{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/31983","repository_url":"https://api.github.com/repos/kubernetes/kubernetes","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/31983/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/31983/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/31983/events","html_url":"https://github.com/kubernetes/kubernetes/issues/31983","id":174796521,"number":31983,"title":"Incoming UDP packets not reach newly deployed services","user":{"login":"dachulin","id":3028406,"avatar_url":"https://avatars.githubusercontent.com/u/3028406?v=3","gravatar_id":"","url":"https://api.github.com/users/dachulin","html_url":"https://github.com/dachulin","followers_url":"https://api.github.com/users/dachulin/followers","following_url":"https://api.github.com/users/dachulin/following{/other_user}","gists_url":"https://api.github.com/users/dachulin/gists{/gist_id}","starred_url":"https://api.github.com/users/dachulin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dachulin/subscriptions","organizations_url":"https://api.github.com/users/dachulin/orgs","repos_url":"https://api.github.com/users/dachulin/repos","events_url":"https://api.github.com/users/dachulin/events{/privacy}","received_events_url":"https://api.github.com/users/dachulin/received_events","type":"User","site_admin":false},"labels":[{"id":128716589,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/component/kube-proxy","name":"component/kube-proxy","color":"0052cc","default":false},{"id":173493827,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/team/cluster","name":"team/cluster","color":"d2b48c","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":10,"created_at":"2016-09-02T16:16:19Z","updated_at":"2016-10-28T15:55:32Z","closed_at":null,"body":"Hi,\r\n\r\nWe have a device (router in this case) that sends long living stream of udp packets to our kubernetes cluster. We then create a service and pods that expose a node port to receive the incoming udp packets. However, packets were not reach our containers.\r\n\r\nFurther digging and found that because UDP packets already stream into our host (therefore conntrack entry already created) BEFORE our service is created (iptable rules added), the iptable rule didn't take effect. Since our UDP stream is long living, the conntrack entry never get timeout neither.\r\n\r\nTo workaround the issue, we have to stop the UDP stream for sometime after the service is created so that the conntrack entry times out. If we use \"conntrack -D\" to clear all entries after service is deployed also workaround the issue. \r\n\r\nThough it is the behavior of the linux iptable that new rules doesn't affect already existing connection, we are trying to see if kubernetes proxy have any config that can clear the related conntrack entries when a new service is deployed?"},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/256958206","html_url":"https://github.com/kubernetes/kubernetes/issues/31983#issuecomment-256958206","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/31983","id":256958206,"user":{"login":"dachulin","id":3028406,"avatar_url":"https://avatars.githubusercontent.com/u/3028406?v=3","gravatar_id":"","url":"https://api.github.com/users/dachulin","html_url":"https://github.com/dachulin","followers_url":"https://api.github.com/users/dachulin/followers","following_url":"https://api.github.com/users/dachulin/following{/other_user}","gists_url":"https://api.github.com/users/dachulin/gists{/gist_id}","starred_url":"https://api.github.com/users/dachulin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dachulin/subscriptions","organizations_url":"https://api.github.com/users/dachulin/orgs","repos_url":"https://api.github.com/users/dachulin/repos","events_url":"https://api.github.com/users/dachulin/events{/privacy}","received_events_url":"https://api.github.com/users/dachulin/received_events","type":"User","site_admin":false},"created_at":"2016-10-28T15:55:32Z","updated_at":"2016-10-28T15:55:32Z","body":"Sorry didn't get back for a while.\r\n\r\nI tried the conntrack tool and seems like you can use --dport option:\r\n\r\nconntrack -D -s 172.27.209.165 -p udp --dport 53\r\nudp      17 63 src=172.27.209.165 dst=171.70.168.183 sport=38061 dport=53 src=171.70.168.183 dst=172.27.209.165 sport=53 dport=38061 [ASSURED] mark=0 use=1\r\nudp      17 33 src=172.27.209.165 dst=171.70.168.183 sport=45906 dport=53 src=171.70.168.183 dst=172.27.209.165 sport=53 dport=45906 [ASSURED] mark=0 use=1\r\nconntrack v1.4.3 (conntrack-tools): 2 flow entries have been deleted.\r\n"}}
{"actor":{"display_login":"dachulin"}}