Chapter 3. Troubleshooting

Procedure

1. View the iptable rules for the NodePort service by running the following command:

   $ iptables-save | grep NODEPORT

   Copy to Clipboard Toggle word wrap

   Example output

   -A OUTPUT -j OVN-KUBE-NODEPORT
   -A OVN-KUBE-NODEPORT -p tcp -m addrtype --dst-type LOCAL -m tcp --dport 30326 -j DNAT --to-destination 10.43.95.170:80

   Copy to Clipboard Toggle word wrap

   OVN-Kubernetes configures the OVN-KUBE-NODEPORT iptable chain in the NAT table to match the destination port and Destination Network Address Translates (DNATs) the packet to the clusterIP service. The packet is then routed to the OVN network through the gateway bridge br-ex via routing rules on the host.

2. Route the packet through the network with routing rules by running the following command:

   $ ip route

   Copy to Clipboard Toggle word wrap

   Example output

   10.43.0.0/16 via 192.168.122.1 dev br-ex mtu 1400

   Copy to Clipboard Toggle word wrap

   This routing rule matches the Kubernetes service IP address range and forwards the packet to the gateway bridge br-ex. You must enable ip_forward on the host. After the packet is forwarded to the OVS bridge br-ex, it is handled by OpenFlow rules in OVS which steers the packet to the OVN network and eventually to the pod.