@@ -3,7 +3,7 @@ reviewers:
33- thockin
44- dwinship
55min-kubernetes-server-version : v1.33
6- title : Kubernetes Default Service CIDR Reconfiguration
6+ title : Kubernetes Default ServiceCIDR Reconfiguration
77content_type : task
88---
99
@@ -21,106 +21,104 @@ to a cluster.
2121
2222<!-- steps -->
2323
24- ## Kubernetes Default Service CIDR Reconfiguration
24+ ## Kubernetes Default ServiceCIDR Reconfiguration
2525
2626This document explains how to manage the Service IP address range within a
2727Kubernetes cluster, which also influences the cluster's supported IP families
2828for Services.
2929
3030The IP families available for Service ClusterIPs are determined by the
31- ` --service-cluster-ip-range ` flag to kube-apiserver. For a better understanding of Service IP address allocation, refer to the
32- [ Services IP address allocation tracking] ( http://kubernetes.io/docs/reference/networking/virtual-ips/#ip-address-objects ) documentation.
31+ ` --service-cluster-ip-range ` flag to kube-apiserver. For a better
32+ understanding of Service IP address allocation, refer to the
33+ [ Services IP address allocation tracking] ( /docs/reference/networking/virtual-ips/#ip-address-objects ) documentation.
3334
3435Since Kubernetes 1.33, the Service IP families configured for the cluster are
35- reflected by the ` ServiceCIDR ` object named ` kubernetes ` . The ` kubernetes ` ` ServiceCIDR `
36+ reflected by the ServiceCIDR object named ` kubernetes ` . The ` kubernetes ` ServiceCIDR
3637object is created by the first kube-apiserver instance that starts, based on its
37- configured ` --service-cluster-ip-range ` flag. To ensure consistent cluster behavior, all kube-apiserver instances must be configured with the same ` --service-cluster-ip-range ` values, which must match the default kubernetes ServiceCIDR object.
38-
39- ### Kubernetes Service CIDR Reconfiguration Categories
40-
41- We can categorize Service CIDR reconfiguration into the following scenarios:
42-
43- * ** Extending the existing Service CIDRs:** This can be done dynamically by
44- adding new ServiceCIDR objects without the need of reconfiguration of the
45- kube-apiserver. Please refer to the dedicated documentation on
46- [ Extending Service IP
47- Ranges] ( http://kubernetes.io/docs/tasks/network/extend-service-ip-ranges/ ) .
48-
49- * ** Single-to-dual-stack conversion preserving the primary service CIDR:** This
50- involves introducing a secondary IP family (IPv6 to an IPv4-only cluster, or
51- IPv4 to an IPv6-only cluster) while keeping the original IP family as
52- primary. This requires an update to the kube-apiserver configuration and a
53- corresponding modification of various cluster components that need to handle
54- this additional IP family. These components include, but are not limited to,
55- kube-proxy, the CNI or network plugin, service mesh implementations, and DNS
56- services.
57-
58- * ** Dual-to-single conversion preserving the primary service CIDR:** This
59- involves removing the secondary IP family from a dual-stack cluster,
60- reverting to a single IP family while retaining the original primary IP
61- family. In addition to the reconfiguration of the components to match the
62- new IP family, you might need to address Services that were explicitly
63- configured to use the removed IP family.
64-
65- * ** Anything that results in changing the primary service CIDR:** Completely
38+ configured ` --service-cluster-ip-range ` flag. To ensure consistent cluster behavior,
39+ all kube-apiserver instances must be configured with the same ` --service-cluster-ip-range ` values,
40+ which must match the default ` kubernetes ` ServiceCIDR object.
41+
42+ ### Kubernetes ServiceCIDR Reconfiguration Categories
43+
44+ ServiceCIDR reconfiguration typically falls into one of the following categories:
45+
46+ * ** Extending the existing ServiceCIDRs:** This can be done dynamically by
47+ adding new ServiceCIDR objects without the need for reconfiguring the
48+ kube-apiserver. Please refer to the dedicated documentation on
49+ [ Extending Service IP Ranges] ( /docs/tasks/network/extend-service-ip-ranges/ ) .
