mirror of
https://github.com/zhwei820/learn.lianglianglee.com.git
synced 2025-09-26 05:06:42 +08:00
1065 lines
26 KiB
HTML
1065 lines
26 KiB
HTML
<!DOCTYPE html>
|
||
|
||
<!-- saved from url=(0046)https://kaiiiz.github.io/hexo-theme-book-demo/ -->
|
||
|
||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||
|
||
<head>
|
||
|
||
<head>
|
||
|
||
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
|
||
|
||
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1.0, user-scalable=no">
|
||
|
||
<link rel="icon" href="/static/favicon.png">
|
||
|
||
<title>10 东西向流量组件 Calico 的落地实践.md.html</title>
|
||
|
||
<!-- Spectre.css framework -->
|
||
|
||
<link rel="stylesheet" href="/static/index.css">
|
||
|
||
<!-- theme css & js -->
|
||
|
||
<meta name="generator" content="Hexo 4.2.0">
|
||
|
||
</head>
|
||
|
||
|
||
|
||
<body>
|
||
|
||
|
||
|
||
<div class="book-container">
|
||
|
||
<div class="book-sidebar">
|
||
|
||
<div class="book-brand">
|
||
|
||
<a href="/">
|
||
|
||
<img src="/static/favicon.png">
|
||
|
||
<span>技术文章摘抄</span>
|
||
|
||
</a>
|
||
|
||
</div>
|
||
|
||
<div class="book-menu uncollapsible">
|
||
|
||
<ul class="uncollapsible">
|
||
|
||
<li><a href="/" class="current-tab">首页</a></li>
|
||
|
||
</ul>
|
||
|
||
|
||
|
||
<ul class="uncollapsible">
|
||
|
||
<li><a href="../">上一级</a></li>
|
||
|
||
</ul>
|
||
|
||
|
||
|
||
<ul class="uncollapsible">
|
||
|
||
<li>
|
||
|
||
|
||
|
||
|
||
|
||
<a href="/专栏/Kubernetes 实践入门指南/00 为什么我们要学习 Kubernetes 技术.md.html">00 为什么我们要学习 Kubernetes 技术.md.html</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
|
||
|
||
|
||
|
||
<a href="/专栏/Kubernetes 实践入门指南/01 重新认识 Kubernetes 的核心组件.md.html">01 重新认识 Kubernetes 的核心组件.md.html</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
|
||
|
||
|
||
|
||
<a href="/专栏/Kubernetes 实践入门指南/02 深入理解 Kubernets 的编排对象.md.html">02 深入理解 Kubernets 的编排对象.md.html</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
|
||
|
||
|
||
|
||
<a href="/专栏/Kubernetes 实践入门指南/03 DevOps 场景下落地 K8s 的困难分析.md.html">03 DevOps 场景下落地 K8s 的困难分析.md.html</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
|
||
|
||
|
||
|
||
<a href="/专栏/Kubernetes 实践入门指南/04 微服务应用场景下落地 K8s 的困难分析.md.html">04 微服务应用场景下落地 K8s 的困难分析.md.html</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
|
||
|
||
|
||
|
||
<a href="/专栏/Kubernetes 实践入门指南/05 解决 K8s 落地难题的方法论提炼.md.html">05 解决 K8s 落地难题的方法论提炼.md.html</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
|
||
|
||
|
||
|
||
<a href="/专栏/Kubernetes 实践入门指南/06 练习篇：K8s 核心实践知识掌握.md.html">06 练习篇：K8s 核心实践知识掌握.md.html</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
|
||
|
||
|
||
|
||
<a href="/专栏/Kubernetes 实践入门指南/07 容器引擎 containerd 落地实践.md.html">07 容器引擎 containerd 落地实践.md.html</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
|
||
|
||
|
||
|
||
