{"action":"created","issue":{"url":"https://api.github.com/repos/BenTheElder/kubernetes/issues/4","labels_url":"https://api.github.com/repos/BenTheElder/kubernetes/issues/4/labels{/name}","comments_url":"https://api.github.com/repos/BenTheElder/kubernetes/issues/4/comments","events_url":"https://api.github.com/repos/BenTheElder/kubernetes/issues/4/events","html_url":"https://github.com/BenTheElder/kubernetes/issues/4","id":95312851,"number":4,"title":"iptables rules churning","user":{"login":"Symmetric","id":1524910,"avatar_url":"https://avatars.githubusercontent.com/u/1524910?v=3","gravatar_id":"","url":"https://api.github.com/users/Symmetric","html_url":"https://github.com/Symmetric","followers_url":"https://api.github.com/users/Symmetric/followers","following_url":"https://api.github.com/users/Symmetric/following{/other_user}","gists_url":"https://api.github.com/users/Symmetric/gists{/gist_id}","starred_url":"https://api.github.com/users/Symmetric/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Symmetric/subscriptions","organizations_url":"https://api.github.com/users/Symmetric/orgs","repos_url":"https://api.github.com/users/Symmetric/repos","events_url":"https://api.github.com/users/Symmetric/events{/privacy}","received_events_url":"https://api.github.com/users/Symmetric/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-07-15T23:40:38Z","updated_at":"2015-07-16T20:35:49Z","closed_at":null,"body":"On commit cd781e4a84b0e5aa2237ec39d780ef71ec7d7308 (from the tip of iptables_proxy), if you run \r\n\r\n`watch -n 1 -d \"sudo iptables -t nat -L -vn\"`\r\n\r\nWait 10-100s and you will see a bunch of churn in the iptables rules that are programmed, even when there are no changes to the services.\r\n\r\ni) this is going to impose an additional CPU and i/o load on the system\r\nii) this blats the statistics for the iptables rules, which makes debugging harder\r\n\r\nIt would be desirable to have a deterministic ordering/naming of the rules, so that we don't delete and re-add the iptables rules when there is no change to the set of rules needed."},"comment":{"url":"https://api.github.com/repos/BenTheElder/kubernetes/issues/comments/122082921","html_url":"https://github.com/BenTheElder/kubernetes/issues/4#issuecomment-122082921","issue_url":"https://api.github.com/repos/BenTheElder/kubernetes/issues/4","id":122082921,"user":{"login":"MikaelCluseau","id":3868856,"avatar_url":"https://avatars.githubusercontent.com/u/3868856?v=3","gravatar_id":"","url":"https://api.github.com/users/MikaelCluseau","html_url":"https://github.com/MikaelCluseau","followers_url":"https://api.github.com/users/MikaelCluseau/followers","following_url":"https://api.github.com/users/MikaelCluseau/following{/other_user}","gists_url":"https://api.github.com/users/MikaelCluseau/gists{/gist_id}","starred_url":"https://api.github.com/users/MikaelCluseau/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MikaelCluseau/subscriptions","organizations_url":"https://api.github.com/users/MikaelCluseau/orgs","repos_url":"https://api.github.com/users/MikaelCluseau/repos","events_url":"https://api.github.com/users/MikaelCluseau/events{/privacy}","received_events_url":"https://api.github.com/users/MikaelCluseau/received_events","type":"User","site_admin":false},"created_at":"2015-07-16T20:35:49Z","updated_at":"2015-07-16T20:35:49Z","body":"FWIW, I'm in favor of hashes (of course with a good hashing algorithm). The collision probability follows the same rules as UUID: there is a probability, but you will neither hit it in practice. For instance, if we still prefix rules by \"KUBE-SERVICE-\" (length=13), we have 15 chars remaining. With hexadecimal notation, it's 1/16**15 = 1/2**60 (1/1.15e18); if we use \"number+letters\", it's 1/2.11e23; if we differenciate up/low case, it's 1/7.69e26."}}