set for NodePort, we don't do any masq for packets currently. I have tested that masq will resolve the issue in iptables mode, but my question is "do we still need to preserve source ip of packets for nodeport when externalTrafficPolicy=Local"? If we do masq, we will lose the source IP, sadly.
BTW, with the fix of , is reachable The iptables created by is Any comments?
this is not entirely true. key "externalTrafficPolicy=Local" needs to be a solution to the problem of obtaining the real IP of the client, but this is not happening. If we do masq, we will not lose the source IP, because now he doesn't work (version 1.8.1) the problem with the inaccessibility of the actual source IP () in version 1.8.1 is still relevant and is a very big problem for deployment in kubernetes most web services on a production. besides, in my cluster key "externalTrafficPolicy : false" leads to a hollow stop traffic to the pods.
Without masq, nodeport for localhost when set "externalTrafficPolicy=Local" won't work. If service is not reachable, say "how to preserve source IP" won't make sense. Listen, masq is used for someone who want to visit nodeport via localhost when set "externalTrafficPolicy=Local" and don't require preserving source IP. If source IP is really important to you, you can just ignore the .
I do not understand what do you mean "you can just ignore the 127.0.0.1". could you describe in detail how to configure the service to get the real source IP?
type service, externalTrafficPolicy=[Local | Cluster] type service, externalTrafficPolicy=Local, but don't try to access type service, externalTrafficPolicy=Local
i wrote above, NodePort type service with externalTrafficPolicy=Local blocking the transmission of traffic to the pod. I'm trying to connect to node_ip:port. maybe this is a bug? I could demonstrate this.
oh, sorry )) i'm connecting to wrong node )) yes, now traffic is gone. but ip is not source! with "externalTrafficPolicy=Cluster" i getting ip 10.1.29.21 (node ip) with "externalTrafficPolicy=Local" i getting ip 10.4.62.1 (pods network ip - not real source ip)
You probably should check the iptables applied in your host, is there any masq rules created by other processes other than kube-proxy? It preserves the source IP of client - I double checked it. BTW, you can create another thread for discussing your problems. I feel like this issue is orthogonal with your question.
Will setting ClusterIP type service and externalTrafficPolicy=Local for a service to a DaemonSet, route traffic only to the daemonSet pod in that node when i access the service using DaemonSetServiceIP?
no. local service does not work for cluster IP

Discussion:
// Build rules for each service. var svcNameString string for svcName, svcInfo := range proxier.serviceMap { <ins> isIPv6 := utilproxy.IsIPv6(svcInfo.clusterIP) </ins> protocol := strings.ToLower(string(svcInfo.protocol)) svcNameString = svcInfo.serviceNameString

// This is very low impact. The NodePort range is intentionally obscure, and unlikely to actually collide with real Services. // This only affects UDP connections, which are not common. // See issue: https://github.com/kubernetes/kubernetes/issues/49881 <del> isIPv6 := utilproxy.IsIPv6(svcInfo.clusterIP) </del> err := utilproxy.ClearUDPConntrackForPort(proxier.exec, lp.Port, isIPv6) if err != nil { glog.Errorf("Failed to clear udp conntrack for port %d, error: %v", lp.Port, err)

} else { // TODO: Make all nodePorts jump to the firewall chain. // Currently we only create it for loadbalancers (#33586). <ins> // Fix localhost martian source error loopback := "127.0.0.0/8" if isIPv6 { loopback = "::1/128" } writeLine(proxier.natRules, append(args, "-s", loopback, "-j", string(KubeMarkMasqChain))...) </ins> writeLine(proxier.natRules, append(args, "-j", string(svcXlbChain))...) }

errorf(fmt.Sprintf("Failed to find jump to lb chain %v", lbChain), kubeNodePortRules, t) } <ins> if !hasJump(kubeNodePortRules, string(KubeMarkMasqChain), "", svcNodePort) { errorf(fmt.Sprintf("Failed to find jump to %s chain for destination IP %d", KubeMarkMasqChain, svcNodePort), kubeNodePortRules, t) } </ins> svcChain := string(servicePortChainName(svcPortName.String(), proto)) lbRules := ipt.GetRules(lbChain) if hasJump(lbRules, nonLocalEpChain, "", 0) {