<a href="/专栏/Kubernetes 实践入门指南/08 K8s 集群安装工具 kubeadm 的落地实践.md.html">08 K8s 集群安装工具 kubeadm 的落地实践.md.html</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
|
||
|
||
|
||
|
||
<a href="/专栏/Kubernetes 实践入门指南/09 南北向流量组件 IPVS 的落地实践.md.html">09 南北向流量组件 IPVS 的落地实践.md.html</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
|
||
|
||
<a class="current-tab" href="/专栏/Kubernetes 实践入门指南/10 东西向流量组件 Calico 的落地实践.md.html">10 东西向流量组件 Calico 的落地实践.md.html</a>
|
||
|
||
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
|
||
|
||
|
||
|
||
<a href="/专栏/Kubernetes 实践入门指南/11 服务发现 DNS 的落地实践.md.html">11 服务发现 DNS 的落地实践.md.html</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
|
||
|
||
|
||
|
||
<a href="/专栏/Kubernetes 实践入门指南/12 练习篇：K8s 集群配置测验.md.html">12 练习篇：K8s 集群配置测验.md.html</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
|
||
|
||
|
||
|
||
<a href="/专栏/Kubernetes 实践入门指南/13 理解对方暴露服务的对象 Ingress 和 Service.md.html">13 理解对方暴露服务的对象 Ingress 和 Service.md.html</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
|
||
|
||
|
||
|
||
<a href="/专栏/Kubernetes 实践入门指南/14 应用网关 OpenResty 对接 K8s 实践.md.html">14 应用网关 OpenResty 对接 K8s 实践.md.html</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
|
||
|
||
|
||
|
||
<a href="/专栏/Kubernetes 实践入门指南/15 Service 层引流技术实践.md.html">15 Service 层引流技术实践.md.html</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
|
||
|
||
|
||
|
||
<a href="/专栏/Kubernetes 实践入门指南/16 Cilium 容器网络的落地实践.md.html">16 Cilium 容器网络的落地实践.md.html</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
|
||
|
||
|
||
|
||
<a href="/专栏/Kubernetes 实践入门指南/17 应用流量的优雅无损切换实践.md.html">17 应用流量的优雅无损切换实践.md.html</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
|
||
|
||
|
||
|
||
<a href="/专栏/Kubernetes 实践入门指南/18 练习篇：应用流量无损切换技术测验.md.html">18 练习篇：应用流量无损切换技术测验.md.html</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
|
||
|
||
|
||
|
||
<a href="/专栏/Kubernetes 实践入门指南/19 使用 Rook 构建生产可用存储环境实践.md.html">19 使用 Rook 构建生产可用存储环境实践.md.html</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
|
||
|
||
|
||
|
||
<a href="/专栏/Kubernetes 实践入门指南/20 有状态应用的默认特性落地分析.md.html">20 有状态应用的默认特性落地分析.md.html</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
|
||
|
||
|
||
|
||
<a href="/专栏/Kubernetes 实践入门指南/21 案例：分布式 MySQL 集群工具 Vitess 实践分析.md.html">21 案例：分布式 MySQL 集群工具 Vitess 实践分析.md.html</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
|
||
|
||
|
||
|
||
<a href="/专栏/Kubernetes 实践入门指南/22 存储对象 PV、PVC、Storage Classes 的管理落地实践.md.html">22 存储对象 PV、PVC、Storage Classes 的管理落地实践.md.html</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
|
||
|
||
|
||
|
||
<a href="/专栏/Kubernetes 实践入门指南/23 K8s 集群中存储对象灾备的落地实践.md.html">23 K8s 集群中存储对象灾备的落地实践.md.html</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
|
||
|
||
|
||
|
||
<a href="/专栏/Kubernetes 实践入门指南/24 练习篇：K8s 集群配置测验.md.html">24 练习篇：K8s 集群配置测验.md.html</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
