Configuring kube-proxy

The Kubernetes network proxy (kube-proxy) runs on each node and is managed by the Cluster Network Operator (CNO). kube-proxy maintains network rules for forwarding connections for endpoints associated with services.

About iptables rules synchronization

The synchronization period determines how frequently the Kubernetes network proxy (kube-proxy) syncs the iptables rules on a node.

A sync begins when either of the following events occurs:

  • An event occurs, such as service or endpoint is added to or removed from the cluster.

  • The time since the last sync exceeds the sync period defined for kube-proxy.

kube-proxy configuration parameters

You can modify the following kubeProxyConfig parameters.

Because of performance improvements introduced in OKD 4.3 and greater, adjusting the iptablesSyncPeriod parameter is no longer necessary.

Table 1. Parameters
ParameterDescriptionValuesDefault

iptablesSyncPeriod

The refresh period for iptables rules.

A time interval, such as 30s or 2m. Valid suffixes include s, m, and h and are described in the Go time package documentation.

30s

proxyArguments.iptables-min-sync-period

The minimum duration before refreshing iptables rules. This parameter ensures that the refresh does not happen too frequently. By default, a refresh starts as soon as a change that affects iptables rules occurs.

A time interval, such as 30s or 2m. Valid suffixes include s, m, and h and are described in the Go time package

0s

Modifying the kube-proxy configuration

You can modify the Kubernetes network proxy configuration for your cluster.

Prerequisites

  • Install the OpenShift CLI (oc).

  • Log in to a running cluster with the cluster-admin role.

Procedure

  1. Edit the Network.operator.openshift.io custom resource (CR) by running the following command:

    1. $ oc edit network.operator.openshift.io cluster

  2. Modify the kubeProxyConfig parameter in the CR with your changes to the kube-proxy configuration, such as in the following example CR:

    1. apiVersion: operator.openshift.io/v1
    2. kind: Network
    3. metadata:
    4.   name: cluster
    5. spec:
    6.   kubeProxyConfig:
    7.     iptablesSyncPeriod: 30s
    8.     proxyArguments:
    9.       iptables-min-sync-period: ["30s"]

  3. Save the file and exit the text editor.

    The syntax is validated by the oc command when you save the file and exit the editor. If your modifications contain a syntax error, the editor opens the file and displays an error message.

  4. Enter the following command to confirm the configuration update:

    1. $ oc get networks.operator.openshift.io -o yaml

    Example output

    1. apiVersion: v1
    2. items:
    3. - apiVersion: operator.openshift.io/v1
    4.   kind: Network
    5.   metadata:
    6.     name: cluster
    7.   spec:
    8.     clusterNetwork:
    9.     - cidr: 10.128.0.0/14
    10.       hostPrefix: 23
    11.     defaultNetwork:
    12.       type: OpenShiftSDN
    13.     kubeProxyConfig:
    14.       iptablesSyncPeriod: 30s
    15.       proxyArguments:
    16.         iptables-min-sync-period:
    17.         - 30s
    18.     serviceNetwork:
    19.     - 172.30.0.0/16
    20.   status: {}
    21. kind: List

  5. Optional: Enter the following command to confirm that the Cluster Network Operator accepted the configuration change:

    1. $ oc get clusteroperator network

    Example output

    1. NAME      VERSION     AVAILABLE   PROGRESSING   DEGRADED   SINCE
    2. network   4.1.0-0.9   True        False         False      1m

    The AVAILABLE field is True when the configuration update is applied successfully.