Download as PDF, PPTX
More Related Content
![[ě¤íěě¤ěť¨ě¤í
] Linux Network Troubleshooting](https://cdn.slidesharecdn.com/ss_thumbnails/opensourceconsultingnetworktroubleshootingyjlee20210412-210413014206-thumbnail.jpg?width=600ounds&width=560&fit=bounds)
Similar to Networking in Kubernetes
![UiPath Automation Suite Installation (Hands-On) [2/3]](https://cdn.slidesharecdn.com/ss_thumbnails/automationsuitecommunitysession2-251015095633-a6d862f1-thumbnail.jpg?width=600ounds&width=560&fit=bounds)
Networking in Kubernetes
- 1. Google Cloud Platform Networkingin Kubernetes K8s Meetup #8 Apr 21, 2016 Minhan Xia Software Engineer github.com/freehan
- 2.
- 3.
- 4.
- 5.
- 6.
- 7.
- 8.
- 9.
- 10.
- 11.
- 12.
- 13. Host ports A: 172.16.1.1 3306 B:172.16.1.2 80 9376 11878SNAT SNAT C: 172.16.1.1 8000
- 14. Host ports A: 172.16.1.1 3306 B:172.16.1.2 80 9376 11878SNAT SNAT C: 172.16.1.1 8000 REJECTED
- 15.
- 16. Kubernetes networking IPs areroutable ⢠vs docker default private IP Pods can reach each other without NAT ⢠even across nodes No brokering of port numbers ⢠too complex, why bother? This is a fundamental requirement ⢠can be L3 routed ⢠can be underlayed (cloud) ⢠can be overlayed (SDN)
- 17.
- 18.
- 19. Kubernetes networking On GCE/GKE â˘GCE Advanced Routes (program the fabric) ⢠âEverything to 10.1.1.0/24, send to this VMâ Plenty of other ways ⢠AWS: Route Tables ⢠Weave ⢠Calico ⢠Flannel ⢠OVS ⢠OpenContrail ⢠Cisco Contiv ⢠Others...
- 20. Kubernetes networking On GCE/GKE â˘GCE Advanced Routes (program the fabric) ⢠âEverything to 10.1.1.0/24, send to this VMâ Plenty of other ways ⢠AWS: Route Tables ⢠Weave ⢠Calico ⢠Flannel ⢠OVS ⢠OpenContrail ⢠Cisco Contiv ⢠Others...
- 21. Kubernetes networking On GCE/GKE â˘GCE Advanced Routes (program the fabric) ⢠âEverything to 10.1.1.0/24, send to this VMâ Plenty of other ways ⢠AWS: Route Tables ⢠Weave ⢠Calico ⢠Flannel ⢠OVS ⢠OpenContrail ⢠Cisco Contiv ⢠Others...
- 22.
- 23. Pods Small group ofcontainers & volumes Tightly coupled The atom of scheduling & placement Shared namespaces ⢠share IP address & localhost ⢠share IPC, etc. Managed lifecycle ⢠bound to a node, restart in place ⢠can die, cannot be reborn with same ID Example: data puller & web server Consumers Content Manager File Puller Web Server Volume Pod
- 24. Pods Small group ofcontainers & volumes Tightly coupled The atom of scheduling & placement Shared namespaces ⢠share IP address & localhost ⢠share IPC, etc. Managed lifecycle ⢠bound to a node, restart in place ⢠can die, cannot be reborn with same ID Example: data puller & web server 10.1.1.2
- 25. Pods Small group ofcontainers & volumes Tightly coupled The atom of scheduling & placement Shared namespace ⢠share IP address & localhost ⢠share IPC, etc. Managed lifecycle ⢠bound to a node, restart in place ⢠can die, cannot be reborn with same ID Example: data puller & web server c1 --net=container:infra --ipc=container:infra infra 10.1.1.2 c2 --net=container:infra --ipc=container:infra
- 26.
- 27. Services A group ofpods that work together ⢠grouped by a selector Defines access policy ⢠âload balancedâ or âheadlessâ Gets a stable virtual IP and port ⢠sometimes called the service portal ⢠also a DNS name VIP is managed by kube-proxy ⢠watches all services ⢠updates iptables when backends change Hides complexity - ideal for non-native apps Client Virtual IP
- 28.