|
||
|
||
|
||
</div>
|
||
|
||
</div>
|
||
|
||
|
||
|
||
<div class="sidebar-toggle" onclick="sidebar_toggle()" onmouseover="add_inner()" onmouseleave="remove_inner()">
|
||
|
||
<div class="sidebar-toggle-inner"></div>
|
||
|
||
</div>
|
||
|
||
|
||
|
||
<script>
|
||
|
||
function add_inner() {
|
||
|
||
let inner = document.querySelector('.sidebar-toggle-inner')
|
||
|
||
inner.classList.add('show')
|
||
|
||
}
|
||
|
||
|
||
|
||
function remove_inner() {
|
||
|
||
let inner = document.querySelector('.sidebar-toggle-inner')
|
||
|
||
inner.classList.remove('show')
|
||
|
||
}
|
||
|
||
|
||
|
||
function sidebar_toggle() {
|
||
|
||
let sidebar_toggle = document.querySelector('.sidebar-toggle')
|
||
|
||
let sidebar = document.querySelector('.book-sidebar')
|
||
|
||
let content = document.querySelector('.off-canvas-content')
|
||
|
||
if (sidebar_toggle.classList.contains('extend')) { // show
|
||
|
||
sidebar_toggle.classList.remove('extend')
|
||
|
||
sidebar.classList.remove('hide')
|
||
|
||
content.classList.remove('extend')
|
||
|
||
} else { // hide
|
||
|
||
sidebar_toggle.classList.add('extend')
|
||
|
||
sidebar.classList.add('hide')
|
||
|
||
content.classList.add('extend')
|
||
|
||
}
|
||
|
||
}
|
||
|
||
|
||
|
||
|
||
|
||
function open_sidebar() {
|
||
|
||
let sidebar = document.querySelector('.book-sidebar')
|
||
|
||
let overlay = document.querySelector('.off-canvas-overlay')
|
||
|
||
sidebar.classList.add('show')
|
||
|
||
overlay.classList.add('show')
|
||
|
||
}
|
||
|
||
function hide_canvas() {
|
||
|
||
let sidebar = document.querySelector('.book-sidebar')
|
||
|
||
let overlay = document.querySelector('.off-canvas-overlay')
|
||
|
||
sidebar.classList.remove('show')
|
||
|
||
overlay.classList.remove('show')
|
||
|
||
}
|
||
|
||
|
||
|
||
</script>
|
||
|
||
|
||
|
||
<div class="off-canvas-content">
|
||
|
||
<div class="columns">
|
||
|
||
<div class="column col-12 col-lg-12">
|
||
|
||
<div class="book-navbar">
|
||
|
||
<!-- For Responsive Layout -->
|
||
|
||
<header class="navbar">
|
||
|
||
<section class="navbar-section">
|
||
|
||
<a onclick="open_sidebar()">
|
||
|
||
<i class="icon icon-menu"></i>
|
||
|
||
</a>
|
||
|
||
</section>
|
||
|
||
</header>
|
||
|
||
</div>
|
||
|
||
<div class="book-content" style="max-width: 960px; margin: 0 auto;
|
||
|
||
overflow-x: auto;
|
||
|
||
overflow-y: hidden;">
|
||
|
||
<div class="book-post">
|
||
|
||
<p id="tip" align="center"></p>
|
||
|
||
<div><h1>10 东西向流量组件 Calico 的落地实践</h1>
|
||
|
||
<p>Kubernetes 网络并没有原生的方案，它从一开始就给我们送来了一个选择题。到底选哪种网络方案才是最佳的方案呢？网络问题一直让社区用户很困惑，以至于在早期，不同场景下的方案如雨后春笋般涌现出来。其中比较优秀的就是今天选择给大家介绍的网络组件 Calico。这里我们要强调的是，Calico 方案并不是唯一方案，我们在社区仍然能看到很多优秀的方案比如 Cilium、OvS、Contiv、Flannel 等，至于选择它来讲解东西向流量的组件落地，实在是当前国内业界大部分的方案都是以 Cailico 实践为主，介绍它可以起到一个案例示范的作用。</p>
