Kubernetes 网络基础知识
01
Network namespace
ip netns helpUsage: ip netns list ip netns add NAME ip netns set NAME NETNSID ip [-all] netns delete [NAME] ip netns identify [PID] ip netns pids NAME ip [-all] netns exec [NAME] cmd ... ip netns monitor ip netns list-idip netns add ns1ip netns exec ns1 ip a# 输出：1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00#define _GNU_SOURCE#include <sys/*.h>#include <sys/wait.h>#include <stdio.h>#include <sched.h>#include <signal.h>#include <unistd.h>
/* 定义一个给 clone 用的栈，栈大小1M */#define STACK_SIZE (1024 * 1024)static char container_stack[STACK_SIZE];
char* const container_args[] = { "/bin/bash", NULL};
int container_main(void* arg){ printf("Container - inside the container!\n"); /* 直接执行一个shell，以便我们观察这个进程空间里的资源是否被隔离了 */ execv(container_args[], container_args); printf("Something's wrong!\n"); return 1;}
int main(){ printf("Parent - start a container!\n"); /* 启用CLONE_NEWNET Namespace隔离 */ int container_pid = clone(container_main, container_stack+STACK_SIZE, CLONE_NEWNET | SIGCHLD, NULL); waitpid(container_pid, NULL, ); printf("Parent - container stopped!\n"); return ;}unshare()：使某进程脱离某个namespace setns()：把某进程加入到某个namespace
02
Veth pair
# 创建两个 network namespace[root@k8s01 ~]# ip netns add ns1[root@k8s01 ~]# ip netns add ns2[root@k8s01 ~]# ip netns listns2ns1[root@k8s01 ~]# ip link list1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:002: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000 link/ether 00:1c:42:d0:c4:38 brd ff:ff:ff:ff:ff:ff3: virbr0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN mode DEFAULT group default qlen 1000 link/ether 52:54:00:1f:ac:76 brd ff:ff:ff:ff:ff:ff4: virbr0-nic: <BROADCAST,MULTICAST> mtu 1500 qdisc pfifo_fast master virbr0 state DOWN mode DEFAULT group default qlen 1000 link/ether 52:54:00:1f:ac:76 brd ff:ff:ff:ff:ff:ff5: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN mode DEFAULT group default link/ether 02:42:5f:2d:6b:22 brd ff:ff:ff:ff:ff:ff[root@k8s01 ~]# ip link add veth1 type veth peer name veth2[root@k8s01 ~]# ip link list1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:002: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000 link/ether 00:1c:42:d0:c4:38 brd ff:ff:ff:ff:ff:ff3: virbr0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN mode DEFAULT group default qlen 1000 link/ether 52:54:00:1f:ac:76 brd ff:ff:ff:ff:ff:ff4: virbr0-nic: <BROADCAST,MULTICAST> mtu 1500 qdisc pfifo_fast master virbr0 state DOWN mode DEFAULT group default qlen 1000 link/ether 52:54:00:1f:ac:76 brd ff:ff:ff:ff:ff:ff5: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN mode DEFAULT group default link/ether 02:42:5f:2d:6b:22 brd ff:ff:ff:ff:ff:ff8: veth2@veth1: <BROADCAST,MULTICAST,M-DOWN> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000 link/ether 32:39:60:2d:fd:09 brd ff:ff:ff:ff:ff:ff9: veth1@veth2: <BROADCAST,MULTICAST,M-DOWN> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000 link/ether fe:a1:45:64:c6:b6 brd ff:ff:ff:ff:ff:ff[root@k8s01 ~]# ip netns exec ns1 ip link list1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN mode DEFAULT group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00[root@k8s01 ~]# ip link set veth1 netns ns1[root@k8s01 ~]# ip netns exec ns1 ip link list1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN mode DEFAULT group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:009: veth1@if8: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000 link/ether fe:a1:45:64:c6:b6 