Help Center/ Cloud Container Engine/ User Guide/ Clusters/ Buying a Cluster/ Comparing iptables and IPVS
Updated on 2024-11-11 GMT+08:00
View PDF

Comparing iptables and IPVS

kube-proxy is a key component of a Kubernetes cluster. It is used for load balancing and forwarding data between a Service and its backend pods.

CCE supports the iptables and IP Virtual Server (IPVS) forwarding modes.

Feature Difference

iptables

IPVS

Positioning

A mature, stable kube-proxy mode, but its performance is average. It applies to scenarios where the number of Services is small (less than 3000) or there are a large number of short concurrent connections on the client. For details, see iptables.

A high-performance kube-proxy mode. It applies to scenarios where the cluster scale is large or the number of Services is large. For details, see IPVS.

Throughput

Relatively low

Relatively high

Complexity

O(n). n increases with the number of Services and backend pods in the cluster.

O(1). In most cases, the connection processing efficiency is irrelevant to the cluster scale.

Load balancing algorithm

iptables has only one algorithm for random selection.

IPVS involves multiple load balancing algorithms, such as round-robin, shortest expected delay, least connections, and various hashing methods.

ClusterIP connectivity

The internal IP address in the cluster cannot be pinged.

The internal IP address in the cluster can be pinged.

NOTE:

The IP address in clusters of v1.27 or later cannot be pinged due to security hardening.

Additional restrictions

When there are more than 3000 Services in a cluster, network delay may occur.
  • If an ingress and a Service use the same load balancer, the ingress cannot be accessed from the nodes and containers in the cluster because kube-proxy mounts the LoadBalancer Service address to the ipvs-0 bridge. This bridge intercepts the traffic of the load balancer used by the ingress. Use different load balancers for the ingress and Service.

iptables

iptables is a Linux kernel function for processing and filtering a large number of data packets. It allows flexible sequences of rules to be attached to various hooks in the packet processing pipeline. When iptables is used, kube-proxy implements NAT and load balancing in the NAT pre-routing hook. For each Service, kube-proxy installs an iptables rule which captures the traffic destined for the Service's ClusterIP and ports and redirects the traffic to one of the backend pods. By default, iptables randomly selects a backend pod. For details, see iptables proxy mode.

IPVS

IPVS is constructed on top of Netfilter and balances transport-layer loads as part of the Linux kernel. IPVS can direct requests for TCP- or UDP-based services to the real servers, and make services of the real servers appear as virtual services on a single IP address.

In the IPVS mode, kube-proxy uses IPVS load balancing instead of iptables. IPVS is designed to balance loads for a large number of Services. It has a set of optimized APIs and uses optimized search algorithms instead of simply searching for rules from a list. For details, see IPVS proxy mode.

Parent Topic: Buying a Cluster