Skip to content

Commit 49436e3

Browse files
Update service.md
1 parent dc947ab commit 49436e3

File tree

1 file changed

+11
-9
lines changed
  • content/en/docs/concepts/services-networking

1 file changed

+11
-9
lines changed

content/en/docs/concepts/services-networking/service.md

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -184,10 +184,10 @@ In the example above, traffic is routed to the single endpoint defined in
184184
the YAML: `192.0.2.42:9376` (TCP).
185185

186186
{{< note >}}
187-
The Kubernetes API server does not allow proxying to endpoints that are not mapped to
188-
pods. Actions such as `kubectl proxy <service-name>` where the service has no
189-
selector will fail due to this constraint. This prevents the Kubernetes API server
190-
from being used as a proxy to endpoints the caller may not be authorized to access.
187+
The Kubernetes API server does not allow proxying to endpoints that are not mapped to
188+
pods. Actions such as `kubectl proxy <service-name>` where the service has no
189+
selector will fail due to this constraint. This prevents the Kubernetes API server
190+
from being used as a proxy to endpoints the caller may not be authorized to access.
191191
{{< /note >}}
192192

193193
An ExternalName Service is a special case of Service that does not have
@@ -251,7 +251,7 @@ There are a few reasons for using proxying for Services:
251251

252252
Later in this page you can read about various kube-proxy implementations work. Overall,
253253
you should note that, when running `kube-proxy`, kernel level rules may be
254-
modified (for example, iptables rules might get created), which won't get cleaned up,
254+
modified (for example, iptables rules might get created), which won't get cleaned up,
255255
in some cases until you reboot. Thus, running kube-proxy is something that should
256256
only be done by an administrator which understands the consequences of having a
257257
low level, privileged network proxying service on a computer. Although the `kube-proxy`
@@ -278,6 +278,8 @@ Lastly, the user-space proxy installs iptables rules which capture traffic to
278278
the Service's `clusterIP` (which is virtual) and `port`. The rules
279279
redirect that traffic to the proxy port which proxies the backend Pod.
280280

281+
{{< note >}} Kube-proxy in userspace mode is deprecated. {{< /note >}}
282+
281283
By default, kube-proxy in userspace mode chooses a backend via a round-robin algorithm.
282284

283285
![Services overview diagram for userspace proxy](/images/docs/services-userspace-overview.svg)
@@ -708,13 +710,13 @@ Your cluster must have the `ServiceLoadBalancerClass` [feature gate](/docs/refer
708710
other versions of Kubernetes, check the documentation for that release.
709711
By default, `spec.loadBalancerClass` is `nil` and a `LoadBalancer` type of Service uses
710712
the cloud provider's default load balancer implementation if the cluster is configured with
711-
a cloud provider using the `--cloud-provider` component flag.
713+
a cloud provider using the `--cloud-provider` component flag.
712714
If `spec.loadBalancerClass` is specified, it is assumed that a load balancer
713715
implementation that matches the specified class is watching for Services.
714716
Any default load balancer implementation (for example, the one provided by
715717
the cloud provider) will ignore Services that have this field set.
716718
`spec.loadBalancerClass` can be set on a Service of type `LoadBalancer` only.
717-
Once set, it cannot be changed.
719+
Once set, it cannot be changed.
718720
The value of `spec.loadBalancerClass` must be a label-style identifier,
719721
with an optional prefix such as "`internal-vip`" or "`example.com/internal-vip`".
720722
Unprefixed names are reserved for end-users.
@@ -997,7 +999,7 @@ There are other annotations to manage Classic Elastic Load Balancers that are de
997999

9981000
service.beta.kubernetes.io/aws-load-balancer-security-groups: "sg-53fae93f"
9991001
# A list of existing security groups to be configured on the ELB created. Unlike the annotation
1000-
# service.beta.kubernetes.io/aws-load-balancer-extra-security-groups, this replaces all other security groups previously assigned to the ELB and also overrides the creation
1002+
# service.beta.kubernetes.io/aws-load-balancer-extra-security-groups, this replaces all other security groups previously assigned to the ELB and also overrides the creation
10011003
# of a uniquely generated security group for this ELB.
10021004
# The first security group ID on this list is used as a source to permit incoming traffic to target worker nodes (service traffic and health checks).
10031005
# If multiple ELBs are configured with the same security group ID, only a single permit line will be added to the worker node security groups, that means if you delete any
@@ -1007,7 +1009,7 @@ There are other annotations to manage Classic Elastic Load Balancers that are de
10071009
service.beta.kubernetes.io/aws-load-balancer-extra-security-groups: "sg-53fae93f,sg-42efd82e"
10081010
# A list of additional security groups to be added to the created ELB, this leaves the uniquely generated security group in place, this ensures that every ELB
10091011
# has a unique security group ID and a matching permit line to allow traffic to the target worker nodes (service traffic and health checks).
1010-
# Security groups defined here can be shared between services.
1012+
# Security groups defined here can be shared between services.
10111013

10121014
service.beta.kubernetes.io/aws-load-balancer-target-node-labels: "ingress-gw,gw-name=public-api"
10131015
# A comma separated list of key-value pairs which are used

0 commit comments

Comments
 (0)