How to disable hairpinMode with Kind?

[kevin85421]

I am trying to disable hairpinMode with Kind. However, it does not work.

Reproduce

kind-config.yaml

# kind-config.yaml
kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
nodes:
- role: control-plane
  kubeadmConfigPatches:
  - |
    apiVersion: kubelet.config.k8s.io/v1beta1
    kind: KubeletConfiguration
    hairpinMode: "none"

example.yaml

apiVersion: v1
kind: Service
metadata:
  name: nginx
  labels:
    name: nginx
spec:
  ports:
  - name: http
    port: 80
    protocol: TCP
    targetPort: http
  selector:
    instance: nginx
---
kind: Deployment
apiVersion: apps/v1
metadata:
  name: nginx
spec:
  replicas: 1
  selector:
    matchLabels:
      instance: nginx
  template:
    metadata:
      labels:
        name: nginx
        instance: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:alpine
        ports:
        - containerPort: 80
          name: http

# Step 1: Create a cluster
kind create cluster --image=kindest/node:v1.23.0 --config kind-config.yaml

# Step 2: Log in to the control plane
docker exec -it kind-control-plane bash

# Step 3: Check the configuration
root@kind-control-plane:/# cat /var/lib/kubelet/config.yaml | grep hairpinMode
hairpinMode: none

# Step 4: Create a Nginx deployment and its service
kubectl apply -f example.yaml

# Step 5: The Nginx Pod can access itself via its ClusterIP service.
kubectl exec ${NGINX_POD} -- curl nginx:80 # succeed
kubectl exec ${NGINX_POD} -- curl nginx.default.svc.cluster.local:80 # succeed

In my expectation, both curl commands in Step 5 should fail because I disabled the hairpinMode. Thanks!

[aojea]

# Step 5: The Nginx Pod can access itself via its ClusterIP service.

That behavior is a Kubernetes networking requirement

Step 3: Check the configuration
root@kind-control-plane:/# cat /var/lib/kubelet/config.yaml | grep hairpinMode

IIRC that is a legacy thing from the kubenet times that no longer works, it was deprecated and removed with the dockershim

Maybe others CNI plugins different than kindnet may support this

[kevin85421]

Thanks @aojea!

[kevin85421]

Hi @aojea,

I do not have a lot of context about dockershim. Based on this link, it said that "Kubernetes' built-in dockershim component was removed in release v1.24.". My example uses v1.23.0 which seems not be affected by the deprecation. In addition, I check the document for Kubelet configuration from Kubernetes v1.26, and hairpinMode is still a valid config.

[aojea]

I do not have a lot of context about dockershim. Based on this link, it said that "Kubernetes' built-in dockershim component was removed in release v1.24.". M

yeah, but kind does not use dockershim :) that config is. no-op