问题

在node上和pod中无法ping通cluster ip

节点之前的网络是kube-proxy管理的，检查kube-proxy 的配置

vim /lib/systemd/system/kube-proxy.service

[Unit]
Description=Kubernetes Proxy
After=network.target

[Service]
WorkingDirectory=/var/lib/kube-proxy
ExecStart=/usr/local/bin/kube-proxy \
  --bind-address=192.168.205.10 \
  --v=4 \
  --kubeconfig=/etc/kubernetes/kube-proxy.kubeconfig
Restart=on-failure

[Install]
WantedBy=multi-user.target

导致这个问题的配置项是 --proxy-mode

 --proxy-mode ProxyMode                         Which proxy mode to use: 'userspace' (older) or 'iptables' (faster) or 'ipvs' (experimental). If blank, use the best-available proxy (currently iptables).  If the iptables proxy is selected, regardless of how, but the system's kernel or iptables versions are insufficient, this always falls back to the userspace proxy.

解决方法

修改配置如下：

[Unit]
Description=Kubernetes Proxy
After=network.target

[Service]
WorkingDirectory=/var/lib/kube-proxy
ExecStart=/usr/local/bin/kube-proxy \
  --bind-address=192.168.205.10 \
  --v=4 \
  --proxy-mode=ipvs \
  --kubeconfig=/etc/kubernetes/kube-proxy.kubeconfig
Restart=on-failure

[Install]
WantedBy=multi-user.target

将 --proxy-mode指定成 ipvs模式。

详细问题原因还不明，反正这样改了后，重启kube-proxy后就可以ping同cluster ip了。