04-kubernetes网络通信

kubernetes网络通信

目录

• kubernetes网络通信
  • 需要解决的问题
  • flannel
  • Calico/Cannel

需要解决的问题

• 同一个pod内部的不同容器间通信, local
• Pod间的通信
• pod与Service的通信: PodIP<--->ClusterIP
• Service 与集群外部通信

CNI：
常见的解决方案

• flannel
• calico
• canel
• kube-router

解决方案：
虚拟网桥：brige方案
多路复用：MacVLAN（二层方案）
硬件交换：SR-IOV

flannel

查看集群的flannel 配置文件
将配置文件放到/etc/cni/net.d目录下， kubelet 会加载该文件。
cat /etc/cni/net.d/10-flannel.conflist

flannel不支持网络策略
不同namespace 的pod 可以相互通信

支持多种方式后端

• Vxlan 工作原理
  • vxlan
  • Directrouting # 同网段使用host-gw 不同网段使用vxlan
• host-gw： Host Gateway 工作原理
• UDP： 效率很低

flannel 的配置参数：

• network

  使用CIRD格式的网络地址：

  10.244.0.0/16 ->

  master: 10.244.0.0/24

  ​ node1: 10.244.1.0/24

  ​ ...

  node255: 10.244.255.0/24

• SubnetLen

  在node上使用多长的掩码 默认 24位

• SubnetMin 与SubnetMax

  网段中最小的子网网段与最大的子网网段。

• Backend： 选择flannel的类型

修改flannel 类型

修改配置文件 kube-flannel.yaml

  net-conf.json: |
    {
      "Network": "172.20.0.0/16",
      "Backend": {
        "Type": "vxlan"
        "Direcrouting": true
      }
    }

Calico/Cannel

可以提供网络策略

https://docs.projectcalico.org/v3.5/getting-started/kubernetes/installation/other

networkpolicy.spec

   egress	<[]Object>
     List of egress rules to be applied to the selected pods. Outgoing traffic
     is allowed if there are no NetworkPolicies selecting the pod (and cluster
     policy otherwise allows the traffic), OR if the traffic matches at least
     one egress rule across all of the NetworkPolicy objects whose podSelector
     matches the pod. If this field is empty then this NetworkPolicy limits all
     outgoing traffic (and serves solely to ensure that the pods it selects are
     isolated by default). This field is beta-level in 1.8

   ingress	<[]Object>
     List of ingress rules to be applied to the selected pods. Traffic is
     allowed to a pod if there are no NetworkPolicies selecting the pod OR if
     the traffic source is the pod's local node, OR if the traffic matches at
     least one ingress rule across all of the NetworkPolicy objects whose
     podSelector matches the pod. If this field is empty then this NetworkPolicy
     does not allow any traffic (and serves solely to ensure that the pods it
     selects are isolated by default).

   podSelector	<Object> -required-
     Selects the pods to which this NetworkPolicy object applies. The array of
     ingress rules is applied to any pods selected by this field. Multiple
     network policies can select the same set of pods. In this case, the ingress
     rules for each are combined additively. This field is NOT optional and
     follows standard label selector semantics. An empty podSelector matches all
     pods in this namespace.

   policyTypes	<[]string>
     List of rule types that the NetworkPolicy relates to. Valid options are
     Ingress, Egress, or Ingress,Egress. If this field is not specified, it will
     default based on the existence of Ingress or Egress rules; policies that
     contain an Egress section are assumed to affect Egress, and all policies
     (whether or not they contain an Ingress section) are assumed to affect
     Ingress. If you want to write an egress-only policy, you must explicitly
     specify policyTypes [ "Egress" ]. Likewise, if you want to write a policy
     that specifies that no egress is allowed, you must specify a policyTypes
     value that include "Egress" (since such a policy would not include an
     Egress section and would otherwise default to just [ "Ingress" ]). This
     field is beta-level in 1.8

注意：如果是定义egress-only 策略，则需要显式的声明Egress。如果需要一个拒绝所有出流量的策略，需要在value中包含Egress，因为如果不包含egress，默认只包含ingress。

阻止所有ingress, 允许所有Egress

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all-ingress
spec:
  podSelector: {}
  policyTypes:
  - Ingress

允许所有ingress，允许所有Egress

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all-ingress
spec:
  podSelector: {}
  ingress:
  - {}
  policyTypes:
  - Ingress

阻止所有Egress

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all-ingress
spec:
  podSelector: {}
  policyTypes:
  - Egress

案例：

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: test-network-policy
  namespace: default
spec:
  podSelector:
    matchLabels:
      role: db
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - ipBlock:
        cidr: 172.17.0.0/16
        except:
        - 172.17.1.0/24
    - namespaceSelector:
        matchLabels:
          project: myproject
    - podSelector:
        matchLabels:
          role: frontend
    ports:
    - protocol: TCP
      port: 6379
  egress:
  - to:
    - ipBlock:
        cidr: 10.0.0.0/24
    ports:
    - protocol: TCP
      port: 5978

总结

1. NetworkPolicy 针对 namespace 中的 pod 生效。
2. 默认ingress 禁止， egreess 放行。要默认禁止 egress 需要在 policyTypes 的 value 中加入 egress。
3. NetworkPolicy 在定义流量匹配上与防火墙类似。
4. 一般来说对于 提供服务的pod 应该按一下规则定义
   • 默认关闭所有出入栈
   • 放行本namespace 中的所有
   • 定义外部流量