每周阅读（4/2/2018）

The Almighty Pause Container
K8s pause 容器的作用：为 pod 里的容器提供 network namespace和父进程，相当于所有 pod 里面的容器的父容器。

In Kubernetes, the pause container serves as the "parent container" for all of the containers in your pod. The pause container has two core responsibilities. First, it serves as the basis of Linux namespace sharing in the pod. And second, with PID (process ID) namespace sharing enabled, it serves as PID 1 for each pod and reaps zombie processes.

Operating a Kubernetes network
重读了这篇，K8s 的网络部分，还是相当复杂，其中有 2 个组件：dns 和
proxy（还有 overlay network 方案，例如： calico，7 层的 http proxy 和 load balancer：ingress）：

• Every Kubernetes service gets an IP address (like 10.23.1.2)
• kube-dns: 解析

kube-dns resolves Kubernetes service DNS names to IP addresses (so my-svc.my-namespace.svc.cluster.local might map to 10.23.1.2)

• kube-proxy：路由

kube-proxy sets up iptables rules in order to do random load balancing between them. Kube-proxy also has a userspace round-robin load balancer but my impression is that they don’t recommend using it.

文中提到的 https://blog.sophaskins.net/blog/misadventures-with-kube-dns/，如何 debug dns，也可以读一读。