(“conntrack”) Linux. , , .
Conntrack — , :
- NAT onntrack, . , pod service Kubernetes, kube-proxy NAT pod . Conntrack , IP service pod, , pod’ , NAT- pod .
- Firewall’ , Calico, onntrack, “” . , : « pod’ IP-» . ( « pod IP».)
, conntrack ( ),
, , . « kube-proxy», , .
, conntrack ...
, ?
conntrack , , , . , . , , conntrack:
- , . , conntrack 128k , > 128k , !
- : . , Linux ( 120). , conntrack 128 . 1100 , conntrack, (128k / 120 = 1092 / ).
, . , , conntrack « » (DOS). conntrack . conntrack — - conntrack ( , ). conntrack .
: SaaS memcached- ( ), 50+ .
conntrack, , , , ( !), conntrack ( ).
Calico. Calico conntrack ( doNotTrack). , Calico.
, conntrack?
- do-not-track, , . SaaS-: , memcached.
- do-not-track . , memcached- memcached-, . , memcached, .
- do-not-track , , . CPU , . conntrack. , SaaS , , CPU .
pod' memcached- pod' memcached-, , . pod' memcached- 8 512k conntrack ( ).
: ; Calico ; Calico do-not-track .
4.000 , CPU. , do-not-track CPU 20% :
, , memcached-. , “ ” “ ” conntrack 4,000 (512k / 120s = 4,369 /). do-not-track 60,000 - . , , , , , !
Conntrack — . . . , , - conntrack , . Calico , conntrack . conntrack !
: