1

Below is the output from ip route command in one of the worker nodes of Kubernetes cluster (aws based):

$ip route
default via 10.6.16.1 dev eth0 
10.6.16.0/21 dev eth0 proto kernel scope link src 10.6.22.111 
111.97.95.0/26 via 10.6.145.224 dev tunl0 proto bird onlink 
111.98.108.64/26 via 10.6.144.128 dev tunl0 proto bird onlink 
111.98.163.0/26 via 10.6.147.100 dev tunl0 proto bird onlink 
111.101.172.128/26 via 10.6.86.141 dev tunl0 proto bird onlink 
111.103.57.192/26 via 10.6.17.44 dev eth0 proto bird 
111.103.80.128/26 via 10.6.85.178 dev tunl0 proto bird onlink 
111.105.231.0/26 via 10.6.23.120 dev eth0 proto bird 
111.115.208.128/26 via 10.6.80.11 dev tunl0 proto bird onlink 
blackhole 111.126.117.128/26 proto bird 
111.126.117.129 dev cali8934275ty scope link 
111.126.117.132 dev cali983hfsdf4 scope link 
111.126.117.140 dev cali443gfby45 scope link

I am quite new to Kubernetes and would like to understand a couple of things related to this output and Calico networking in general:

  1. what kind of ip address is 10.6.16.1 if eth0 has IP of 10.6.22.111/21 - is it Internet Gateway ?
  2. Another worker node has two pods with the same IP=10.6.145.224 (pods calico-node-74hde и kube-proxy-internal) - how this is working/possible?
  3. Why do we need blackhole route?
Arghya Sadhu
  • 41,002
  • 9
  • 78
  • 107
Viji
  • 412
  • 4
  • 15

1 Answers1

3

what kind of ip address is 10.6.16.1 if eth0 has IP of 10.6.22.111/21 - is it Internet Gateway ?

Yes, you are correct, this is indeed default(internet) gateway. So for example on your local computer default route would hold an IP of your home router.

Another worker node has two pods with the same IP=10.6.145.224 (pods calico-node-74hde и kube-proxy-internal) - how this is working/possible?

This is possible beacause they have set hostNetwork: true. Check it yourself running e.g.:

kubectl get po -n kube-system calico-node-74hde

and look for hostNetwork field. If this field is set to true, the pod (more specificaly containers within the pod) will not be network isolated and will have access to the host network interface, and this is why these pod have host IP.

Why do we need blackhole route?

I belive this calico issue may give us some answers.

I will try to explaint it. Imagine situation when there are 2 pod running and sending data over the network to each other.

When one of these pods gets deleted, the other pod may not recognise it and keep sending data to the IP address that does not exist (and because there is no pod, there is also no interface with the address).

So what shoud the node do if receives a packet with destination address that no longer exists?

Normally it would forward the packet according to the route rules. Now that there is no route rule associated with the pod (that just got deleted), the packet will get send according to the best match rule. If the blackhole rule exists, the packet will be dropped, but if there is no blackhole, packet will get forwarded (according to the best match rule) through the default gateway and you don't usually want this.

Let me know if it answers your questions.

Matt
  • 7,419
  • 1
  • 11
  • 22