{"action":"created","issue":{"url":"https://api.github.com/repos/projectcalico/calico-containers/issues/1008","repository_url":"https://api.github.com/repos/projectcalico/calico-containers","labels_url":"https://api.github.com/repos/projectcalico/calico-containers/issues/1008/labels{/name}","comments_url":"https://api.github.com/repos/projectcalico/calico-containers/issues/1008/comments","events_url":"https://api.github.com/repos/projectcalico/calico-containers/issues/1008/events","html_url":"https://github.com/projectcalico/calico-containers/issues/1008","id":158348591,"number":1008,"title":"Service IP responses can bypass kube-proxy","user":{"login":"fasaxc","id":469264,"avatar_url":"https://avatars.githubusercontent.com/u/469264?v=3","gravatar_id":"","url":"https://api.github.com/users/fasaxc","html_url":"https://github.com/fasaxc","followers_url":"https://api.github.com/users/fasaxc/followers","following_url":"https://api.github.com/users/fasaxc/following{/other_user}","gists_url":"https://api.github.com/users/fasaxc/gists{/gist_id}","starred_url":"https://api.github.com/users/fasaxc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fasaxc/subscriptions","organizations_url":"https://api.github.com/users/fasaxc/orgs","repos_url":"https://api.github.com/users/fasaxc/repos","events_url":"https://api.github.com/users/fasaxc/events{/privacy}","received_events_url":"https://api.github.com/users/fasaxc/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/projectcalico/calico-containers/labels/kubernetes","name":"kubernetes","color":"006b75"}],"state":"open","locked":false,"assignee":{"login":"caseydavenport","id":1944093,"avatar_url":"https://avatars.githubusercontent.com/u/1944093?v=3","gravatar_id":"","url":"https://api.github.com/users/caseydavenport","html_url":"https://github.com/caseydavenport","followers_url":"https://api.github.com/users/caseydavenport/followers","following_url":"https://api.github.com/users/caseydavenport/following{/other_user}","gists_url":"https://api.github.com/users/caseydavenport/gists{/gist_id}","starred_url":"https://api.github.com/users/caseydavenport/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/caseydavenport/subscriptions","organizations_url":"https://api.github.com/users/caseydavenport/orgs","repos_url":"https://api.github.com/users/caseydavenport/repos","events_url":"https://api.github.com/users/caseydavenport/events{/privacy}","received_events_url":"https://api.github.com/users/caseydavenport/received_events","type":"User","site_admin":false},"assignees":[{"login":"caseydavenport","id":1944093,"avatar_url":"https://avatars.githubusercontent.com/u/1944093?v=3","gravatar_id":"","url":"https://api.github.com/users/caseydavenport","html_url":"https://github.com/caseydavenport","followers_url":"https://api.github.com/users/caseydavenport/followers","following_url":"https://api.github.com/users/caseydavenport/following{/other_user}","gists_url":"https://api.github.com/users/caseydavenport/gists{/gist_id}","starred_url":"https://api.github.com/users/caseydavenport/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/caseydavenport/subscriptions","organizations_url":"https://api.github.com/users/caseydavenport/orgs","repos_url":"https://api.github.com/users/caseydavenport/repos","events_url":"https://api.github.com/users/caseydavenport/events{/privacy}","received_events_url":"https://api.github.com/users/caseydavenport/received_events","type":"User","site_admin":false}],"milestone":null,"comments":4,"created_at":"2016-06-03T11:39:26Z","updated_at":"2016-06-29T08:52:40Z","closed_at":null,"body":"User reached out on slack, having issues in this scenario:\r\n\r\n- k8s nodes on same LAN segment\r\n- Calico networking\r\n- 2 compute nodes: node1 and node2\r\n- service IP configured for a pod\r\n- pod is running on node2\r\n- try to connect to service IP via node1\r\n\r\nResponse packets come back with source IP being that of the pod rather than the service IP, as expected.  This scenario works with flannel.\r\n\r\nI suspect the issue is that node2 has a return path to the external host that doesn't go via node1, where the NAT flow has been set up."},"comment":{"url":"https://api.github.com/repos/projectcalico/calico-containers/issues/comments/229296568","html_url":"https://github.com/projectcalico/calico-containers/issues/1008#issuecomment-229296568","issue_url":"https://api.github.com/repos/projectcalico/calico-containers/issues/1008","id":229296568,"user":{"login":"fasaxc","id":469264,"avatar_url":"https://avatars.githubusercontent.com/u/469264?v=3","gravatar_id":"","url":"https://api.github.com/users/fasaxc","html_url":"https://github.com/fasaxc","followers_url":"https://api.github.com/users/fasaxc/followers","following_url":"https://api.github.com/users/fasaxc/following{/other_user}","gists_url":"https://api.github.com/users/fasaxc/gists{/gist_id}","starred_url":"https://api.github.com/users/fasaxc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fasaxc/subscriptions","organizations_url":"https://api.github.com/users/fasaxc/orgs","repos_url":"https://api.github.com/users/fasaxc/repos","events_url":"https://api.github.com/users/fasaxc/events{/privacy}","received_events_url":"https://api.github.com/users/fasaxc/received_events","type":"User","site_admin":false},"created_at":"2016-06-29T08:52:40Z","updated_at":"2016-06-29T08:52:40Z","body":"It's a non-obvious consequence of how Calico does networking that you can't access a service VIP from outside the cluster.  I don't think k8s ever intended for service VIPs to be accessible from outside the cluster but, since it works with some other networking options, some people have come to expect it.   \r\n\r\nThree possible options:\r\n\r\n- Document it as an FAQ, along with the right way (which I think is to use a NodePort?).  \r\n- Document a work-around, which would probably mean running a dedicate kube-proxy, also set up to be the router for a cluster (feel s icky)\r\n- \"Fix\" kube-proxy to make this case work."}}
{"actor":{"display_login":"fasaxc"}}