<p>I am using k8s 1.2 on ubuntu 14.04.4.</p>
<p>Here is some info on my one k8s minion node:</p>
<pre><code># cat /etc/os-release
NAME=&quot;Ubuntu&quot;
VERSION=&quot;14.04.4 LTS, Trusty Tahr&quot;
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME=&quot;Ubuntu 14.04.4 LTS&quot;
VERSION_ID=&quot;14.04&quot;
HOME_URL=&quot;http://www.ubuntu.com/&quot;
SUPPORT_URL=&quot;http://help.ubuntu.com/&quot;
BUG_REPORT_URL=&quot;http://bugs.launchpad.net/ubuntu/&quot;

# uname -a
Linux k8s-010 3.19.0-47-generic #53~14.04.1-Ubuntu SMP Mon Jan 18 16:09:14 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
</code></pre>
<p>You see, I upgraded the linux kernel to 3.19.0-47.</p>
<p>here are kube-proxy log on this node:</p>
<pre><code># cat /var/log/upstart/kube-proxy.log.1
I0429 17:55:11.397842     985 server.go:200] Using iptables Proxier.
I0429 17:55:11.397941     985 server.go:213] Tearing down userspace rules.
I0429 17:55:12.408962     985 conntrack.go:36] Setting nf_conntrack_max to 262144
I0429 17:55:12.409050     985 conntrack.go:41] Setting conntrack hashsize to 65536
I0429 17:55:12.409288     985 conntrack.go:46] Setting nf_conntrack_tcp_timeout_established to 86400
</code></pre>
<p>I have some cluster-ips on my k8s:</p>
<pre><code>$ kubectl --namespace=enlighten get svc
NAME      CLUSTER-IP        EXTERNAL-IP   PORT(S)     AGE
mongo     192.168.15.118    &lt;none&gt;        27017/TCP   1d
mysql     192.168.4.191     &lt;none&gt;        3306/TCP    23h
redis     192.168.193.134   &lt;none&gt;        6379/TCP    1d
</code></pre>
<p>I found my pod in this cluster can access this CLusterIP.
But If I tried to access this clusterIP from the node host directly, It failed.</p>
<p>I used iptables-save to dump the rules. Since there are a lot of rules, I filter the relevance in:</p>
<pre><code># iptables-save |grep -e mysql -e 192.168.4.191 -e &quot;-A KUBE-MARK-MASQ&quot; -e KUBE-SEP-HLHD6IM4G76NUUUM
:KUBE-SEP-HLHD6IM4G76NUUUM - [0:0]
-A KUBE-MARK-MASQ -j MARK --set-xmark 0x4000/0x4000
-A KUBE-SEP-HLHD6IM4G76NUUUM -s 172.17.45.2/32 -m comment --comment &quot;enlighten/mysql:&quot; -j KUBE-MARK-MASQ
-A KUBE-SEP-HLHD6IM4G76NUUUM -p tcp -m comment --comment &quot;enlighten/mysql:&quot; -m tcp -j DNAT --to-destination 172.17.45.2:3306
-A KUBE-SERVICES -d 192.168.4.191/32 -p tcp -m comment --comment &quot;enlighten/mysql: cluster IP&quot; -m tcp --dport 3306 -j KUBE-SVC-FIZ3LEJD226YKZ4B
-A KUBE-SVC-FIZ3LEJD226YKZ4B -m comment --comment &quot;enlighten/mysql:&quot; -j KUBE-SEP-HLHD6IM4G76NUUUM
</code></pre>
<p>Is it WAD or an issue?</p>

wangyumi
<p>The short answer is <strong>yes</strong>. <code>kube-proxy</code> generates IPtables rules for each service so that it can be accessed from both hosts and pods.</p>

<p>When in doubt, execute <code>iptables -t nat -n -v</code> <strong>on a host where kube-proxy is running</strong> and search for the IP of the service. You can post the output here as a comment if you need help.</p>