- 29.
- 30.
- 31. iptables kube-proxy iptables kube-proxy apiserver NodeX watch services & endpoints
- 32. iptables kube-proxy iptables kube-proxy apiserver NodeX kubectl run ... watch
- 33. iptables kube-proxy iptables kube-proxy apiserver NodeX schedule watch
- 34. iptables kube-proxy iptables kube-proxy apiserver NodeX watch kubectl expose ...
- 35. iptables kube-proxy iptables kube-proxy apiserver NodeX new service! update
- 36. iptables kube-proxy iptables kube-proxy apiserver NodeX watch configure
- 37.
- 38. iptables kube-proxy iptables kube-proxy apiserver NodeX new endpoints! update VIP
- 39. iptables kube-proxy iptables kube-proxy apiserver NodeX VIP watch configure
- 40.
- 41. iptables kube-proxy iptables kube-proxy apiserver NodeX VIP watch Client
- 42. iptables kube-proxy iptables kube-proxy apiserver NodeX VIP watch Client
- 43. iptables kube-proxy iptables kube-proxy apiserver NodeX VIP watch Client
- 44. iptables kube-proxy iptables kube-proxy apiserver NodeX VIP watch Client
- 45. Services are justan abstraction ⢠Only requirement: route (and maybe load balance) a virtual IP to a set of backends. Kube-proxy is an implementation ⢠Kube-proxy watches apiserver. ⢠iptables is re-configured on changes. There could be other ways ⢠Userspace, iptables, IP Virtual Servers? Services
- 46. DNS Run SkyDNS asa pod in the cluster ⢠kube2sky bridges Kubernetes API -> SkyDNS ⢠Tell kubelets about it (static service IP) Strictly optional, but practically required ⢠LOTS of things depend on it ⢠Probably will become more integrated Or plug in your own! kubernetes kubernetes.default kubernetes.default.svc.cluster.local foo.my-namespace.svc.cluster.local
- 47. DNS Run SkyDNS asa pod in the cluster ⢠kube2sky bridges Kubernetes API -> SkyDNS ⢠Tell kubelets about it (static service IP) Strictly optional, but practically required ⢠LOTS of things depend on it ⢠Probably will become more integrated Or plug in your own! apiserverwatch etcd kube-dns-qxin kube2skyskyDNS
- 48. DNS Run SkyDNS asa pod in the cluster ⢠kube2sky bridges Kubernetes API -> SkyDNS ⢠Tell kubelets about it (static service IP) Strictly optional, but practically required ⢠LOTS of things depend on it ⢠Probably will become more integrated Or plug in your own! nameserver 10.0.0.10 ... /etc/resolv.conf apiserverwatch etcd kube-dns-qxin kube2skyskyDNS
- 49. DNS Run SkyDNS asa pod in the cluster ⢠kube2sky bridges Kubernetes API -> SkyDNS ⢠Tell kubelets about it (static service IP) Strictly optional, but practically required ⢠LOTS of things depend on it ⢠Probably will become more integrated Or plug in your own! nameserver 10.0.0.10 ... /etc/resolv.conf apiserverwatch etcd kube-dns-qxin kube2skyskyDNS 10.0.0.10
- 50. Putting it Together Whathappens when I... $ curl foo.my-namespace Client
- 51. What happens whenI... $ curl foo.my-namespace Putting it Together nameserver 10.0.0.10 ... /etc/resolv.conf Client 10.1.0.1
- 52. 10.1.0.1 Putting it Together Whathappens when I... $ curl foo.my-namespace etcd kube-dns-qxin kube2skyskyDNS 10.0.0.10 foo.my-namespace? Client
- 53. Putting it Together Whathappens when I... $ curl foo.my-namespace etcd kube-dns-qxin kube2skyskyDNS 10.0.0.10 10.0.123.45 Client 10.1.0.1
- 54. Putting it Together Whathappens when I... $ curl foo.my-namespace 10.0.123.45Client 10.1.0.1
- 55. Putting it Together Whathappens when I... $ curl foo.my-namespace Client VIP10.0.123.45 10.1.0.1
- 56. Putting it Together Whathappens when I... $ curl foo.my-namespace Client VIP10.0.123.45 iptables 10.1.0.1
- 57. Putting it Together Whathappens when I... $ curl foo.my-namespace Client VIP10.0.123.45 iptables 10.1.0.1 10.1.0.6 10.1.3.1 10.1.6.3
- 58. Putting it Together Whathappens when I... $ curl foo.my-namespace Client VIP10.0.123.45 iptables 10.1.3.1 10.1.0.1 10.1.0.6 10.1.3.1 10.1.6.3
- 59. Putting it Together Whathappens when I... $ curl foo.my-namespace Client VIP10.0.123.45 iptables 10.1.3.1 10.1.0.1 10.1.0.6 10.1.3.1 10.1.6.3 10.1.3.0/24 -> Node X
- 60. Putting it Together Whathappens when I... $ curl foo.my-namespace Client VIP10.0.123.45 iptables 10.1.3.1 10.1.0.1 10.1.0.6 10.1.3.1 10.1.6.3
- 61. Putting it Together Whathappens when I... $ curl foo.my-namespace Client VIP10.0.123.45 iptables 10.1.3.1 10.1.0.1 10.1.0.6 10.1.3.1 10.1.6.3 Hello World!