|
||
|
||
<h3>容器网络路由的原理</h3>
|
||
|
||
<p>众所周知容器原生网络模型基于单机的 veth 虚拟网桥实现，无法跨主机互联互通。如果想让容器跨主机互联互通，需要支持以下 3 点：</p>
|
||
|
||
<ol>
|
||
|
||
<li>网络控制面需要保证容器 IP 的唯一性</li>
|
||
|
||
<li>两个容器需要放在一个数据平面</li>
|
||
|
||
<li>需要工具来自动解决容器网络地址转换</li>
|
||
|
||
</ol>
|
||
|
||
<p>这里我们通过一个原生网络路由的例子来帮助大家理解容器网络互联互通的基本原理：</p>
|
||
|
||
<p><img src="assets/7dc3f9e0-dc3e-11ea-a66a-d5ea9de370fe.jpg" alt="9-1-hosts-container-network" /></p>
|
||
|
||
<p>图：Docker 19.03.12 版本直接路由模式图例</p>
|
||
|
||
<h4><strong>分别对主机 1 和主机 2 上的 docker0 进行配置，重启 docker 服务生效</strong></h4>
|
||
|
||
<p>编辑主机 1 上的 <code>/etc/docker/daemon.json</code> 文件，添加内容：<code>"bip" : "ip/netmask"</code>。</p>
|
||
|
||
<pre><code>{
|
||
|
||
"bip": "172.17.1.252/24"
|
||
|
||
}
|
||
|
||
|
||
|
||
</code></pre>
|
||
|
||
<p>编辑主机 2 上的 <code>/etc/docker/daemon.json</code> 文件，添加内容：<code>"bip" : "ip/netmask"</code>。</p>
|
||
|
||
<pre><code>{
|
||
|
||
"bip": "172.17.2.252/24"
|
||
|
||
}
|
||
|
||
|
||
|
||
</code></pre>
|
||
|
||
<p>主机 1 和主机 2 上均执行如下命令，重启 Docker 服务以使修改后的 docker0 网段生效。</p>
|
||
|
||
<pre><code>systemctl restart docker
|
||
|
||
|
||
|
||
</code></pre>
|
||
|
||
<h4><strong>添加路由规则</strong></h4>
|
||
|
||
<p>主机 1 上添加路由规则如下：</p>
|
||
|
||
<pre><code>route add -net 172.17.2.0/24 gw 172.26.15.215
|
||
|
||
|
||
|
||
</code></pre>
|
||
|
||
<p>主机 2 上添加路由规则如下：</p>
|
||
|
||
<pre><code>route add -net 172.17.1.0/24 gw 172.26.14.120
|
||
|
||
|
||
|
||
</code></pre>
|
||
|
||
<p>理论上配置完路由后应该从主机 1 可以连接到主机 2 的 docker0，实际场景下因为交换机会检查 docker0 的 mac 地址，并把这个非法的地址下的数据包直接 DROP 掉，让跨主机的容器无法想通，但这个并不妨碍我们理解原理。Calico 网络路由原理和以上示范静态路由原理是一致的，那么它是如何实现连通的呢？</p>
|
||
|
||
<p>安装 Calico 后，主机上检查如下：</p>
|
||
|
||
<pre><code class="language-bash">### 主机 1 上的
|
||
|
||
vxlan.calico: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1410 qdisc noqueue state UNKNOWN group default
|
||
|
||
link/ether 66:18:b6:89:bd:6f brd ff:ff:ff:ff:ff:ff
|
||
|
||
inet 192.168.206.0/32 brd 192.168.206.0 scope global vxlan.calico
|
||
|
||
|
||
|
||
### 主机 2 上的
|
||
|
||
vxlan.calico: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1410 qdisc noqueue state UNKNOWN group default
|
||
|
||
link/ether 66:85:17:26:23:b1 brd ff:ff:ff:ff:ff:ff
|
||
|
||
inet 192.168.49.0/32 brd 192.168.49.0 scope global vxlan.calico
|
||
|
||
|
||
|
||
</code></pre>
|
||
|
||
<p>对比可以知道，和上面范例中分配 IP 段一样，Calico 也是为每台主机分配固定的 IP 段保证容器网络 IP 不冲突。我们再来看下路由规则：</p>
|
||
|
||
<pre><code class="language-bash"><a href="/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="b5c7dadac1f5dcc598848287988783988d98848783">[email protected]</a>:~# route -n
|
||
|
||
Kernel IP routing table
|
||
|
||
Destination Gateway Genmask Flags Metric Ref Use Iface
|
||
|
||
0.0.0.0 172.26.0.1 0.0.0.0 UG 100 0 0 eth0
|
||
|
||
172.26.0.0 0.0.0.0 255.255.240.0 U 0 0 0 eth0
|
||
|
||
