(тАЬconntrackтАЭ) Linux. , , .
Conntrack тАФ , :
- NAT onntrack, . , pod service Kubernetes, kube-proxy NAT pod . Conntrack , IP service pod, , podтАЩ , NAT- pod .
- FirewallтАЩ , Calico, onntrack, тАЬтАЭ . , : ┬л podтАЩ IP-┬╗ . ( ┬л pod IP┬╗.)
, conntrack ( ),
, , . ┬л kube-proxy┬╗, , .
, conntrack ...
, ?
conntrack , , , . , . , , conntrack:
- , . , conntrack 128k , > 128k , !
- : . , Linux ( 120). , conntrack 128 . 1100 , conntrack, (128k / 120 = 1092 / ).
, . , , conntrack ┬л ┬╗ (DOS). conntrack . conntrack тАФ - conntrack ( , ). conntrack .
: SaaS memcached- ( ), 50+ .
conntrack, , , , ( !), conntrack ( ).
Calico. Calico conntrack ( doNotTrack). , Calico.
, conntrack?
- do-not-track, , . SaaS-: , memcached.
- do-not-track . , memcached- memcached-, . , memcached, .
- do-not-track , , . CPU , . conntrack. , SaaS , , CPU .
pod' memcached- pod' memcached-, , . pod' memcached- 8 512k conntrack ( ).
: ; Calico ; Calico do-not-track .
4.000 , CPU. , do-not-track CPU 20% :
, , memcached-. , тАЬ тАЭ тАЬ тАЭ conntrack 4,000 (512k / 120s = 4,369 /). do-not-track 60,000 - . , , , , , !
Conntrack тАФ . . . , , - conntrack , . Calico , conntrack . conntrack !
: