K8s 网络深入：Service / NodePort / Ingress 流量端到端

# 1. 起点: 节点上 OUTPUT 链 nat 表
$ iptables -t nat -L OUTPUT -n -v | head
Chain OUTPUT (policy ACCEPT 1234 packets)
 pkts bytes target           prot opt in     out     source       destination
 1234  56789 KUBE-SERVICES   all  --  *      *       0.0.0.0/0    0.0.0.0/0   /* kubernetes service portals */

# 2. 进 KUBE-SERVICES 链
$ iptables -t nat -L KUBE-SERVICES -n -v | grep 10.96.1.5
  100  6000 KUBE-SVC-XYZ123  tcp  --  *  *  0.0.0.0/0  10.96.1.5  /* default/my-svc */ tcp dpt:8080

# 3. 进 KUBE-SVC-XYZ123 链
$ iptables -t nat -L KUBE-SVC-XYZ123 -n -v
 pkts bytes target          prot opt ...
   30  1800 KUBE-MARK-MASQ   all  --  ... !10.244.0.0/16  10.96.1.5  /* default/my-svc */
                                       ^^^^^^^^^^^^^^^^^
                                       源不是 pod CIDR 的(外部) 打 MASQ 标记
   33  1980 KUBE-SEP-AAA     all  --  ...  /* probability 0.5 */ statistic mode random probability 0.5
   33  1980 KUBE-SEP-BBB     all  --  ...  /* */                                    ← 没 probability 兜底

# 4. 进 KUBE-SEP-AAA 链 (具体 endpoint)
$ iptables -t nat -L KUBE-SEP-AAA -n -v
 pkts bytes target  prot opt ...
   30  1800 KUBE-MARK-MASQ  all  --  ... 10.244.1.6                                  ← 源是自己 (hairpin) 打 MASQ
   33  1980 DNAT             tcp  --  ...                                            ← 实际 DNAT
                                      to:10.244.1.6:8080

$ kubectl get cm -n kube-system kube-proxy -o jsonpath='{.data.config\.conf}' | grep mode
mode: ""              # 默认 iptables
# 或
mode: ipvs            # IPVS

$ ipvsadm -L -n
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
  -> RemoteAddress:Port           Forward Weight ActiveConn InActConn
TCP  10.96.1.5:8080 rr
  -> 10.244.0.5:8080              Masq    1      10         0
  -> 10.244.1.6:8080              Masq    1      8          1
  -> 10.244.2.7:8080              Masq    1      12         0

$ kubectl edit cm -n kube-system kube-proxy
# data.config.conf:
#   mode: "ipvs"

$ kubectl rollout restart ds -n kube-system kube-proxy

$ dig my-headless.default.svc.cluster.local +short
10.244.0.5
10.244.1.6
10.244.2.7

# 老的 Endpoints (单一对象)
$ kubectl get endpoints my-svc
NAME      ENDPOINTS                                       AGE
my-svc    10.244.0.5:8080,10.244.1.6:8080,10.244.2.7:8080  1h

# 新的 EndpointSlice (多个对象 / 大集群高效)
$ kubectl get endpointslice -l kubernetes.io/service-name=my-svc
NAME             ADDRESSTYPE   PORTS   ENDPOINTS                                AGE
my-svc-abc123    IPv4          8080    10.244.0.5,10.244.1.6,10.244.2.7         1h

$ kubectl get endpoints my-svc
NAME      ENDPOINTS   AGE
my-svc    <none>      1h

# 看 pod 的真实 label
$ kubectl get pod -l app=foo --show-labels

# 看 pod ready 状态
$ kubectl get pod -o wide

# 看 readinessProbe 失败原因
$ kubectl describe pod ⟨pod⟩

$ hubble observe --verdict DROPPED --pod default/backend
... Policy denied (L3-L4) from default/random-pod to default/backend

$ kubectl get ingress
NAME         CLASS   HOSTS                          ADDRESS       PORTS     AGE
my-ingress   nginx   a.example.com,b.example.com    1.2.3.4       80, 443   1d

$ kubectl describe ingress my-ingress
# 看 events / endpoints

# 看 ingress-nginx pod 实际配置（生成的 nginx.conf）
$ kubectl exec -n ingress-nginx ingress-nginx-xxx -- cat /etc/nginx/nginx.conf | head -100

$ kubectl exec test-pod -- curl http://my-svc:8080
# Connection timed out

# 第 1 步：endpoint 在吗？
$ kubectl get endpoints my-svc
NAME      ENDPOINTS   AGE
my-svc    <none>      1h        ← 空！

# 第 2 步：selector 和 pod label 对吗？
$ kubectl get svc my-svc -o jsonpath='{.spec.selector}'
{"app":"my-app"}

$ kubectl get pod -l app=my-app
No resources found.              ← pod label 错

$ kubectl get pod --show-labels | grep my-app
my-pod    1/1     Running   ...   application=my-app    ← 应该叫 app

$ kubectl get endpoints my-svc
NAME      ENDPOINTS               AGE
my-svc    10.244.0.5:8080         5m

$ kubectl exec test-pod -- nc -zv 10.244.0.5 8080
# Connection refused

# pod 内 ss 看监听
$ kubectl exec my-pod -- ss -lntp
LISTEN 0 128 127.0.0.1:8080    process=app    ← 只监听 127.0.0.1！

$ kubectl exec test-pod -- curl http://my-svc:8080
# Sometimes 200 OK, sometimes timeout

$ kubectl get endpoints my-svc
NAME      ENDPOINTS                                       AGE
my-svc    10.244.0.5:8080,10.244.1.6:8080,10.244.2.7:8080  1h

$ for ep in 10.244.0.5 10.244.1.6 10.244.2.7; do
    echo "=== $ep ==="
    kubectl exec test-pod -- curl -m 3 http://$ep:8080
  done

# 看哪个失败

# 外部访问 NodePort
$ curl http://⟨node-ip⟩:30080      # 通

# 集群内访问 ClusterIP
$ kubectl exec test-pod -- curl http://my-svc:8080   # 不通

$ iptables -t nat -L KUBE-SERVICES -n -v | grep ⟨cluster-ip⟩
# pkts = 0?           ← 流量没到 KUBE-SERVICES

$ kubectl exec pod-in-ns-a -- curl http://svc-in-ns-b
# Could not resolve host

$ kubectl exec pod-in-ns-a -- curl http://svc-in-ns-b.ns-b.svc.cluster.local
# 通

# 1. Service 状态
kubectl get svc ⟨name⟩

# 2. Endpoint 列表
kubectl get endpoints ⟨name⟩
kubectl get endpointslice -l kubernetes.io/service-name=⟨name⟩

# 3. pod ready 状态
kubectl get pod -l <selector> -o wide

# 4. 应用监听
kubectl exec ⟨pod⟩ -- ss -lntp

# 5. iptables 规则
iptables -t nat -L KUBE-SERVICES -n -v | grep ⟨cluster-ip⟩

# 6. DNS 解析
kubectl exec ⟨pod⟩ -- dig ⟨svc-name⟩.⟨ns⟩.svc.cluster.local

# 7. NetworkPolicy 检查
kubectl get netpol -A