172.26.0.1 0.0.0.0 255.255.255.255 UH 100 0 0 eth0
|
||
|
||
192.168.49.1 0.0.0.0 255.255.255.255 UH 0 0 0 cali3f1b566e6d6
|
||
|
||
192.168.49.2 0.0.0.0 255.255.255.255 UH 0 0 0 cali408c6db5188
|
||
|
||
192.168.206.0 172.26.5.8 255.255.255.192 UG 0 0 0 eth0
|
||
|
||
|
||
|
||
<a href="/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="71031e1e053118015c4046435c43475c445c49">[email protected]</a>:~# route -n
|
||
|
||
Kernel IP routing table
|
||
|
||
Destination Gateway Genmask Flags Metric Ref Use Iface
|
||
|
||
0.0.0.0 172.26.0.1 0.0.0.0 UG 100 0 0 eth0
|
||
|
||
172.26.0.0 0.0.0.0 255.255.240.0 U 0 0 0 eth0
|
||
|
||
172.26.0.1 0.0.0.0 255.255.255.255 UH 100 0 0 eth0
|
||
|
||
192.168.49.0 172.26.8.126 255.255.255.192 UG 0 0 0 eth0
|
||
|
||
192.168.206.1 0.0.0.0 255.255.255.255 UH 0 0 0 cali517a7f7f853
|
||
|
||
192.168.206.3 0.0.0.0 255.255.255.255 UH 0 0 0 cali8d8ae1f64d9
|
||
|
||
192.168.206.4 0.0.0.0 255.255.255.255 UH 0 0 0 cali99a5d6c4e2d
|
||
|
||
192.168.206.5 0.0.0.0 255.255.255.255 UH 0 0 0 cali3b6d130f2eb
|
||
|
||
192.168.206.6 0.0.0.0 255.255.255.255 UH 0 0 0 calid8aeffc724c
|
||
|
||
|
||
|
||
</code></pre>
|
||
|
||
<p>两台主机路由表上都做了对方 IP 的路由信息。</p>
|
||
|
||
<p>我们通过部署容器来测试网络连通性：</p>
|
||
|
||
<pre><code class="language-bash"><a href="/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="bbc9d4d4cffbd2cb968a8c8996898d968e9683">[email protected]</a>:~# cat pingtest-deployment.yaml
|
||
|
||
apiVersion: apps/v1
|
||
|
||
kind: Deployment
|
||
|
||
metadata:
|
||
|
||
name: pingtest-deployment
|
||
|
||
labels:
|
||
|
||
app: pingtest
|
||
|
||
spec:
|
||
|
||
replicas: 3
|
||
|
||
selector:
|
||
|
||
matchLabels:
|
||
|
||
app: pingtest
|
||
|
||
template:
|
||
|
||
metadata:
|
||
|
||
labels:
|
||
|
||
app: pingtest
|
||
|
||
spec:
|
||
|
||
containers:
|
||
|
||
- name: pingtest
|
||
|
||
image: busybox
|
||
|
||
args: ["sleep", "infinity"]
|
||
|
||
|
||
|
||
<a href="/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="f785989883b79e87dac6c0c5dac5c1dac2dacf">[email protected]</a>:~# kubectl apply -f pingtest-deployment.yaml
|
||
|
||
|
||
|
||
<a href="/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="b1c3dedec5f1d8c19c8086839c83879c849c89">[email protected]</a>:~# kubectl get pod -l app=pingtest -o wide
|
||
|
||
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
|
||
|
||
pingtest-deployment-6dcb8d6c77-8ntqf 1/1 Running 0 10m 192.168.49.4 ip-172-26-8-126 <none> <none>
|
||
|
||
pingtest-deployment-6dcb8d6c77-l5hq2 1/1 Running 0 10m 192.168.49.5 ip-172-26-8-126 <none> <none>
|
||
|
||
pingtest-deployment-6dcb8d6c77-6fcdn 1/1 Running 0 6m48s 192.168.206.7 ip-172-26-5-8 <none> <none>
|
||
|
||
|
||
|
||
</code></pre>
|
||
|
||
<p>因为最新的 Calico 默认配置的模式是 vxlanMode 模式，你没有修改路由器的权限，所以需要修改 ipipMode 为 Always。</p>
|
||
|
||
