How do I increase the nf_conntrack_max quota on my Amazon EKS nodes?

Resolution

Check the current nf_conntrack_max value

Complete the following steps:

1. Use SSH or Session Manager, a capability of AWS Systems Manager, to connect to your worker node.
2. Run the following command to get the current nf_conntrack_max value:

   cat /proc/sys/net/netfilter/nf_conntrack_max

Modify the kube-proxy ConfigMap

Complete the following steps:

1. Run the following command to edit the kube-proxy-config ConfigMap:

   kubectl edit configmap kube-proxy-config -n kube-system

2. Under conntrack, increase the min value:

   conntrack:
     maxPerCore: 32768
     min: 131072

   Note: Replace the example values with your values. Calculate the nf_conntrack_max value as max(min, maxPerCore * number_of_CPU_cores). For example, you set min to 131072 and maxPerCore to 32768 on a node with 2 CPU cores. The nf_conntrack_max value becomes 131072 because 131072 is greater than 32768 multiplied by 2.

3. Save your changes, and then close the editor.

Restart the kube-proxy DaemonSet

After you modify the ConfigMap, run the following command to restart the kube-proxy DaemonSet to apply the changes:

kubectl rollout restart daemonset kube-proxy -n kube-system

Verify that the nf_conntrack_max value updated

Important: When you increase nf_conntrack_max, node memory usage increases. Each connection tracking entry uses approximately 300 bytes of memory. Make sure that you allocate enough memory.

Complete the following steps:

1. Use SSH or Session Manager to connect to your worker node.
2. Run the following command to confirm that the nf_conntrack_max value updated:

   cat /proc/sys/net/netfilter/nf_conntrack_max

Related information

Update the Kubernetes kube-proxy self-managed add-on

Manage networking add-ons for Amazon EKS clusters

kube-proxy on the Kubernetes website

AWS Systems Manager Session Manager