- 62. Putting it Together Whathappens when I... $ curl foo.my-namespace Client iptables Hello World! 10.1.0.1 10.1.0.6 10.1.3.1 10.1.6.3 10.1.0.1
- 63. Putting it Together Whathappens when I... $ curl foo.my-namespace Client iptables Hello World! 10.1.0.1 10.1.0.6 10.1.3.1 10.1.6.3 10.1.0.0/24 -> Node Y 10.1.0.1
- 64. Putting it Together Whathappens when I... $ curl foo.my-namespace Client iptables Hello World! 10.1.0.1 10.1.0.6 10.1.3.1 10.1.6.3 10.1.0.0/24 -> Node Y 10.1.0.1
- 65. Putting it Together Whathappens when I... $ curl foo.my-namespace Hello World! Client iptables Hello World! 10.1.0.1 10.1.0.6 10.1.3.1 10.1.6.3 10.1.0.0/24 -> Node Y 10.1.0.1
- 66.
- 67. External Services Services IPsare only available inside the cluster Need to receive traffic from âthe outside worldâ Builtin: Service âtypeâ ⢠nodePort: expose on a port on every node ⢠loadBalancer: provision a cloud load-balancer DiY load-balancer solutions ⢠socat (for nodePort remapping) ⢠haproxy ⢠nginx
- 68.
- 69. Ingress (L7) Services areassumed L3/L4 Lots of apps want HTTP/HTTPS Ingress maps incoming traffic to backend services ⢠by HTTP host headers ⢠by HTTP URL paths HAProxy and GCE implementations With SSL now! Status: BETA in Kubernetes v1.2 URL Map Client
- 70. Ingress (L7) Services areassumed L3/L4 Lots of apps want HTTP/HTTPS Ingress maps incoming traffic to backend services ⢠by HTTP host headers ⢠by HTTP URL paths HAProxy and GCE implementations With SSL now! Status: BETA in Kubernetes v1.2 URL Map Client api.company.com api.company.com/foo api.company.com/bar othercompany.com/*
- 71.
- 72. Network Plugins Introduced inKubernetes v1.0 ⢠VERY experimental Uses CNI (CoreOS) in v1.1 ⢠Simple exec interface ⢠Not using Docker libnetwork ⢠but can defer to Docker for networking Cluster admins can customize their installs ⢠DHCP, MACVLAN, Flannel, custom net Plugin Plugin Plugin
- 73. Google Cloud Platform NetworkIsolation
- 74. Google Cloud Platform NetworkIsolation Describe the DAG of your app, enforce it in the network Restrict Pod-to-Pod traffic or across Namespaces Designed by the network SIG ⢠implementations for Calico, OpenShift, Romana, OpenContrail (so far) Status: Alpha in v1.2, expect beta in v1.3
- 75. Kubernetes is Open -open community - open design - open source - open to ideas Networking is Hard - help guide us! http://kubernetes.io https://github.com/kubernetes/kubernetes slack: kubernetes twitter: @kubernetesio
- 76. iptables kube-proxy MeanLatency contrib/for-tests/netperf-tester --number=1000 Mean Latency Microseconds iptables kube-proxy legacy kube-proxy