brd ff:ff:ff:ff:ff:ff link-netnsid [root@k8s01 ~]# ip link set veth2 netns ns2[root@k8s01 ~]# ip netns exec ns2 ip link list1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN mode DEFAULT group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:008: veth2@if9: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000 link/ether 32:39:60:2d:fd:09 brd ff:ff:ff:ff:ff:ff link-netnsid [root@k8s01 ~]# ip netns exec ns1 ip a add 10.1.1.1/24 dev veth1[root@k8s01 ~]# ip netns exec ns1 ip a 1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:009: veth1@if8: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000 link/ether fe:a1:45:64:c6:b6 brd ff:ff:ff:ff:ff:ff link-netnsid 1 inet 10.1.1.1/24 scope global veth1 valid_lft forever preferred_lft forever[root@k8s01 ~]# ip netns exec ns2 ip a add 10.1.1.2/24 dev veth2[root@k8s01 ~]# ip netns exec ns2 ip a 1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:008: veth2@if9: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000 link/ether 32:39:60:2d:fd:09 brd ff:ff:ff:ff:ff:ff link-netnsid inet 10.1.1.2/24 scope global veth2 valid_lft forever preferred_lft forever[root@k8s01 ~]# ip netns exec ns1 ping 10.1.1.2connect: Network is unreachable[root@k8s01 ~]# ip netns exec ns1 ip link set dev veth1 up[root@k8s01 ~]# ip netns exec ns2 ip link set dev veth2 up[root@k8s01 ~]# ip netns exec ns1 ping 10.1.1.2PING 10.1.1.2 (10.1.1.2) 56(84) bytes of data.64 bytes from 10.1.1.2: icmp_seq=1 ttl=64 time=.076 ms64 bytes from 10.1.1.2: icmp_seq=2 ttl=64 time=.070 ms64 bytes from 10.1.1.2: icmp_seq=3 ttl=64 time=.065 ms^C--- 10.1.1.2 ping statistics ---3 packets transmitted, 3 received, % packet loss, time 1999msrtt min/avg/max/mdev = 0.065/0.070/0.076/0.008 ms[root@k8s01 ~]# ip netns exec ns2 ping 10.1.1.1PING 10.1.1.1 (10.1.1.1) 56(84) bytes of data.64 bytes from 10.1.1.1: icmp_seq=1 ttl=64 time=.063 ms64 bytes from 10.1.1.1: icmp_seq=2 ttl=64 time=.076 ms64 bytes from 10.1.1.1: icmp_seq=3 ttl=64 time=.071 ms^C--- 10.1.1.1 ping statistics ---3 packets transmitted, 3 received, % packet loss, time 2000msrtt min/avg/max/mdev = 0.063/0.070/0.076/0.005 ms# 查找对端所在ns[root@k8s01 ~]# ip netns exec ns2 ip link show veth28: veth2@if9: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000 link/ether 32:39:60:2d:fd:09 brd ff:ff:ff:ff:ff:ff link-netnsid [root@k8s01 ~]# ip netns exec ns1 ip link show veth19: veth1@if8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000 link/ether fe:a1:45:64:c6:b6 brd ff:ff:ff:ff:ff:ff link-netnsid 1[root@k8s01 ~]# ip netns list-idnsid (iproute2 netns name: ns1)nsid 1 (iproute2 netns name: ns2)
# 查找对端设备[root@k8s01 ~]# ip netns exec ns1 ethtool -S veth1NIC statistics: peer_ifindex: 8[root@k8s01 ~]# ip netns exec ns2 ip link list | grep 88: veth2@if9: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 100003
Bridge
[root@k8s01 ~]# brctl addbr br0[root@k8s01 ~]# brctl showbridge name bridge id STP enabled interfacesbr0 8000.000000000000 no docker0 8000.02425f2d6b22 no virbr0 8000.5254001fac76 yes virbr0-nic[root@k8s01 ~]# ip netns add ns1[root@k8s01 ~]# ip netns add ns2[root@k8s01 ~]# ip netns add ns3[root@k8s01 ~]# ip netns listns3ns2ns1[root@k8s01 ~]# ip link add veth1 type veth peer name veth-ns1[root@k8s01 ~]# ip link add veth2 type veth peer name veth-ns2[root@k8s01 ~]# ip link add veth3 type veth peer name veth-ns3[root@k8s01 ~]# ip link list...10: br0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000 link/ether 4e:ae:91:1d:14:23 