k8s的兩種網絡方案與多種工作模式
1. Flannel:
flannel有三種工作模式:
1. vxlan(隧道方案) 2. host-gw(路由方案)
2. udp(在使用者态實作的資料封裝解封裝,由于性能較差已經被棄用)
vxlan模式:
vxlan模式會在目前伺服器中建立一個cni0的網橋,和flannel.1隧道端點. 這個隧道端點會對資料包進行再次封裝.然後flannel會把資料包傳輸到目标節點中.同時它也會在本地建立幾個路由表.(可以通過指令 ip route 檢視到)
[root@k8s-master1 ~]# ip route
default via 10.0.0.254 dev eth0
10.0.0.0/24 dev eth0 proto kernel scope link src 10.0.0.63
10.244.1.0/24 via 10.244.1.0 dev flannel.1 onlink
10.244.2.0/24 via 10.244.2.0 dev flannel.1 onlink
169.254.0.0/16 dev eth0 scope link metric 1002
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 1.1 Flannel網絡部署與解除安裝:
1. 安裝flannel網絡:
wget https://www.chenleilei.net/soft/k8s/kube-flannel.yaml
kubectl apply -f kube-flannel.yaml
1.1 驗證網絡:
1.1.1 建立一個應用
kubectl create deployment nginx --image=nginx
kubectl expose deployment nginx --port=80 --target-port=80 --type=NodePort
1.1.2 檢查測試:
[root@k8s-master1 ~]# kubectl get pods -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
nginx-f89759699-rcgh2 1/1 Running 0 52s 10.244.2.16 k8s-node2 <none> <none>
1.1.3 測試flannel網絡連通性:
[root@k8s-master1 ~]# ping 10.244.2.16
PING 10.244.2.16 (10.244.2.16) 56(84) bytes of data.
64 bytes from 10.244.2.16: icmp_seq=1 ttl=63 time=0.865 ms
64 bytes from 10.244.2.16: icmp_seq=2 ttl=63 time=0.549 ms
1.1.4 解除安裝flannel網絡:
[root@k8s-master1 ~]# ip route
default via 10.0.0.254 dev eth0
10.0.0.0/24 dev eth0 proto kernel scope link src 10.0.0.63
10.244.1.0/24 via 10.244.1.0 dev flannel.1 onlink # <---flannel網絡
10.244.2.0/24 via 10.244.2.0 dev flannel.1 onlink # <---flannel網絡
169.254.0.0/16 dev eth0 scope link metric 1002
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1
[老師提供方法: 所有伺服器執行]
ip link delete cni0
ip link delete flannel.1
執行後,檢查ip route 檢視是否有路由表,flannel網絡已經不存在.
[root@k8s-master1 ~]# ip link delete cni0
Cannot find device "cni0"
[root@k8s-master1 ~]# ip link delete flannel.1
[root@k8s-master1 ~]# ip route
default via 10.0.0.254 dev eth0
10.0.0.0/24 dev eth0 proto kernel scope link src 10.0.0.63
169.254.0.0/16 dev eth0 scope link metric 1002
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1
1.1.5 測試
[root@k8s-master1 ~]# kubectl get pods -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
nginx-f89759699-rcgh2 1/1 Running 0 23m 10.244.2.16 k8s-node2 <none> <none>
[root@k8s-master1 ~]# ping 10.244.2.16
PING 10.244.2.16 (10.244.2.16) 56(84) bytes of data.
^C
--- 10.244.2.16 ping statistics ---
68 packets transmitted, 0 received, 100% packet loss, time 68199ms
此時,沒有flannel網絡的情況下,nginx的這個pod已經無法通路.
在解除安裝網絡插件時無法删除可以使用 --grace-period=0 --force
如:
kubectl delete pod coredns-7ff77c879f-5cc29 -n kube-system --grace-period=0 --force 2. Calico網絡部署與解除安裝
calico有2種中作模式:
1. ipip(隧道方案) 2.bgp(路由方案)
注意: 公有雲可能會對路由方案造成影響,并且有的雲主機會禁止路由(bgp)方案,是以有些雲廠商是禁止此實作方式的,因為他會寫入路由表,這樣可能會影響到廠商現有網絡.
