Skip to content

Commit 6a0fe41

Browse files
committed
Clean up reconfigure-default-service-ip-ranges.md
1 parent ebcfab6 commit 6a0fe41

File tree

1 file changed

+78
-80
lines changed

1 file changed

+78
-80
lines changed

content/en/docs/tasks/network/reconfigure-default-service-ip-ranges.md

Lines changed: 78 additions & 80 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ reviewers:
33
- thockin
44
- dwinship
55
min-kubernetes-server-version: v1.33
6-
title: Kubernetes Default Service CIDR Reconfiguration
6+
title: Kubernetes Default ServiceCIDR Reconfiguration
77
content_type: task
88
---
99

@@ -21,106 +21,104 @@ to a cluster.
2121

2222
<!-- steps -->
2323

24-
## Kubernetes Default Service CIDR Reconfiguration
24+
## Kubernetes Default ServiceCIDR Reconfiguration
2525

2626
This document explains how to manage the Service IP address range within a
2727
Kubernetes cluster, which also influences the cluster's supported IP families
2828
for Services.
2929

3030
The IP families available for Service ClusterIPs are determined by the
31-
`--service-cluster-ip-range` flag to kube-apiserver. For a better understanding of Service IP address allocation, refer to the
32-
[Services IP address allocation tracking](http://kubernetes.io/docs/reference/networking/virtual-ips/#ip-address-objects) documentation.
31+
`--service-cluster-ip-range` flag to kube-apiserver. For a better
32+
understanding of Service IP address allocation, refer to the
33+
[Services IP address allocation tracking](/docs/reference/networking/virtual-ips/#ip-address-objects) documentation.
3334

3435
Since Kubernetes 1.33, the Service IP families configured for the cluster are
35-
reflected by the `ServiceCIDR` object named `kubernetes`. The `kubernetes` `ServiceCIDR`
36+
reflected by the ServiceCIDR object named `kubernetes`. The `kubernetes` ServiceCIDR
3637
object is created by the first kube-apiserver instance that starts, based on its
37-
configured `--service-cluster-ip-range` flag. To ensure consistent cluster behavior, all kube-apiserver instances must be configured with the same `--service-cluster-ip-range` values, which must match the default kubernetes ServiceCIDR object.
38-
39-
### Kubernetes Service CIDR Reconfiguration Categories
40-
41-
We can categorize Service CIDR reconfiguration into the following scenarios:
42-
43-
* **Extending the existing Service CIDRs:** This can be done dynamically by
44-
adding new ServiceCIDR objects without the need of reconfiguration of the
45-
kube-apiserver. Please refer to the dedicated documentation on
46-
[Extending Service IP
47-
Ranges](http://kubernetes.io/docs/tasks/network/extend-service-ip-ranges/).
48-
49-
* **Single-to-dual-stack conversion preserving the primary service CIDR:** This
50-
involves introducing a secondary IP family (IPv6 to an IPv4-only cluster, or
51-
IPv4 to an IPv6-only cluster) while keeping the original IP family as
52-
primary. This requires an update to the kube-apiserver configuration and a
53-
corresponding modification of various cluster components that need to handle
54-
this additional IP family. These components include, but are not limited to,
55-
kube-proxy, the CNI or network plugin, service mesh implementations, and DNS
56-
services.
57-
58-
* **Dual-to-single conversion preserving the primary service CIDR:** This
59-
involves removing the secondary IP family from a dual-stack cluster,
60-
reverting to a single IP family while retaining the original primary IP
61-
family. In addition to the reconfiguration of the components to match the
62-
new IP family, you might need to address Services that were explicitly
63-
configured to use the removed IP family.
64-
65-
* **Anything that results in changing the primary service CIDR:** Completely
38+
configured `--service-cluster-ip-range` flag. To ensure consistent cluster behavior,
39+
all kube-apiserver instances must be configured with the same `--service-cluster-ip-range` values,
40+
which must match the default `kubernetes` ServiceCIDR object.
41+
42+
### Kubernetes ServiceCIDR Reconfiguration Categories
43+
44+
ServiceCIDR reconfiguration typically falls into one of the following categories:
45+
46+
* **Extending the existing ServiceCIDRs:** This can be done dynamically by
47+
adding new ServiceCIDR objects without the need for reconfiguring the
48+
kube-apiserver. Please refer to the dedicated documentation on
49+
[Extending Service IP Ranges](/docs/tasks/network/extend-service-ip-ranges/).
50+
51+
* **Single-to-dual-stack conversion preserving the primary ServiceCIDR:** This
52+
involves introducing a secondary IP family (IPv6 to an IPv4-only cluster, or
53+
IPv4 to an IPv6-only cluster) while keeping the original IP family as
54+
primary. This requires an update to the kube-apiserver configuration and a
55+
corresponding modification of various cluster components that need to handle
56+
this additional IP family. These components include, but are not limited to,
57+
kube-proxy, the CNI or network plugin, service mesh implementations, and DNS
58+
services.
59+
60+
* **Dual-to-single conversion preserving the primary ServiceCIDR:** This
61+
involves removing the secondary IP family from a dual-stack cluster,
62+
reverting to a single IP family while retaining the original primary IP
63+
family. In addition to reconfiguring the components to match the
64+
new IP family, you might need to address Services that were explicitly
65+
configured to use the removed IP family.
66+
67+
* **Anything that results in changing the primary ServiceCIDR:** Completely
6668
replacing the default ServiceCIDR is a complex operation. If the new
67-
ServiceCIDR does not overlap with the existing one, [it will require
68-
renumbering all existing Services and changing the `kubernetes.default`
69-
service](#illustrative-reconfiguration-steps). The case where the primary IP
70-
family also changes is even more complicated, and may require to change
71-
multiple cluster components (kubelet, network plugins, etc.) to match the new
72-
primary IP family.
69+
ServiceCIDR does not overlap with the existing one, it will require
70+
[renumbering all existing Services and changing the `kubernetes.default` Service](#illustrative-reconfiguration-steps).
71+
The case where the primary IP family also changes is even more complicated,
72+
and may require changing multiple cluster components (kubelet, network plugins, etc.)
73+
to match the new primary IP family.
7374

