How to Break your Kubernetes Cluster with Networking
summary
Kubernetes networking failures are concrete and repeatable: non‑FQDN lookups plus IPv4/IPv6 and a five‑entry search path generate 10 DNS lookups per curl, which easily triggers cloud rate limits (AWS example given: 1000 pps per ENI) and intermittent failures; iptables kube-proxy latency rises with thousands of services; service loopback drops due to kernel source-IP checks unless a CNI rewrites addresses; an ExternalIP Service can hijack external traffic; CRD churn (50 KB × 5,000 nodes × updates every 10 min) creates a 16 Gbps CRD storm that stalls control plane.
AI-written summary · about
chapters (11)
- 0:00Start
- 2:13Components Involved in Kubernetes Networking
- 2:31Kubernetes Networking the Dark Side
- 3:58101 on Kubernetes Networking
- 4:49Load Balancing
- 9:54Dns Rate Limiting
- 12:53Network Policy Editor
- 14:41Service Loopback
- 20:55Cni Configuration Wars
- 24:17Asymmetric Cleanup
- 26:00Visibility Matters
related talks
35mKubernetes, Lessons Learnt
06mLightning Talk: Is Your Kubernetes Cluster's DNS Working?
32mUnderstand and Troubleshoot the “Magic” of Kubernetes Networking - Minhan Xia & Rohit Ramkumar
31mNetworking Failure Stories: How to Maintain, Break, and Fix Cluster Connectivity
32mThe Easy--Don't Drive Yourself Crazy--Way to Kubernetes Networking
34mIt's Not Always the Network (But Here's How to Prove It): Kubernetes Packet...
38mLogs Told Us It Was DNS, It Looked like DNS, It Had to Be DNS, It Wasn't DNS
37m10 Ways to Shoot Yourself in the Foot with Kubernetes, #9 Will Surprise You