Wienczny's questions

I'm trying to set up a LVS load balancer in front of my Kubernetes: Calico is used as container network, so every pod has its own network interface in it's host. External IPs, routes and routing rules are manager using keepalived. Every subnet assigned by my hosting provider has its own router. The servers have two physical interfaces connected to the Internet. The external IPs are available on the second interface.

The configuration is this: The first interface has a global IP address and a default Route. The second interface has a private IP. It also has all additional IPs by my hosting provider. Because all packets from the additional IPs must be routed through a special default gateway I've added routing tables and rules.

Up to this point everything is working as expected. To make Kubernetes services available in the IPs I've added a LVS on some nodes.

My problem is this: Packets from the internet arrive at my Kubernetes pods but their answers don't get back to the internet. The packets disappear somewhere in my Kubernetes node. The answer packets from my pods are using the pod IP as source and have to be rewritten by NAT.

When looking at the iptables rules I don't see the ones for LVS. Where are they? When are LVS NAT rules executed? Are they bound to an interface? Is the forwarding path and interface decided before NAT for the answer packets are done?

I've got a Kubernetes installation on CoreOS with DNS addon running in a pod.

My problem is this: kube2sky cannot access the api-server. By default it uses 127.0.0.1:8080 which is not available to docker containers. Because the api-server is listening to localhost I switched the kube_master_url to the server version. This endpoint requires authentication.

This is the log from the kube2sky pod:

I1119 02:01:48.603839       1 kube2sky.go:389] Etcd server found: http://127.0.0.1:4001
I1119 02:01:49.604512       1 kube2sky.go:455] Using https://10.3.0.1:443 for kubernetes master
I1119 02:01:49.604524       1 kube2sky.go:456] Using kubernetes API v1
E1119 02:01:49.616085       1 reflector.go:136] Failed to list *api.Service: Get https://10.3.0.1:443/api/v1/services: x509: failed to load system roots and no roots provided
E1119 02:01:49.616142       1 reflector.go:136] Failed to list *api.Endpoints: Get https://10.3.0.1:443/api/v1/endpoints: x509: failed to load system roots and no roots provided

How do I get the authentication credentials into the pod so that kube2sky uses it?

This is the pod deklaration:

apiVersion: v1
kind: ReplicationController
metadata:
  name: kube-dns-v9
  namespace: kube-system
labels:
  k8s-app: kube-dns
  version: v9
  kubernetes.io/cluster-service: "true"
spec:
  replicas: 1
  selector:
    k8s-app: kube-dns
    version: v9
  template:
    metadata:
      labels:
        k8s-app: kube-dns
        version: v9
        kubernetes.io/cluster-service: "true"
    spec:
      containers:
      - name: etcd
        image: gcr.io/google_containers/etcd:2.0.9
        resources:
          limits:
            cpu: 100m
            memory: 50Mi
        command:
        - /usr/local/bin/etcd
        - -data-dir
        - /var/etcd/data
        - -listen-client-urls
        - http://127.0.0.1:2379,http://127.0.0.1:4001
        - -advertise-client-urls
        - http://127.0.0.1:2379,http://127.0.0.1:4001
        - -initial-cluster-token
        - skydns-etcd
        volumeMounts:
        - name: etcd-storage
          mountPath: /var/etcd/data
          - name: kube2sky
        image: gcr.io/google_containers/kube2sky:1.11
        resources:
          limits:
            cpu: 100m
            memory: 50Mi
        args:
        # command = "/kube2sky"
        - -domain=cluster.local
        - -kube_master_url=https://10.3.0.1:443
      - name: skydns
        image: gcr.io/google_containers/skydns:2015-10-13-8c72f8c
        resources:
          limits:
            cpu: 100m
            memory: 50Mi
        args:
        # command = "/skydns"
        - -machines=http://127.0.0.1:4001
        - -addr=0.0.0.0:53
        - -ns-rotate=false
        - -domain=cluster.local.
        ports:
        - containerPort: 53
          name: dns
          protocol: UDP
        - containerPort: 53
          name: dns-tcp
          protocol: TCP
        livenessProbe:
          httpGet:
            path: /healthz
            port: 8080
            scheme: HTTP
          initialDelaySeconds: 30
          timeoutSeconds: 5
        readinessProbe:
          httpGet:
            path: /healthz
            port: 8080
            scheme: HTTP
          initialDelaySeconds: 1
          timeoutSeconds: 5
      - name: healthz
        image: gcr.io/google_containers/exechealthz:1.0
        resources:
          limits:
            cpu: 10m
            memory: 20Mi
        args:
        - -cmd=nslookup kubernetes.default.svc.cluster.local 127.0.0.1 >/dev/null
        - -port=8080
        ports:
        - containerPort: 8080
          protocol: TCP
      volumes:
      - name: etcd-storage
        emptyDir: {}
      dnsPolicy: Default  # Don't use cluster DNS.

There are two directories I'd like to compare. I tried diff but it includes the changes inside the files. All I want is something like this

file a is just in /A 
file b is missing in /A 
file c changed
directory d is missing in /A 
directory e is just in /A

I think this is common when doing full file patching but I don't know a good solution.