50+
51+ * ** Single-to-dual-stack conversion preserving the primary ServiceCIDR:** This
52+ involves introducing a secondary IP family (IPv6 to an IPv4-only cluster, or
53+ IPv4 to an IPv6-only cluster) while keeping the original IP family as
54+ primary. This requires an update to the kube-apiserver configuration and a
55+ corresponding modification of various cluster components that need to handle
56+ this additional IP family. These components include, but are not limited to,
57+ kube-proxy, the CNI or network plugin, service mesh implementations, and DNS
58+ services.
59+
60+ * ** Dual-to-single conversion preserving the primary ServiceCIDR:** This
61+ involves removing the secondary IP family from a dual-stack cluster,
62+ reverting to a single IP family while retaining the original primary IP
63+ family. In addition to reconfiguring the components to match the
64+ new IP family, you might need to address Services that were explicitly
65+ configured to use the removed IP family.
66+
67+ * ** Anything that results in changing the primary ServiceCIDR:** Completely
6668 replacing the default ServiceCIDR is a complex operation. If the new
67- ServiceCIDR does not overlap with the existing one, [ it will require
68- renumbering all existing Services and changing the ` kubernetes.default `
69- service] ( #illustrative-reconfiguration-steps ) . The case where the primary IP
70- family also changes is even more complicated, and may require to change
71- multiple cluster components (kubelet, network plugins, etc.) to match the new
72- primary IP family.
69+ ServiceCIDR does not overlap with the existing one, it will require
70+ [ renumbering all existing Services and changing the ` kubernetes.default ` Service] ( #illustrative-reconfiguration-steps ) .
71+ The case where the primary IP family also changes is even more complicated,
72+ and may require changing multiple cluster components (kubelet, network plugins, etc.)
73+ to match the new primary IP family.
7374
74- ### Manual Operations for Replacing the Default Service CIDR
75+ ### Manual Operations for Replacing the Default ServiceCIDR
7576
76- Reconfiguring the default Service CIDR necessitates manual steps performed by
77+ Reconfiguring the default ServiceCIDR necessitates manual steps performed by
7778the cluster operator, administrator, or the software managing the cluster
7879lifecycle. These typically include:
7980
80- 1 . ** Updating** the kube-apiserver configuration: Modify the
81- ` --service-cluster-ip-range ` flag with the new IP range(s).
82- 2 . ** Reconfiguring** the network components: This is a critical step and the
83- specific procedure depends on the different networking components in use. It
84- might involve updating configuration files, restarting agent pods, or
85- updating the components to manage the new Service CIDR (s) and the desired IP
86- family configuration for Pods. Typical components can be the implementation
87- of Kubernetes Services, such as kube-proxy, and the configured networking
88- plugin, and potentially other networking components like service mesh
89- controllers and DNS servers, to ensure they can correctly handle traffic and
90- perform service discovery with the new IP family configuration.
91- 3 . ** Managing existing Services:** Services with IPs from the old CIDR need to
92- be addressed if they are not within the new configured ranges. Options
93- include recreation (leading to downtime and new IP assignments) or
94- potentially more complex reconfiguration strategies.
95- 4 . ** Recreating internal Kubernetes services:** The ` kubernetes.default `
96- service must be deleted and recreated to obtain an IP address from the new
97- Service CIDR if the primary IP family is changed or replaced by a different
98- network.
81+ 1 . ** Updating** the kube-apiserver configuration: Modify the
82+ ` --service-cluster-ip-range ` flag with the new IP range(s).