74-
### Manual Operations for Replacing the Default Service CIDR
75+
### Manual Operations for Replacing the Default ServiceCIDR
7576

76-
Reconfiguring the default Service CIDR necessitates manual steps performed by
77+
Reconfiguring the default ServiceCIDR necessitates manual steps performed by
7778
the cluster operator, administrator, or the software managing the cluster
7879
lifecycle. These typically include:
7980

80-
1. **Updating** the kube-apiserver configuration: Modify the
81-
`--service-cluster-ip-range` flag with the new IP range(s).
82-
2. **Reconfiguring** the network components: This is a critical step and the
83-
specific procedure depends on the different networking components in use. It
84-
might involve updating configuration files, restarting agent pods, or
85-
updating the components to manage the new Service CIDR(s) and the desired IP
86-
family configuration for Pods. Typical components can be the implementation
87-
of Kubernetes Services, such as kube-proxy, and the configured networking
88-
plugin, and potentially other networking components like service mesh
89-
controllers and DNS servers, to ensure they can correctly handle traffic and
90-
perform service discovery with the new IP family configuration.
91-
3. **Managing existing Services:** Services with IPs from the old CIDR need to
92-
be addressed if they are not within the new configured ranges. Options
93-
include recreation (leading to downtime and new IP assignments) or
94-
potentially more complex reconfiguration strategies.
95-
4. **Recreating internal Kubernetes services:** The `kubernetes.default`
96-
service must be deleted and recreated to obtain an IP address from the new
97-
Service CIDR if the primary IP family is changed or replaced by a different
98-
network.
81+
1. **Updating** the kube-apiserver configuration: Modify the
82+
`--service-cluster-ip-range` flag with the new IP range(s).
83+
1. **Reconfiguring** the network components: This is a critical step and the
84+
specific procedure depends on the different networking components in use. It
85+
might involve updating configuration files, restarting agent pods, or
86+
updating the components to manage the new ServiceCIDR(s) and the desired IP
87+
family configuration for Pods. Typical components can be the implementation
88+
of Kubernetes Services, such as kube-proxy, and the configured networking
89+
plugin, and potentially other networking components like service mesh
90+
controllers and DNS servers, to ensure they can correctly handle traffic and
91+
perform service discovery with the new IP family configuration.
92+
1. **Managing existing Services:** Services with IPs from the old CIDR need to
93+
be addressed if they are not within the new configured ranges. Options
94+
include recreation (leading to downtime and new IP assignments) or
95+
potentially more complex reconfiguration strategies.
96+
1. **Recreating internal Kubernetes services:** The `kubernetes.default`
97+
Service must be deleted and recreated to obtain an IP address from the new
98+
ServiceCIDR if the primary IP family is changed or replaced by a different
99+
network.
99100

