<p>The response from the called service is not DNAT'ed back to set src to the service clusterIP. So the response packet is going directly via cni0 bridge and not getting into iptables, preserving pod's IP.</p>

<p>to fix this i added the following option to kube-proxy and issue was gone.</p>

<p>--masquerade-all=true</p>

CC BY-SA 4.0
2018-07-29T16:28:09.623Z
2018-07-29T16:28:09.623Z
mootez
<p>few days ago, i am facing a strange issue which is "a pod can not reach another pod running in the same minion/host through servide ClusterIP whereas they can reach each other skipping going through service clusterIP"</p>

<p>i am running kubernetes 1.9.6 on top of openstack (ubuntu 16.04 hosts) with:</p>

<ul>
<li>cni 0.7.0</li>
<li>cri-containerd 1.0.0-beta</li>
<li>flannel 0.9.1</li>
<li>etcd 3.0.13</li>
</ul>

<p>the other scenarios were working fine. even between pods running in different hosts, they can reach each other through service clusterIP.</p>

<p>what is going on here !!! any support will be more than welcome</p>

CC BY-SA 4.0
2018-07-29T11:05:54.257Z
what you mean by "do not try to do it !!" it was working with me like a charm. i upgraded to 1.10 but still not working. the behavior happens randomly(in some minions not all). do you have an idea about the issue described above. i need to know the RC.
mootez
CC BY-SA 4.0
2018-07-31T03:27:01.333Z
https://stackoverflow.com/a/43283363/747579
Abdennour TOUMI
<kubernetes><networking>
pod to pod can not be reached through service clusterIP running in the same minion
mootez
# pod to pod can not be reached through service clusterIP running in the same minion

(Asked by: username_0 on 2018-07-29)

few days ago, i am facing a strange issue which is "a pod can not reach another pod running in the same minion/host through servide ClusterIP whereas they can reach each other skipping going through service clusterIP"

i am running kubernetes 1.9.6 on top of openstack (ubuntu 16.04 hosts) with:

* cni 0.7.0
* cri-containerd 1.0.0-beta
* flannel 0.9.1
* etcd 3.0.13

the other scenarios were working fine. even between pods running in different hosts, they can reach each other through service clusterIP.

what is going on here !!! any support will be more than welcome

**Tags:** kubernetes, networking

> **Comments:**
> **username_0**: what you mean by "do not try to do it !!" it was working with me like a charm. i upgraded to 1.10 but still not working. the behavior happens randomly(in some minions not all). do you have an idea about the issue described above. i need to know the RC.  
> **username_1**: https://stackoverflow.com/a/43283363/747579  

---

## 1 answers

### Answer by username_0 on 2018-07-29. Score: 0 | Accepted answer

The response from the called service is not DNAT'ed back to set src to the service clusterIP. So the response packet is going directly via cni0 bridge and not getting into iptables, preserving pod's IP.

to fix this i added the following option to kube-proxy and issue was gone.

--masquerade-all=true


---