<pre><code class="language-json"><a href="/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="5624393922163f267b6761647b64607b67647b676f6e">[email protected]</a>:~# cat pool.json
|
||
|
||
{
|
||
|
||
"kind": "IPPoolList",
|
||
|
||
"apiVersion": "projectcalico.org/v3",
|
||
|
||
"metadata": {
|
||
|
||
"resourceVersion": "2306"
|
||
|
||
},
|
||
|
||
"items": [
|
||
|
||
{
|
||
|
||
"kind": "IPPool",
|
||
|
||
"apiVersion": "projectcalico.org/v3",
|
||
|
||
"metadata": {
|
||
|
||
"name": "default-ipv4-ippool",
|
||
|
||
"uid": "0ba1e107-0582-4b7b-b99f-f7105525e987",
|
||
|
||
"resourceVersion": "763",
|
||
|
||
"creationTimestamp": "2020-08-10T16:59:28Z"
|
||
|
||
},
|
||
|
||
"spec": {
|
||
|
||
"cidr": "192.168.0.0/16",
|
||
|
||
"vxlanMode": "Never",
|
||
|
||
"ipipMode": "Always",
|
||
|
||
"natOutgoing": true,
|
||
|
||
"blockSize": 26,
|
||
|
||
"nodeSelector": "all()"
|
||
|
||
}
|
||
|
||
}
|
||
|
||
]
|
||
|
||
}
|
||
|
||
|
||
|
||
</code></pre>
|
||
|
||
<p>修改后在命令行下查看路由规则的办法，确认虚拟网络走了 tunnel 网卡口：</p>
|
||
|
||
<pre><code><a href="/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="daa8b5b5ae9ab3aaf7ebede8f7e8ecf7ebe8f7ebe3e2">[email protected]</a>:~# ip route
|
||
|
||
default via 172.26.0.1 dev eth0 proto dhcp src 172.26.12.198 metric 100
|
||
|
||
172.26.0.0/20 dev eth0 proto kernel scope link src 172.26.12.198
|
||
|
||
172.26.0.1 dev eth0 proto dhcp scope link src 172.26.12.198 metric 100
|
||
|
||
192.168.31.0 via 172.26.5.10 dev tunl0 proto bird onlink
|
||
|
||
192.168.31.0/26 via 172.26.5.10 dev eth0 proto 80 onlink
|
||
|
||
192.168.31.1 via 172.26.5.10 dev tunl0 proto bird onlink
|
||
|
||
192.168.31.3 via 172.26.5.10 dev tunl0 proto bird onlink
|
||
|
||
192.168.31.4 via 172.26.5.10 dev tunl0 proto bird onlink
|
||
|
||
192.168.31.5 via 172.26.5.10 dev tunl0 proto bird onlink
|
||
|
||
192.168.31.7 via 172.26.5.10 dev tunl0 proto bird onlink
|
||
|
||
192.168.31.64/26 via 172.26.5.10 dev tunl0 proto bird onlink
|
||
|
||
192.168.41.137 dev calie486eacd845 scope link
|
||
|
||
192.168.41.138 dev calif383cce9723 scope link
|
||
|
||
192.168.41.139 dev calia4f3d6b96e0 scope link
|
||
|
||
192.168.41.140 dev cali391d55f6fc3 scope link
|
||
|
||
192.168.41.141 dev cali981dc37e1ca scope link
|
||
|
||
192.168.41.142 dev calic0a72d40721 scope link
|
||
|
||
192.168.41.143 dev calicfb8f80c8c5 scope link
|
||
|
||
blackhole 192.168.41.192/26 proto bird
|
||
|
||
192.168.41.193 dev calia6f4721616e scope link
|
||
|
||
|
||
|
||
</code></pre>
|
||
|
||
<p>通过 kubectl exec 可以进入 Pod 容器进行连通性测试：</p>
|
||
|
||
<pre><code class="language-bash"><a href="/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="5d2f3232291d342d706c6a6f706f6b706c6f706c6465">[email protected]</a>:~# kubectl get po -o wide
|
||
|
||
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
|
||
|
||