100101
### Illustrative Reconfiguration Steps
101102

102103
The following steps describe a controlled reconfiguration focusing on the
103-
completely replacement of the default Service CIDR and the recreation of the
104+
complete replacement of the default ServiceCIDR and the recreation of the
104105
`kubernetes.default` Service:
105106

106-
1. Start the kube-apiserver with the initial `--service-cluster-ip-range`.
107-
2. Create initial Services that obtain IPs from this range.
108-
3. Introduce a new Service CIDR as a temporary target for reconfiguration.
109-
4. Mark the `kubernetes` default Service CIDR for deletion (it will remain
110-
pending due to existing IPs and finalizers). This prevents new allocations
111-
from the old range.
112-
5. Recreate existing Services. They should now be allocated IPs from the new,
113-
temporary Service CIDR.
114-
6. Restart the kube-apiserver with the new Service CIDR(s) configured and shut
115-
down the old instance.
116-
7. Delete the `kubernetes.default` service. The new kube-apiserver will
117-
recreate it within the new Service CIDR.
107+
1. Start the kube-apiserver with the initial `--service-cluster-ip-range`.
108+
1. Create initial Services that obtain IPs from this range.
109+
1. Introduce a new ServiceCIDR as a temporary target for reconfiguration.
110+
1. Mark the `kubernetes` default ServiceCIDR for deletion (it will remain
111+
pending due to existing IPs and finalizers). This prevents new allocations
112+
from the old range.
113+
1. Recreate existing Services. They should now be allocated IPs from the new,
114+
temporary ServiceCIDR.
115+
1. Restart the kube-apiserver with the new ServiceCIDR(s) configured and shut
116+
down the old instance.
117+
1. Delete the `kubernetes.default` Service. The new kube-apiserver will
118+
recreate it within the new ServiceCIDR.
118119

119120
## {{% heading "whatsnext" %}}
120121

121-
* **Kubernetes Networking Concepts:**
122-
[http://kubernetes.io/docs/concepts/cluster-administration/networking/](http://kubernetes.io/docs/concepts/cluster-administration/networking/)
123-
* **Kubernetes Dual-Stack Services:**
124-
[http://kubernetes.io/docs/concepts/services-networking/dual-stack/](http://kubernetes.io/docs/concepts/services-networking/dual-stack/)
125-
* **Extending Kubernetes Service IP Ranges:**
126-
[http://kubernetes.io/docs/tasks/network/extend-service-ip-ranges/](http://kubernetes.io/docs/tasks/network/extend-service-ip-ranges/)
122+
* [Kubernetes Networking Concepts](/docs/concepts/cluster-administration/networking/)
123+
* [Kubernetes Dual-Stack Services](/docs/concepts/services-networking/dual-stack/)
124+
* [Extending Kubernetes Service IP Ranges](/docs/tasks/network/extend-service-ip-ranges/)

0 commit comments

Comments
 (0)