Kubernetes Dataplane · wrap-up
Cheat sheet & self-check
Every command from this section on one page.
Identify the CNI
ls /etc/cni/net.d/ | Which CNI config is active on a node |
kubectl get pods -n kube-system -o wide | grep -E 'calico|cilium|flannel|kindnet|aws-node' | CNI agent pods |
kubectl get nodes -o jsonpath='{.items[*].spec.podCIDR}' | Per-node pod CIDRs (if the CNI uses them) |
CNI-specific tools
cilium status / cilium connectivity test | Cilium health and an end-to-end test suite |
hubble observe --namespace shop | Cilium: live flow logs |
calicoctl node status | Calico: BGP peering status |
Which mode am I in?
kubectl -n kube-system get cm kube-proxy -o yaml | grep mode | kube-proxy mode (empty = platform default) |
curl -s localhost:10249/proxyMode | Ask kube-proxy on a node |
cilium status | grep KubeProxyReplacement | Cilium replacing kube-proxy? |
Inspect the rules
sudo iptables -t nat -L KUBE-SERVICES -n | head | iptables mode Service rules |
sudo ipvsadm -Ln | IPVS mode virtual servers and backends |
sudo nft list table ip kube-proxy | head -50 | nftables mode rules |
cilium service list | eBPF service table (Cilium) |
Inspect
kubectl exec <pod> -- cat /etc/resolv.conf | The pod's resolver config |
kubectl -n kube-system get cm coredns -o yaml | The Corefile (CoreDNS configuration) |
kubectl -n kube-system logs -l k8s-app=kube-dns | CoreDNS logs (enable the 'log' plugin to see queries) |
Test
kubectl run dns --rm -it --image=busybox:1.36 --restart=Never -- nslookup web.shop | Resolve a Service |
dig +search web | Resolve using search domains (where dig is available) |
dig @10.96.0.10 web.shop.svc.cluster.local | Ask CoreDNS directly by its Service IP |
MetalLB
kubectl get ipaddresspools,l2advertisements,bgpadvertisements -n metallb-system | MetalLB configuration |
kubectl get svc -A --field-selector spec.type=LoadBalancer | LoadBalancer Services and their external IPs |
kubectl -n metallb-system logs -l component=speaker | Which node announces which IP |
Client IP
externalTrafficPolicy: Local | Keep the source IP at L4 (no SNAT hop) |
X-Forwarded-For / Forwarded | Client IP carried in HTTP headers by L7 proxies |
PROXY protocol v1/v2 | Client IP prepended to the TCP stream by L4 proxies |
