{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/13913","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/13913/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/13913/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/13913/events","html_url":"https://github.com/kubernetes/kubernetes/issues/13913","id":106304208,"number":13913,"title":"service using Nodeport really slow ","user":{"login":"nancykyo","id":1332885,"avatar_url":"https://avatars.githubusercontent.com/u/1332885?v=3","gravatar_id":"","url":"https://api.github.com/users/nancykyo","html_url":"https://github.com/nancykyo","followers_url":"https://api.github.com/users/nancykyo/followers","following_url":"https://api.github.com/users/nancykyo/following{/other_user}","gists_url":"https://api.github.com/users/nancykyo/gists{/gist_id}","starred_url":"https://api.github.com/users/nancykyo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nancykyo/subscriptions","organizations_url":"https://api.github.com/users/nancykyo/orgs","repos_url":"https://api.github.com/users/nancykyo/repos","events_url":"https://api.github.com/users/nancykyo/events{/privacy}","received_events_url":"https://api.github.com/users/nancykyo/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/area/performance","name":"area/performance","color":"d4c5f9"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/team/cluster","name":"team/cluster","color":"d2b48c"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":21,"created_at":"2015-09-14T09:28:39Z","updated_at":"2015-09-17T05:43:56Z","closed_at":null,"body":"the service definition\r\n```\r\n$kubectl get -o yaml service/packetix-112\r\napiVersion: v1\r\nkind: Service\r\nmetadata:\r\n  creationTimestamp: 2015-09-09T10:07:34Z\r\n  labels:\r\n    name: packetix-112\r\n  name: packetix-112\r\n  namespace: default\r\n  resourceVersion: \"3925035\"\r\n  selfLink: /api/v1/namespaces/default/services/packetix-112\r\n  uid: 970a03ec-56da-11e5-9633-fa163e6d9c98\r\nspec:\r\n  clusterIP: 172.18.48.118\r\n  ports:\r\n  - nodePort: 30503\r\n    port: 8001\r\n    protocol: TCP\r\n    targetPort: 8001\r\n  selector:\r\n    name: packetix-112\r\n  sessionAffinity: None\r\n  type: NodePort\r\nstatus:\r\n  loadBalancer: {}\r\n```\r\niptables rule from one of the nodes\r\n```\r\niptables-save|grep 30503\r\n-A KUBE-NODEPORT-CONTAINER -p tcp -m comment --comment \"default/packetix-112:\" -m tcp --dport 30503 -j REDIRECT --to-ports 43913\r\n-A KUBE-NODEPORT-HOST -p tcp -m comment --comment \"default/packetix-112:\" -m tcp --dport 30503 -j DNAT --to-destination 192.168.59.150:43913\r\n```\r\niptables one the node where the container really runs.\r\n```\r\n# iptables-save |grep packetix-112\r\n-A KUBE-NODEPORT-CONTAINER -p tcp -m comment --comment \"default/packetix-112:\" -m tcp --dport 30503 -j REDIRECT --to-ports 53976\r\n-A KUBE-NODEPORT-HOST -p tcp -m comment --comment \"default/packetix-112:\" -m tcp --dport 30503 -j DNAT --to-destination 192.168.59.151:53976\r\n-A KUBE-PORTALS-CONTAINER -d 172.18.48.118/32 -p tcp -m comment --comment \"default/packetix-112:\" -m tcp --dport 8001 -j REDIRECT --to-ports 53976\r\n-A KUBE-PORTALS-HOST -d 172.18.48.118/32 -p tcp -m comment --comment \"default/packetix-112:\" -m tcp --dport 8001 -j DNAT --to-destination 192.168.59.151:53976\r\n```\r\nusing 192.168.59.151:53976 is fast.\r\nhere is the time of execution from outside of the cluster.\r\n```\r\nfor i in {1..30}; do time curl -x 192.168.59.151:30503 ip.cn; done\r\n\r\nreal  0m0.264s\r\n\r\nreal  0m51.782s\r\n\r\nreal  0m1.004s\r\n\r\nreal  1m0.425s\r\n```\r\nhere is the time of execution from outside of the container.\r\n```\r\nroot@packetix-112-p53dd q]# for i in {1..30}; do time curl -x 0.0.0.0:8001 ip.cn; done\r\nreal  0m0.249s\r\n\r\nreal  0m0.963s\r\n\r\nreal  0m1.268s\r\n```"},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/140974977","html_url":"https://github.com/kubernetes/kubernetes/issues/13913#issuecomment-140974977","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/13913","id":140974977,"user":{"login":"thockin","id":5595220,"avatar_url":"https://avatars.githubusercontent.com/u/5595220?v=3","gravatar_id":"","url":"https://api.github.com/users/thockin","html_url":"https://github.com/thockin","followers_url":"https://api.github.com/users/thockin/followers","following_url":"https://api.github.com/users/thockin/following{/other_user}","gists_url":"https://api.github.com/users/thockin/gists{/gist_id}","starred_url":"https://api.github.com/users/thockin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thockin/subscriptions","organizations_url":"https://api.github.com/users/thockin/orgs","repos_url":"https://api.github.com/users/thockin/repos","events_url":"https://api.github.com/users/thockin/events{/privacy}","received_events_url":"https://api.github.com/users/thockin/received_events","type":"User","site_admin":false},"created_at":"2015-09-17T05:43:56Z","updated_at":"2015-09-17T05:43:56Z","body":"The iptables proxy relies on a bunch of kernel features that are relatively\nnew (not that new but newer than CentOS 6 :) so we just attached to the\niptables version.  I forget if that also guarded some of the iptables flags\nwe used.\n\nWhat distro and kernel are you on that has iptables 1.4.7?  If you say\nCentOS 6 I'm going to tell you that you get to stay on the userspace\nproxier.  That iptables version was release LITERALLY 5 years ago.  The\nversion we need is 4.5 years old.\n\nOn Tue, Sep 15, 2015 at 8:41 AM, Harry Zhang <notifications@github.com>\nwrote:\n\n> @jayunit100 <https://github.com/jayunit100> Actually, the existing\n> version check only determines whether we can set -C and -w, so it's not\n> clear how new the iptables should be to support\n> -legacy-userspace-proxy=false. Hopes @thockin <https://github.com/thockin>\n> can lead out ...\n>\n> —\n> Reply to this email directly or view it on GitHub\n> <https://github.com/kubernetes/kubernetes/issues/13913#issuecomment-140436019>\n> .\n>\n"}}