不要开启tcp_tw_recycle

        apiVersion:v1data:192.168.128.5:default/rmt50-vip-svckind:ConfigMap

        vrrp_instance vips {
  state BACKUP
  interface eno16780032
  virtual_router_id 28
  priority 100
  nopreempt
  advert_int 1

  track_interface {
    eno16780032
  }

  virtual_ipaddress { 
    192.168.128.5
  }
}

# Service: default/rmt50-vip
virtual_server 192.168.128.5 5432 {
  delay_loop 5
  lvs_sched wlc
  lvs_method NAT
  persistence_timeout 1800
  protocol TCP
  
  real_server 10.244.3.27 5432 {
    weight 1
    TCP_CHECK {
      connect_port 5432
      connect_timeout 3
      retry 1
      delay_before_retry 3
    }
  }
}

        kubectl get pods -o wide|grep rmt50
rmt50-master              1/1       Running    0          2d        10.244.3.27       s2.adb.g1.com
rmt50-standby             1/1       Running    0          2d        10.244.1.250      m2.adb.g1.com
rmt50-vip                 1/1       Running    5          2d        192.168.128.149   s2.adb.g1.com

        cat /proc/net/netstat 
TcpExt: SyncookiesSent SyncookiesRecv SyncookiesFailed EmbryonicRsts PruneCalled RcvPruned OfoPruned OutOfWindowIcmps LockDroppedIcmps ArpFilter TW TWRecycled TWKilled PAWSPassive PAWSActive PAWSEstab DelayedACKs DelayedACKLocked DelayedACKLost ListenOverflows ListenDrops TCPPrequeued TCPDirectCopyFromBacklog TCPDirectCopyFromPrequeue TCPPrequeueDropped TCPHPHits TCPHPHitsToUser TCPPureAcks TCPHPAcks TCPRenoRecovery TCPSackRecovery TCPSACKReneging TCPFACKReorder TCPSACKReorder TCPRenoReorder TCPTSReorder TCPFullUndo TCPPartialUndo TCPDSACKUndo TCPLossUndo TCPLostRetransmit TCPRenoFailures TCPSackFailures TCPLossFailures TCPFastRetrans TCPForwardRetrans TCPSlowStartRetrans TCPTimeouts TCPLossProbes TCPLossProbeRecovery TCPRenoRecoveryFail TCPSackRecoveryFail TCPSchedulerFailed TCPRcvCollapsed TCPDSACKOldSent TCPDSACKOfoSent TCPDSACKRecv TCPDSACKOfoRecv TCPAbortOnData TCPAbortOnClose TCPAbortOnMemory TCPAbortOnTimeout TCPAbortOnLinger TCPAbortFailed TCPMemoryPressures TCPSACKDiscard TCPDSACKIgnoredOld TCPDSACKIgnoredNoUndo TCPSpuriousRTOs TCPMD5NotFound TCPMD5Unexpected TCPSackShifted TCPSackMerged TCPSackShiftFallback TCPBacklogDrop TCPMinTTLDrop TCPDeferAcceptDrop IPReversePathFilter TCPTimeWaitOverflow TCPReqQFullDoCookies TCPReqQFullDrop TCPRetransFail TCPRcvCoalesce TCPOFOQueue TCPOFODrop TCPOFOMerge TCPChallengeACK TCPSYNChallenge TCPFastOpenActive TCPFastOpenActiveFail TCPFastOpenPassive TCPFastOpenPassiveFail TCPFastOpenListenOverflow TCPFastOpenCookieReqd TCPSpuriousRtxHostQueues BusyPollRxPackets TCPAutoCorking TCPFromZeroWindowAdv TCPToZeroWindowAdv TCPWantZeroWindowAdv TCPSynRetrans TCPOrigDataSent TCPHystartTrainDetect TCPHystartTrainCwnd TCPHystartDelayDetect TCPHystartDelayCwnd TCPACKSkippedSynRecv TCPACKSkippedPAWS TCPACKSkippedSeq TCPACKSkippedFinWait2 TCPACKSkippedTimeWait TCPACKSkippedChallenge
TcpExt: 0 0 118 0 0 0 0 0 1 0 94979 0 960494 0 0 906 343087 1119 5435 0 0 432477 9530 21215128 0 7057137 7 2736264 2582522 0 4 0 1 2 0 0 0 0 6 317 0 0 5 0 92 0 23 1992 1464 713 0 0 4 0 5450 62 1557 0 293509 80 0 12 0 0 0 0 0 782 49 0 0 0 0 171 0 0 0 0 0 0 0 2 1743889 11075 0 69 7 3 0 0 0 0 0 0 174 0 303158 542 542 3641 3021 21292349 27 749 0 0 0 0 0 0 0 0
IpExt: InNoRoutes InTruncatedPkts InMcastPkts OutMcastPkts InBcastPkts OutBcastPkts InOctets OutOctets InMcastOctets OutMcastOctets InBcastOctets OutBcastOctets InCsumErrors InNoECTPkts InECT1Pkts InECT0Pkts InCEPkts
IpExt: 3 0 4802567 1188058 6661 0 57132122839 92642737581 189351200 38019672 2189009 0 0 85932763 0 0 0

