kubernetes: SCTP port is not opening to receive traffic from outside of kubernetes cluster
I have a cluster with two machines (1 master and 1 worker) and have a single pod on worker node which is providing SCTP service. A ClusterIP service related to the pod declares externalIPs. The value of externalIPs is the public IP (###.###.##.208) of the worker’s machine. When pod and service are deployed using helm I can see both pod and service are available and external IP is assigned to the service but result of netstat command shows that port defined for sctp service is not opened to be accessed from outside world, however if I do the same thing for a tcp port it gets opened for the outside world. Result of netstat is given as below -
For SCTP -
user1@master:~/build/helm$ kubectl get svc --all-namespaces NAMESPACE NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE default amf-service ClusterIP 10.99.154.48 ###.###.##.208 38412/SCTP 2m55s
For TCP -
user1@worker01:~$ netstat -nl | grep 38412 <doesn’t return anything>
user1@master:~/build/helm$ kubectl get svc --all-namespaces NAMESPACE NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE default amf-service ClusterIP 10.99.154.48 ###.###.##.208 38412/TCP 2m16s
user1@worker01:~$ netstat -nl | grep 38412 Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 ###.###.##.208:38412 0.0.0.0:* LISTEN
Service Definition -
apiVersion: v1 kind: Service metadata: name: amf-service labels: {{- include “amf-chart.labels” . | nindent 4 }} spec: type: {{ .Values.service.type }} ports: ####### - port: {{ .Values.service.http_port }} ####### targetPort: {{ .Values.service.http_port }} ####### protocol: TCP ####### name: http - port: {{ .Values.service.sctp_port }} targetPort: {{ .Values.service.sctp_port }} protocol: SCTP name: sctp selector: {{- include “amf-chart.selectorLabels” . | nindent 4 }} externalIPs: - { .Values.service.workerIP}
It should have behaved same as that of TCP and service should be available at port 38412 for SCTP protocol.
For reproduction deploy a pod which provides sctp service and use the service configuration as I have mentioned in service template given above.
If I run the SCTP client inside the cluster in a pod I am able to use SCTP service
Environment:
- Kubernetes version (use
kubectl version
): 1.21 - Cloud provider or hardware configuration:
- OS (e.g:
cat /etc/os-release
): Ubuntu 18.04.5 LTS (Bionic Beaver) - Kernel (e.g.
uname -a
): Linux worker01 5.4.0-72-generic #80~18.04.1-Ubuntu SMP Mon Apr 12 23:26:25 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux - Install tools:
- Network plugin and version (if this is a network-related bug):
{ "name": "cbr0", "cniVersion": "0.3.1", "plugins": [ { "type": "flannel", "delegate": { "hairpinMode": true, "isDefaultGateway": true } }, { "type": "portmap", "capabilities": { "portMappings": true } } ] } ~
- Others: Docker container is using centos8 as base image (FROM centos:centos8)
About this issue
- Original URL
- State: closed
- Created 3 years ago
- Comments: 23 (10 by maintainers)
Hi @aojea, thanks for your comments. Apparently, there is something with SCTP and NAT. I did some tests with ncat and all tests within the cluster were OK :pod, service, host, other host in the same LAN, etc. In my actual topology, I have one SCTP endpoint in a K8s pod accessible with a public address and the other SCTP endpoint behind a NAT and in this scenario I have failures. Troubleshooting with ncat from the Natted host, I get the following error:
So far, I assume this behavior is not related to Kubernetes, so I will research in other direction.
Thank you so much for your time and support!