In a Flannel cluster, requests to access the Ingress Controller itself from within the Ingress pod using domain name, CLB IP address, or Cluster IP address, may fail.

Cause analysis

Flannel allows hairpin access by default.

Solution

Restore the hairpinMode in Flannel to its default setting.

kubectl edit cm kube-flannel-cfg -n kube-flannel

In the returned cni-conf.json file, check whether the hairpinMode setting has been modified (the default is true), as shown below.

cni-conf.json: |
{
"name": "cbr0",
"cniVersion": "0.3.1",
"plugins": [
{
"type": "flannel",
"delegate": {
"hairpinMode": true,
"isDefaultGateway": true
}
},
{
"type": "portmap",
"capabilities": {
"portMappings": true
}
}
]
}

If the hairpinMode setting has been changed from its default value, set it back to true. After completing the configuration, delete the current Flannel pod and wait for it to be recreated.

Last updated: 2026.07.23 14:31:45

Public security network record in Beijing: No. 11010802032137