        PAWSPassive 3565   3858
ListenDrops 3565   3858

        inttcp_v4_conn_request(structsock*sk,structsk_buff*skb)/* VJ's idea. We save last timestamp seen
		 * from the destination in peer table, when entering
		 * state TIME-WAIT, and check against it before
		 * accepting new connection request.
		 *
		 * If "isn" is not zero, this request hit alive
		 * timewait bucket, so that all the necessary checks
		 * are made in the function processing timewait state.
		 */if(tmp_opt.saw_tstamp&&tcp_death_row.sysctl_tw_recycle&&(dst=inet_csk_route_req(sk,&fl4,req))!=NULL&&fl4.daddr==saddr){if(!tcp_peer_is_proven(req,dst,true)){NET_INC_STATS_BH(sock_net(sk),LINUX_MIB_PAWSPASSIVEREJECTED);gotodrop_and_release;}}drop_and_release:dst_release(dst);drop_and_free:reqsk_free(req);drop:NET_INC_STATS_BH(sock_net(sk),LINUX_MIB_LISTENDROPS);return0;

        booltcp_peer_is_proven(structrequest_sock*req,structdst_entry*dst,boolpaws_check){structtcp_metrics_block*tm;boolret;if(!dst)returnfalse;rcu_read_lock();tm=__tcp_get_metrics_req(req,dst);if(paws_check){if(tm&&(u32)get_seconds()-tm->tcpm_ts_stamp<TCP_PAWS_MSL&&(s32)(tm->tcpm_ts-req->ts_recent)>TCP_PAWS_WINDOW)ret=false;elseret=true;}

        /* TCP timestamps are only 32-bits, this causes a slight
 * complication on 64-bit systems since we store a snapshot
 * of jiffies in the buffer control blocks below.  We decided
 * to use only the low 32-bits of jiffies and hide the ugly
 * casts with the following macro.
 */#define tcp_time_stamp		((__u32)(jiffies))

        if(tm&&(u32)get_seconds()-tm->tcpm_ts_stamp<TCP_PAWS_MSL&&(s32)(tm->tcpm_ts-req->ts_recent)>TCP_PAWS_WINDOW)//hereret=false;elseret=true;

        Chain POSTROUTING (policy ACCEPT 6 packets, 360 bytes)
 pkts bytes target     prot opt in     out     source               destination
6351K  563M KUBE-POSTROUTING  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* kubernetes postrouting rules */
    0     0 MASQUERADE  all  --  *      !docker0  172.17.0.0/16        0.0.0.0/0
2601K  177M RETURN     all  --  *      *       10.244.0.0/16        10.244.0.0/16
 102K 6466K MASQUERADE  all  --  *      *       10.244.0.0/16       !224.0.0.0/4
1248K   86M MASQUERADE  all  --  *      *      !10.244.0.0/16        10.244.0.0/16