From 391b55ceafd911efc189e13d9f0c375a3954570b Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Mon, 23 Apr 2018 14:24:44 +0100 Subject: [PATCH 1/2] Add note about ip forward setting --- site/kubernetes/kube-addon.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/site/kubernetes/kube-addon.md b/site/kubernetes/kube-addon.md index fdf37967..2442e8c9 100644 --- a/site/kubernetes/kube-addon.md +++ b/site/kubernetes/kube-addon.md @@ -303,6 +303,10 @@ UDP connection from 10.32.0.7:56648 to 10.32.0.11:80 blocked by Weave NPC. pods can talk. - If you do set the `--cluster-cidr` option on kube-proxy, make sure it matches the `IPALLOC_RANGE` given to Weave Net (see below) +- IP forwarding must be enabled on each node, in order for pods to + access Kubernetes services or other IP addresses on another + network. Check this with `sysctl net.ipv4.ip_forward`; the result + should be `1`. ## Changing Configuration Options From 22ecf505e3862d2f2fc885c00be14ae234abaf82 Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Wed, 2 May 2018 06:06:58 +0100 Subject: [PATCH 2/2] Added note about security implications of enabling IP forwarding --- site/kubernetes/kube-addon.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/site/kubernetes/kube-addon.md b/site/kubernetes/kube-addon.md index 2442e8c9..e6319400 100644 --- a/site/kubernetes/kube-addon.md +++ b/site/kubernetes/kube-addon.md @@ -306,7 +306,8 @@ UDP connection from 10.32.0.7:56648 to 10.32.0.11:80 blocked by Weave NPC. - IP forwarding must be enabled on each node, in order for pods to access Kubernetes services or other IP addresses on another network. Check this with `sysctl net.ipv4.ip_forward`; the result - should be `1`. + should be `1`. (Be aware that there can be security implications of + enabling IP forwarding) ## Changing Configuration Options