pingtest-deployment-6dcb8d6c77-95vrw 1/1 Running 0 23m 192.168.41.139 ip-172-26-12-198 <none> <none>
|
||
|
||
pingtest-deployment-6dcb8d6c77-p4cqx 1/1 Running 0 23m 192.168.41.140 ip-172-26-12-198 <none> <none>
|
||
|
||
pingtest-deployment-6dcb8d6c77-kfmhp 1/1 Running 0 23m 192.168.41.137 ip-172-26-12-198 <none> <none>
|
||
|
||
pingtest-deployment-6dcb8d6c77-w582x 1/1 Running 0 23m 192.168.41.141 ip-172-26-12-198 <none> <none>
|
||
|
||
pingtest-deployment-6dcb8d6c77-ts9fh 1/1 Running 0 23m 192.168.41.138 ip-172-26-12-198 <none> <none>
|
||
|
||
pingtest-deployment-6dcb8d6c77-ppt2n 1/1 Running 0 22m 192.168.41.142 ip-172-26-12-198 <none> <none>
|
||
|
||
pingtest-deployment-6dcb8d6c77-qw46c 1/1 Running 0 22m 192.168.41.143 ip-172-26-12-198 <none> <none>
|
||
|
||
pingtest-deployment-6dcb8d6c77-972zw 1/1 Running 0 22m 192.168.31.7 ip-172-26-5-10 <none> <none>
|
||
|
||
<a href="/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="21534e4e556148510c1016130c13170c10130c101819">[email protected]</a>:~# kubectl exec -it pingtest-deployment-6dcb8d6c77-972zw -- sh
|
||
|
||
/ # ping 192.168.41.138
|
||
|
||
PING 192.168.41.138 (192.168.41.138): 56 data bytes
|
||
|
||
64 bytes from 192.168.41.138: seq=0 ttl=62 time=0.449 ms
|
||
|
||
64 bytes from 192.168.41.138: seq=1 ttl=62 time=0.501 ms
|
||
|
||
|
||
|
||
</code></pre>
|
||
|
||
<h3>Calico 网络的性能</h3>
|
||
|
||
<pre><code class="language-bash">sh-4.4# iperf3 -s
|
||
|
||
-----------------------------------------------------------
|
||
|
||
Server listening on 5201
|
||
|
||
-----------------------------------------------------------
|
||
|
||
|
||
|
||
Accepted connection from 172.26.5.10, port 53246
|
||
|
||
[ 5] local 192.168.31.68 port 5201 connected to 172.26.5.10 port 53248
|
||
|
||
[ ID] Interval Transfer Bitrate
|
||
|
||
[ 5] 0.00-1.00 sec 2.42 GBytes 20.8 Gbits/sec
|
||
|
||
[ 5] 1.00-2.00 sec 3.07 GBytes 26.4 Gbits/sec
|
||
|
||
[ 5] 2.00-3.00 sec 2.83 GBytes 24.3 Gbits/sec
|
||
|
||
[ 5] 3.00-4.00 sec 3.05 GBytes 26.2 Gbits/sec
|
||
|
||
[ 5] 4.00-5.00 sec 3.12 GBytes 26.8 Gbits/sec
|
||
|
||
[ 5] 5.00-6.00 sec 2.87 GBytes 24.7 Gbits/sec
|
||
|
||
[ 5] 6.00-7.00 sec 3.02 GBytes 26.0 Gbits/sec
|
||
|
||
[ 5] 7.00-8.00 sec 3.04 GBytes 26.1 Gbits/sec
|
||
|
||
[ 5] 8.00-9.00 sec 3.08 GBytes 26.5 Gbits/sec
|
||
|
||
[ 5] 9.00-10.00 sec 2.93 GBytes 25.2 Gbits/sec
|
||
|
||
[ 5] 10.00-10.04 sec 104 MBytes 24.6 Gbits/sec
|
||
|
||
- - - - - - - - - - - - - - - - - - - - - - - - -
|
||
|
||
[ ID] Interval Transfer Bitrate
|
||
|
||
[ 5] 0.00-10.04 sec 29.5 GBytes 25.3 Gbits/sec receiver
|
||
|
||
|
||
|
||
</code></pre>
|
||
|
||
<p>在规模配置在 10 台以下的情况下，容器传输效率依赖主机网卡性能，结果说明性能不差。</p>
|
||
|
||
<h3>总结</h3>
|
||
|
||
<p>Calico 作为业内常用的方案，它的好处就是灵活配置。因为它有 BGP 协议支持，可以跨数据中心的互联互通。从实践角度来看，它具备复杂场景下灵活配置的特点，所以也在业界主流比较推荐。当然这里我们的目的并不是推荐 Calico，我们仍然需要依据你当前集群的具体需要来规划，让容器网络能更方便的使用。</p>