路由方案: 對現有網絡有一定的要求,但是他的性能最好,它是直接的路由轉發模式,他不會經過資料包封裝再封裝,沒有網絡消耗.此方案優先選擇,但是也要看廠商是否支援. 它會要求,二層網絡可達
隧道方案: 對現有網絡要求不高,它隻需要三層通信正常基本都可以通信.
calico網絡插件下載下傳:
官方位址:
wget https://docs.projectcalico.org/manifests/calico.yaml
個人網盤位址:
wget https://www.chenleilei.net/soft/k8s/calico.yaml
注意: 安裝calico網絡插件 需要解除安裝 flannel網絡插件.
#解除安裝flannel網絡:
ip link delete cni0
ip link delete flannel.1
kubectl delete -f kube-flannel.yaml
#執行後,檢查ip route 檢視是否有路由表,flannel網絡已經不存在.
[root@k8s-master1 ~]# ip link delete cni0
Cannot find device "cni0"
[root@k8s-master1 ~]# ip link delete flannel.1
[root@k8s-master1 ~]# ip route
default via 10.0.0.254 dev eth0
10.0.0.0/24 dev eth0 proto kernel scope link src 10.0.0.63
169.254.0.0/16 dev eth0 scope link metric 1002
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1
calico配置:
1.預設網段修改:
找到以下内容:
# - name: CALICO_IPV4POOL_CIDR
# value: "192.168.0.0/16"
改為安裝kubernetes時初始化的網段:
- name: CALICO_IPV4POOL_CIDR
value: "10.244.0.0/16"
2. 安裝calico網絡插件 執行yaml
[root@k8s-master1 ~]# kubectl apply -f calico.yaml
configmap/calico-config created
customresourcedefinition.apiextensions.k8s.io/bgpconfigurations.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/bgppeers.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/blockaffinities.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/clusterinformations.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/felixconfigurations.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/globalnetworkpolicies.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/globalnetworksets.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/hostendpoints.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/ipamblocks.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/ipamconfigs.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/ipamhandles.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/ippools.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/kubecontrollersconfigurations.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/networkpolicies.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/networksets.crd.projectcalico.org created
clusterrole.rbac.authorization.k8s.io/calico-kube-controllers created
clusterrolebinding.rbac.authorization.k8s.io/calico-kube-controllers created
clusterrole.rbac.authorization.k8s.io/calico-node created
clusterrolebinding.rbac.authorization.k8s.io/calico-node created
daemonset.apps/calico-node created
serviceaccount/calico-node created
deployment.apps/calico-kube-controllers created
serviceaccount/calico-kube-controllers created
3. 解除安裝calico網絡插件.
[root@k8s-master1 ~]# kubectl delete -f calico.yaml 檢查;
kubectl get pods -o wide -n kube-system
2.1 驗證與日志檢查:
應用建立:
kubectl create deployment nginx --image=nginx
kubectl expose deployment nginx --port=80 --target-port=80 --type=NodePort
日志檢查:
[root@k8s-master1 ~]# kubectl get pods -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
nginx-f89759699-qlckm 1/1 Running 0 95s 10.244.169.130 k8s-node2 <none> <none>
[root@k8s-master1 ~]# curl -I 10.244.169.130
HTTP/1.1 200 OK
Server: nginx/1.19.0
Date: Thu, 18 Jun 2020 12:41:58 GMT
Content-Type: text/html
Content-Length: 612
Last-Modified: Tue, 26 May 2020 15:00:20 GMT
Connection: keep-alive
ETag: "5ecd2f04-264"
Accept-Ranges: bytes
[root@k8s-master1 ~]# kubectl logs nginx-f89759699-qlckm
10.244.36.64 - - [18/Jun/2020:12:47:09 +0000] "GET /favicon.ico HTTP/1.1" 404 555 "http://10.0.0.65:32746/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.106 Safari/537.36" "-"
通路沒有問題,證明calico網絡部署成功. ![k8s系列（十一：執行個體）PV動态供給，configMap，secretsecre：建立pod通過env的方式引用configmap通過挂載存儲卷的方式引用configmap案例secret[圖]](data:image/gif;base64,R0lGODlhAQABAIAAAP///wAAACwAAAAAAQABAAACAkQBADs=)