Caleb Woodbine BobyMCbobs

kube-proxy nftables and iptables vs a Service with 100k endpoints

Background

Iptables performance is limited mainly by two reasons:

Latency on the first packet of a connection caused by the linear search rule matching
Latency on the programming latency caused by the need to save and restore all the lines to the kernel in each transaction

The kernel community moved to nftables as replacement of iptables, with the goal of removing the existing performance bottlenecks. Kubernetes has decided to implement a new nftables proxy because of this and another reasons explained in more detail in the corresponding KEP and during the Kubernetes Contributor Summit in Chicago 2023 on the session [Iptables, end of

Setting up a Multi-Arch, Multi OS cluster

I wanted to build a home lab to get some experience with how Kubernetes works in a multi-architecture, multi-OS environment. Here's the worklog. I'll probably turn it into a blog later :)

Setting up a Multi-Arch, Multi OS cluster
- First node - ODroid HC-1
  - Initial setup of the ODroid
ODroid frequency scaling (optional)

Requirements

socat
kubectl with proper ~/.kube/config that can connect to your cluster
Working knowledge of kubectl client
OpenSSH client

How does it work?

kubectl does port forwarding to sshd port of your pod. I'm using pm2 process managed to keep my services alive in my workstation container. If you have only sshd, easiest to use is dropbear
ProxyCommand of OpenSSH client uses socat to redirect two way fd - to forwarded port of kubectl
Voila! You are in

On master and nodes

Pull images form internet access laptop

docker pull gcr.io/google_containers/kube-apiserver-amd64:v1.5.0
docker pull gcr.io/google_containers/kube-controller-manager-amd64:v1.5.0
docker pull gcr.io/google_containers/kube-proxy-amd64:v1.5.0
docker pull gcr.io/google_containers/kube-scheduler-amd64:v1.5.0
docker pull weaveworks/weave-npc:1.8.2
docker pull weaveworks/weave-kube:1.8.2

Quick GPG Smartcard Guide

We will generate a master key with only the Certify capability and three subkeys with each of the Sign, Encrypt and Authenticate capabilities. These latter three keys are meant for daily use and will be transferred to an OpenPGP smartcard, which has three corresponding slots. The master private key can then be moved to offline cold storage, or stored on a second smartcard.

We are generating keys on a secure computer instead of on the card, because it allows more flexibility. Ideally this means a machine running Tails or one that is air-gapped and not connected to the internet.

This guide assumes that if you want to sign other peoples keys, then you will require the aforementioned secondary smartcard with your master key stored in its Signature slot, or if you only have one smartcard, then you'll have to fetch the master key out of cold storage. By default, GPG generates a master key with the Certify and

	Shader "Unlit/PolyRhythmVisualizer" {
	Properties {
	_TimeCode ("Input Time", Float) = 0
	_OuterRingFreq ("Outer Ring Frequency", Float) = 1
	_InnerRingFreq ("Inner Ring Frequency", Float) = 0.922
	_RingCount ("Ring Count", Int) = 35
	_VibrantFreq ("Vibrant Frequency", Float) = 2
	_Vibrant ("Vibrant", Range(0, 1)) = 0.5
	_Decay ("Decay", Range(0, 10)) = 2
	[Header(Cosine Gradiant)]

	import tweepy, json, time, sys

	auth = tweepy.OAuth1UserHandler(
	<api keys here>
	)

	api = tweepy.API(auth)

	d = json.loads(open(sys.argv[1]).read().split("=", 1)[1])

	# pretty sudo prompt
	read -r -d '' SUDOPROMPT << EOM
	🌺🌳🌸🌷🌷🌸🌻🌷🌷🌸🌸🌸🌸🌷🌼🌷🌳🌺🌼🌺🌸🌻🌼🌼🌳🌳🌼🌺🌻🌷🐛🌷🌼🌻🌳🌸🌷🌷🌻🌸
	🌸🦉🌻🌸🌳🌷🌸🌷🌸🌳🌸🌻🌳🐌🌻🌷🌷🌼🌻🌺🌺🌻🌼🌻🌻🌼🌺🌻🌳🌼🌳🌺🌳🌷🌻🌼🌷🌼🌻🌸
	🌳🌸🌻🌺🌻🌳🌺🌺🌻🌺🌸🌻🌷🌷🌼🌻🌺🌼🌻🌻🌷🌳🌻🌸🌳🌷🌻🌳🌳🌳🌳🌼🌳🌳🌺🌷🌳🌺🌳🌺
	🦉🌸🌻🌺🌺🌳🌸🌸🌼🌻🌺🌼🌷🌸🌳🌼🌺🌸🌺🌷🌻🌷🌺🌺🌳🌷🌷🐰🌸🌻🌳🌸🌼🌷🌼🌳🌷🐹🌼🌺
	🌷🌳🌻🌸🌸🌼🐰🌷🌺🌷🌺🌻🌷🌸🌺🌻🌳🌻🌷🌻🌻🌺🌸🌸🌺🌻🌸🌻🌳🌳🌻🐦🌻🌼🌼🌻🌻🌺🌳🐰
	🌼🐦🌻🌳🌸🌸🌳🌷🌺🌼🌳🌷🌸🌻🌼🌻🐛🌻🌼🌷🌺🌼🌺🌸🌺🦔🌷🌸🌷🌻🌻🌺🌼🌷🐌🌸🌷🌼🌸🐹
	🌸🌳🌻🌼🌻🌳🌸🌷🌺🌷🌷🌼🌻🌷🌻🌺🌼🌼🌳🌸🌻🌻🌸🌼🌼🌸🌳🌺🌻🌻🌳🌺🌷🐰🌻🌼🐹🌷🌷🌳
	🌼🌷🌻🌸🌼🌳🌻🌻🌳🌷🌼🌻🌺🌺🌺🌺🌺🌳🌻🌼🌷🌸🌸🌻🌺🌻🌳🌸🌷🌺🌺🌼🌸🌺🌻🌻🌷🌸🌻🌷

	# make sure You have installed the infinality patches

	export INFINALITY_FT_FILTER_PARAMS="8 17 50 17 8"
	export INFINALITY_FT_GRAYSCALE_FILTER_STRENGTH="0"
	export INFINALITY_FT_FRINGE_FILTER_STRENGTH="55"
	export INFINALITY_FT_AUTOHINT_HORIZONTAL_STEM_DARKEN_STRENGTH="0"
	export INFINALITY_FT_AUTOHINT_VERTICAL_STEM_DARKEN_STRENGTH="0"
	export INFINALITY_FT_WINDOWS_STYLE_SHARPENING_STRENGTH="20"
	export INFINALITY_FT_CHROMEOS_STYLE_SHARPENING_STRENGTH="0"
	export INFINALITY_FT_STEM_ALIGNMENT_STRENGTH="0"

	// file: index.js

	var _ = require("lodash");
	var express = require("express");
	var bodyParser = require("body-parser");
	var jwt = require('jsonwebtoken');

	var passport = require("passport");
	var passportJWT = require("passport-jwt");