Configuring kube-proxy - OpenShift SDN | Networking | OpenShift Container Platform 4.1

About iptables rules synchronization
Modifying the kube-proxy configuration
kube-proxy configuration parameters

The Kubernetes network proxy (kube-proxy) runs on each node and is managed by the Cluster Network Operator (CNO). kube-proxy maintains network rules for forwarding connections for endpoints associated with services.

About iptables rules synchronization

The synchronization period determines how frequently the Kubernetes network proxy (kube-proxy) syncs the iptables rules on a node.

A sync begins when either of the following events occurs:

An event occurs, such as service or endpoint is added to or removed from the cluster.
The time since the last sync exceeds the sync period defined for kube-proxy.

Modifying the kube-proxy configuration

You can modify the Kubernetes network proxy configuration for your cluster.

Prerequisites

Install the OpenShift Command-line Interface (CLI), commonly known as oc.
Log in to a running cluster with the cluster-admin role.

Procedure

Edit the Network.operator.openshift.io Custom Resource (CR) by running the following command:
```
$ oc edit network.operator.openshift.io cluster
```

Modify the kubeProxyConfig parameter in the CR with your changes to the kube-proxy configuration, such as in the following example CR:

apiVersion: operator.openshift.io/v1
kind: Network
metadata:
  name: cluster
spec:
  kubeProxyConfig:
    iptablesSyncPeriod: 30s
    proxyArguments:
      iptables-min-sync-period: ["30s"]

Save the file and exit the text editor.

The syntax is validated by the oc command when you save the file and exit the editor. If your modifications contain a syntax error, the editor opens the file and displays an error message.

Run the following command to confirm the configuration update:

$ oc get networks.operator.openshift.io -o yaml

The command returns output similar to the following example:

apiVersion: v1
items:
- apiVersion: operator.openshift.io/v1
  kind: Network
  metadata:
    name: cluster
  spec:
    clusterNetwork:
    - cidr: 10.128.0.0/14
      hostPrefix: 23
    defaultNetwork:
      type: OpenShiftSDN
    kubeProxyConfig:
      iptablesSyncPeriod: 30s
      proxyArguments:
        iptables-min-sync-period:
        - 30s
    serviceNetwork:
    - 172.30.0.0/16
  status: {}
kind: List

Optional: Run the following command to confirm that the Cluster Network Operator accepted the configuration change:
```
$ oc get clusteroperator network
NAME      VERSION     AVAILABLE   PROGRESSING   DEGRADED   SINCE
network   4.1.0-0.9   True        False         False      1m
```
The AVAILABLE field is True when the configuration update is applied successfully.

kube-proxy configuration parameters

You can modify the following kubeProxyConfig parameters:

Table 1. Parameters
Parameter	Description	Values	Default
`iptablesSyncPeriod`	The refresh period for `iptables` rules.	A time interval, such as `30s` or `2m`. Valid suffixes include `s`, `m`, and `h` and are described in the Go time package documentation.	`30s`
`proxyArguments.iptables-min-sync-period`	The minimum duration before refreshing `iptables` rules. This parameter ensures that the refresh does not happen too frequently.	A time interval, such as `30s` or `2m`. Valid suffixes include `s`, `m`, and `h` and are described in the Go time package	`30s`