参数配置

apiVersion: kubeproxy.config.k8s.io/v1alpha1
kind: KubeProxyConfiguration
bindAddress: 0.0.0.0
bindAddressHardFail: false
clientConnection:
  acceptContentTypes: ""
  burst: 10
  contentType: application/vnd.kubernetes.protobuf
  kubeconfig: "/var/lib/kube-proxy/kubeconfig.conf"
  qps: 5
clusterCIDR: 192.168.201.0/24
configSyncPeriod: 15m0s
conntrack:
  maxPerCore: 32768
  min: 131072
  tcpCloseWaitTimeout: 1h0m0s
  tcpEstablishedTimeout: 24h0m0s
detectLocalMode: ""
enableProfiling: false
healthzBindAddress: 127.0.0.1:10256
hostnameOverride: ""
iptables:
  masqueradeAll: false
  masqueradeBit: 14
  minSyncPeriod: 1s
  syncPeriod: 30s
ipvs:
  excludeCIDRs: null
  minSyncPeriod: 0s
  scheduler: rr
  strictARP: false
  syncPeriod: 30s
  tcpFinTimeout: 0s
  tcpTimeout: 0s
  udpTimeout: 0s
metricsBindAddress: 127.0.0.1:10249
mode: "ipvs"
nodePortAddresses:
- 192.168.201.0/24
oomScoreAdj: -999
portRange: ""
showHiddenMetricsForVersion: ""
udpIdleTimeout: 250ms
winkernel:
  enableDSR: false
  networkName: ""
  sourceVip: ""

// KubeProxyConfiguration contains everything necessary to configure the
// Kubernetes proxy server.
type KubeProxyConfiguration struct {
    metav1.TypeMeta

    // featureGates is a map of feature names to bools that enable or disable alpha/experimental features.
    FeatureGates map[string]bool

    // bindAddress is the IP address for the proxy server to serve on (set to 0.0.0.0
    // for all interfaces)
    BindAddress string
    // healthzBindAddress is the IP address and port for the health check server to serve on,
    // defaulting to 0.0.0.0:10256
    HealthzBindAddress string
    // metricsBindAddress is the IP address and port for the metrics server to serve on,
    // defaulting to 127.0.0.1:10249 (set to 0.0.0.0 for all interfaces)
    MetricsBindAddress string
    // BindAddressHardFail, if true, kube-proxy will treat failure to bind to a port as fatal and exit
    BindAddressHardFail bool
    // enableProfiling enables profiling via web interface on /debug/pprof handler.
    // Profiling handlers will be handled by metrics server.
    EnableProfiling bool
    // clusterCIDR is the CIDR range of the pods in the cluster. It is used to
    // bridge traffic coming from outside of the cluster. If not provided,
    // no off-cluster bridging will be performed.
    ClusterCIDR string
    // hostnameOverride, if non-empty, will be used as the identity instead of the actual hostname.
    HostnameOverride string
    // clientConnection specifies the kubeconfig file and client connection settings for the proxy
    // server to use when communicating with the apiserver.
    ClientConnection componentbaseconfig.ClientConnectionConfiguration
    // iptables contains iptables-related configuration options.
    IPTables KubeProxyIPTablesConfiguration
    // ipvs contains ipvs-related configuration options.
    IPVS KubeProxyIPVSConfiguration
    // oomScoreAdj is the oom-score-adj value for kube-proxy process. Values must be within
    // the range [-1000, 1000]
    OOMScoreAdj *int32
    // mode specifies which proxy mode to use.
    Mode ProxyMode
    // portRange is the range of host ports (beginPort-endPort, inclusive) that may be consumed
    // in order to proxy service traffic. If unspecified (0-0) then ports will be randomly chosen.
    PortRange string
    // udpIdleTimeout is how long an idle UDP connection will be kept open (e.g. '250ms', '2s').
    // Must be greater than 0. Only applicable for proxyMode=userspace.
    UDPIdleTimeout metav1.Duration
    // conntrack contains conntrack-related configuration options.
    Conntrack KubeProxyConntrackConfiguration
    // configSyncPeriod is how often configuration from the apiserver is refreshed. Must be greater
    // than 0.
    ConfigSyncPeriod metav1.Duration
    // nodePortAddresses is the --nodeport-addresses value for kube-proxy process. Values must be valid
    // IP blocks. These values are as a parameter to select the interfaces where nodeport works.
    // In case someone would like to expose a service on localhost for local visit and some other interfaces for
    // particular purpose, a list of IP blocks would do that.
    // If set it to "127.0.0.0/8", kube-proxy will only select the loopback interface for NodePort.
    // If set it to a non-zero IP block, kube-proxy will filter that down to just the IPs that applied to the node.
    // An empty string slice is meant to select all network interfaces.
    NodePortAddresses []string
    // winkernel contains winkernel-related configuration options.
    Winkernel KubeProxyWinkernelConfiguration
    // ShowHiddenMetricsForVersion is the version for which you want to show hidden metrics.
    ShowHiddenMetricsForVersion string
    // DetectLocalMode determines mode to use for detecting local traffic, defaults to LocalModeClusterCIDR
    DetectLocalMode LocalMode
}

-A KUBE-SERVICES ! -s 192.168.209.0/24 -m comment --comment "Kubernetes service cluster ip + port for masquerade purpose" -m set --match-set KUBE-CLUSTER-IP dst,dst -j KUBE-MARK-MASQ

cat /proc/sys/net/netfilter/nf_conntrack_max

sysctl -a | grep net.netfilter.nf_conntrack_max