Hacker News Reader

Is this available on GKE? Any action required (e.g. node pool flags) on our side to get this working?

Yep! GKE just runs atop GCE. No work required on your side.

That reminds me though: you have to be communicating over the internal IP addresses, not the external ones (I hope the Services stuff does the right thing automatically). Firewall rules and such are different for internal versus external IPs (people often want a simple "deny all external traffic"), so that's sadly still a performance cliff.

Yes, this is enabled for all VMs running on Compute Engine (which includes GKE VMs), however the in-guest iptables &c. bits add non-trivial overhead (I don't have numbers handy, apologies).

Thanks, good to know.

Regarding in-guest iptables -- there's not much we can do on GKE/Kubernetes about that. I serve about 1.2M requests per second on my GKE cluster through GLB and see this overhead very well.

The new Alias IP stuff should help with that (though I imagine there will still be some iptables shenanigans left, so I'm not sure how much it will help)

AFAIK for GLB to work with GKE (via GLBC) I would still need NodePort service that routes exclusively via iptables?

FWIW I also look forward to IPVS in k8s 1.9 that should improve this slightly.

Reply on news.ycombinator.com