Track when we can enable the ipvs mode for the kube-proxy by default

[luxas]

xref: #816 and #782

cc @kubernetes/sig-network-feature-requests when is ipvs going GA?

[cmluciano]

There are no current releases targeted for GA at this time. We are still assembling the GA criteria and gathering feedback from the community.

[luxas]

Okay, thanks

[timothysc]

Only updating to track for this cycle.

[timothysc]

@kubernetes/sig-network-misc any updates on when ipvs will be the default?

[timothysc]

@caseydavenport any insight?

[bowei]

cc: @Lion-Wei

[caseydavenport]

IPVS kube-proxy went GA in v1.11 - kubernetes/enhancements#265

However, there seem to be a few issues open affecting IPVS mode re: the version of iptables/ipset shipped in the kube-proxy container image that might inhibit its adoption in kubeadm, that we'll need to sort out first.

• due to ipset not supporting "comment", kube-proxy is not working in ipvs mode in Kubernetes 1.11.3 kubernetes#68974
• ipset add entries failed inside kube-proxy-amd64:v1.10.7 kubernetes#68703

CC @m1093782566

[Lion-Wei]

Thanks, @bowei
@caseydavenport , I think both those issue are solved in master, maybe need cherry-pick to 1.11/1.10 to make all version work.
xref:
kubernetes/kubernetes#68974 (comment)
kubernetes/kubernetes#68703 (comment)
I'll trace those issues to make sure they all completely solved.

[m1093782566]

@caseydavenport

These issues you mentioned has already been fixed and we only need to cherry-pick the fixes.

[timothysc]

@caseydavenport @Lion-Wei @m1093782566 - Is there any reason for it to not be the default for all deployments?

[neolit123]

as a side note, our e2e by default does iptables currently.

[Lion-Wei]

Hi, @timothysc , I think there still an issue kubernetes/kubernetes#70747 we should pay attention.

[timothysc]

k, I'm thinking we should make this a default for 1.14 out of the gate move the feature gate.

[timothysc]

https://github.com/kubernetes/kubernetes/issues?utf8=%E2%9C%93&q=is%3Aissue+is%3Aopen+ipvs+label%3Asig%2Fnetwork+

clearly is not ready for defaulting

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[neolit123]

adding some feedback to this old issue.

with Windows nodes in the picture and with the planned changes for multi-OS in the kube-proxy config things are moving in this space.

given the complications i've seen in past reports with IPVS kernel modules missing or disabled on user nodes, i'm inclined to recommend that we do not enable IPVS as the default mode yet.

iptables works and people are familiar with it, IPVS is advanced, faster and feels to me it should be the decisions on the side of cluster operators.

[cmluciano]

@andrewsykim @lbernail Do you think we should close this issue ? I agree with @neolit123 's comments and I'm not sure if this issue makes sense to keep open.

[andrewsykim]

Yeah I agree, not sure that it was ever intended for IPVS to be the default.

[lbernail]

Yeah I think at one point we really wanted to try but we are still lacking tests. I'd say for mid-size clusters iptables is very good because it's very well tested. ipvs makes more sense in large clusters but still does not completely align with what support in iptables mode

[neolit123]

thanks for the comments. let's continue keeping iptables as the default with opt-in for IPVS, maybe one day making IPVS the default if kube-proxy has it as the default.