83+ 1 . ** Reconfiguring** the network components: This is a critical step and the
84+ specific procedure depends on the different networking components in use. It
85+ might involve updating configuration files, restarting agent pods, or
86+ updating the components to manage the new ServiceCIDR (s) and the desired IP
87+ family configuration for Pods. Typical components can be the implementation
88+ of Kubernetes Services, such as kube-proxy, and the configured networking
89+ plugin, and potentially other networking components like service mesh
90+ controllers and DNS servers, to ensure they can correctly handle traffic and
91+ perform service discovery with the new IP family configuration.
92+ 1 . ** Managing existing Services:** Services with IPs from the old CIDR need to
93+ be addressed if they are not within the new configured ranges. Options
94+ include recreation (leading to downtime and new IP assignments) or
95+ potentially more complex reconfiguration strategies.
96+ 1 . ** Recreating internal Kubernetes services:** The ` kubernetes.default `
97+ Service must be deleted and recreated to obtain an IP address from the new
98+ ServiceCIDR if the primary IP family is changed or replaced by a different
99+ network.
99100
100101### Illustrative Reconfiguration Steps
101102
102103The following steps describe a controlled reconfiguration focusing on the
103- completely replacement of the default Service CIDR and the recreation of the
104+ complete replacement of the default ServiceCIDR and the recreation of the
104105` kubernetes.default ` Service:
105106
106- 1 . Start the kube-apiserver with the initial ` --service-cluster-ip-range ` .
107- 2 . Create initial Services that obtain IPs from this range.
108- 3 . Introduce a new Service CIDR as a temporary target for reconfiguration.
109- 4 . Mark the ` kubernetes ` default Service CIDR for deletion (it will remain
110- pending due to existing IPs and finalizers). This prevents new allocations
111- from the old range.
112- 5 . Recreate existing Services. They should now be allocated IPs from the new,
113- temporary Service CIDR .
114- 6 . Restart the kube-apiserver with the new Service CIDR (s) configured and shut
115- down the old instance.
116- 7 . Delete the ` kubernetes.default ` service . The new kube-apiserver will
117- recreate it within the new Service CIDR .
107+ 1 . Start the kube-apiserver with the initial ` --service-cluster-ip-range ` .
108+ 1 . Create initial Services that obtain IPs from this range.
109+ 1 . Introduce a new ServiceCIDR as a temporary target for reconfiguration.
110+ 1 . Mark the ` kubernetes ` default ServiceCIDR for deletion (it will remain
111+ pending due to existing IPs and finalizers). This prevents new allocations
112+ from the old range.
113+ 1 . Recreate existing Services. They should now be allocated IPs from the new,
114+ temporary ServiceCIDR .
115+ 1 . Restart the kube-apiserver with the new ServiceCIDR (s) configured and shut
116+ down the old instance.
117+ 1 . Delete the ` kubernetes.default ` Service . The new kube-apiserver will
118+ recreate it within the new ServiceCIDR .
118119
119120## {{% heading "whatsnext" %}}
120121
121- * ** Kubernetes Networking Concepts:**
122- [ http://kubernetes.io/docs/concepts/cluster-administration/networking/ ] ( http://kubernetes.io/docs/concepts/cluster-administration/networking/ )
123- * ** Kubernetes Dual-Stack Services:**
124- [ http://kubernetes.io/docs/concepts/services-networking/dual-stack/ ] ( http://kubernetes.io/docs/concepts/services-networking/dual-stack/ )
125- * ** Extending Kubernetes Service IP Ranges:**
126- [ http://kubernetes.io/docs/tasks/network/extend-service-ip-ranges/ ] ( http://kubernetes.io/docs/tasks/network/extend-service-ip-ranges/ )
122+ * [ Kubernetes Networking Concepts] ( /docs/concepts/cluster-administration/networking/ )
123+ * [ Kubernetes Dual-Stack Services] ( /docs/concepts/services-networking/dual-stack/ )
124+ * [ Extending Kubernetes Service IP Ranges] ( /docs/tasks/network/extend-service-ip-ranges/ )
0 commit comments