|
||
|
||
<p>参考文章：</p>
|
||
|
||
<ul>
|
||
|
||
<li><a href="https://docs.docker.com/network/bridge/">https://docs.docker.com/network/bridge/</a></li>
|
||
|
||
<li><a href="https://www.tecmint.com/test-network-throughput-in-linux/">https://www.tecmint.com/test-network-throughput-in-linux/</a></li>
|
||
|
||
</ul>
|
||
|
||
</div>
|
||
|
||
</div>
|
||
|
||
<div>
|
||
|
||
<div style="float: left">
|
||
|
||
<a href="/专栏/Kubernetes 实践入门指南/09 南北向流量组件 IPVS 的落地实践.md.html">上一页</a>
|
||
|
||
</div>
|
||
|
||
<div style="float: right">
|
||
|
||
<a href="/专栏/Kubernetes 实践入门指南/11 服务发现 DNS 的落地实践.md.html">下一页</a>
|
||
|
||
</div>
|
||
|
||
</div>
|
||
|
||
|
||
|
||
</div>
|
||
|
||
</div>
|
||
|
||
</div>
|
||
|
||
</div>
|
||
|
||
|
||
|
||
<a class="off-canvas-overlay" onclick="hide_canvas()"></a>
|
||
|
||
</div>
|
||
|
||
<script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script defer src="https://static.cloudflareinsights.com/beacon.min.js/v652eace1692a40cfa3763df669d7439c1639079717194" integrity="sha512-Gi7xpJR8tSkrpF7aordPZQlW2DLtzUlZcumS8dMQjwDHEnw9I7ZLyiOj/6tZStRBGtGgN6ceN6cMH8z7etPGlw==" data-cf-beacon='{"rayId":"7099726f2a4b3d60","version":"2021.12.0","r":1,"token":"1f5d475227ce4f0089a7cff1ab17c0f5","si":100}' crossorigin="anonymous"></script>
|
||
|
||
</body>
|
||
|
||
<!-- Global site tag (gtag.js) - Google Analytics -->
|
||
|
||
<script async src="https://www.googletagmanager.com/gtag/js?id=G-NPSEEVD756"></script>
|
||
|
||
<script>
|
||
|
||
window.dataLayer = window.dataLayer || [];
|
||
|
||
|
||
|
||
function gtag() {
|
||
|
||
dataLayer.push(arguments);
|
||
|
||
}
|
||
|
||
|
||
|
||
gtag('js', new Date());
|
||
|
||
gtag('config', 'G-NPSEEVD756');
|
||
|
||
var path = window.location.pathname
|
||
|
||
var cookie = getCookie("lastPath");
|
||
|
||
console.log(path)
|
||
|
||
if (path.replace("/", "") === "") {
|
||
|
||
if (cookie.replace("/", "") !== "") {
|
||
|
||
console.log(cookie)
|
||
|
||
document.getElementById("tip").innerHTML = "<a href='" + cookie + "'>跳转到上次进度</a>"
|
||
|
||
}
|
||
|
||
} else {
|
||
|
||
setCookie("lastPath", path)
|
||
|
||
}
|
||
|
||
|
||
|
||
function setCookie(cname, cvalue) {
|
||
|
||
var d = new Date();
|
||
|
||
d.setTime(d.getTime() + (180 * 24 * 60 * 60 * 1000));
|
||
|
||
var expires = "expires=" + d.toGMTString();
|
||
|
||
document.cookie = cname + "=" + cvalue + "; " + expires + ";path = /";
|
||
|
||
}
|
||
|
||
|
||
|
||
function getCookie(cname) {
|
||
|
||
var name = cname + "=";
|
||
|
||
var ca = document.cookie.split(';');
|
||
|
||
for (var i = 0; i < ca.length; i++) {
|
||
|
||
var c = ca[i].trim();
|
||
|
||
if (c.indexOf(name) === 0) return c.substring(name.length, c.length);
|
||
|
||
}
|
||
|
||
return "";
|
||
|
||
}
|
||
|
||
|
||
|
||
</script>
|
||
|
||
|
||
|
||
</html>
|
||
|