brd ff:ff:ff:ff:ff:ff11: veth-ns1@veth1: <BROADCAST,MULTICAST,M-DOWN> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000 link/ether a6:c7:1b:06:95:15 brd ff:ff:ff:ff:ff:ff12: veth1@veth-ns1: <BROADCAST,MULTICAST,M-DOWN> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000 link/ether de:15:f0:62:e0:f1 brd ff:ff:ff:ff:ff:ff13: veth-ns2@veth2: <BROADCAST,MULTICAST,M-DOWN> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000 link/ether 66:72:7c:0e:43:dd brd ff:ff:ff:ff:ff:ff14: veth2@veth-ns2: <BROADCAST,MULTICAST,M-DOWN> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000 link/ether 76:a8:93:6e:8e:5c brd ff:ff:ff:ff:ff:ff15: veth-ns3@veth3: <BROADCAST,MULTICAST,M-DOWN> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000 link/ether c6:3d:78:1b:dd:f2 brd ff:ff:ff:ff:ff:ff16: veth3@veth-ns3: <BROADCAST,MULTICAST,M-DOWN> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000 link/ether 3a:6e:8c:13:47:c6 brd ff:ff:ff:ff:ff:ff[root@k8s01 ~]# ip link set veth1 netns ns1[root@k8s01 ~]# ip link set veth2 netns ns2[root@k8s01 ~]# ip link set veth3 netns ns3[root@k8s01 ~]# ip link list...10: br0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000 link/ether 4e:ae:91:1d:14:23 brd ff:ff:ff:ff:ff:ff11: veth-ns1@if12: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000 link/ether a6:c7:1b:06:95:15 brd ff:ff:ff:ff:ff:ff link-netnsid 13: veth-ns2@if14: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000 link/ether 66:72:7c:0e:43:dd brd ff:ff:ff:ff:ff:ff link-netnsid 115: veth-ns3@if16: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000 link/ether c6:3d:78:1b:dd:f2 brd ff:ff:ff:ff:ff:ff link-netnsid 2[root@k8s01 ~]# ip netns exec ns1 ip link set lo up[root@k8s01 ~]# ip netns exec ns2 ip link set lo up[root@k8s01 ~]# ip netns exec ns3 ip link set lo up[root@k8s01 ~]# ip netns exec ns1 ip link set veth1 up[root@k8s01 ~]# ip netns exec ns2 ip link set veth2 up[root@k8s01 ~]# ip netns exec ns3 ip link set veth3 up[root@k8s01 ~]# ip netns exec ns1 ip addr add 10.0.0.1/24 dev veth1[root@k8s01 ~]# ip netns exec ns2 ip addr add 10.0.0.2/24 dev veth2[root@k8s01 ~]# ip netns exec ns3 ip addr add 10.0.0.3/24 dev veth3[root@k8s01 ~]# brctl addif br0 veth-ns1[root@k8s01 ~]# brctl addif br0 veth-ns2[root@k8s01 ~]# brctl addif br0 veth-ns3[root@k8s01 ~]# ip link set veth-ns1 up[root@k8s01 ~]# ip link set veth-ns2 up[root@k8s01 ~]# ip link set veth-ns3 up[root@k8s01 ~]# ip link set br0 up# 关闭 ip link set br0 down[root@k8s01 ~]# ip netns exec ns1 ping 10.0.0.2PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data.64 bytes from 10.0..2: icmp_seq=1 ttl=64 time=.127 ms64 bytes from 10.0..2: icmp_seq=2 ttl=64 time=.134 ms^C--- 10.0.0.2 ping statistics ---2 packets transmitted, 2 received, % packet loss, time 999msrtt min/avg/max/mdev = 0.127/0.130/0.134/0.011 ms[root@k8s01 ~]# ^C[root@k8s01 ~]# ^C[root@k8s01 ~]# ip netns exec ns2 ping 10.0.0.3PING 10.0.0.3 (10.0.0.3) 56(84) bytes of data.64 bytes from 10.0..3: icmp_seq=1 ttl=64 time=.136 ms64 bytes from 10.0..3: icmp_seq=2 ttl=64 time=.115 ms64 bytes from 10.0..3: icmp_seq=3 ttl=64 time=.118 ms^C--- 10.0.0.3 ping statistics ---3 packets transmitted, 3 received, % packet loss, time 1999msrtt min/avg/max/mdev = 0.115/0.123/0.136/0.009 ms[root@k8s01 ~]# ip netns exec ns1 ping 10.0.0.2PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data.64 bytes from 10.0..2: icmp_seq=1 ttl=64 time=.127 ms64 bytes from 10.0..2: icmp_seq=2 ttl=64 time=.134 ms^C--- 10.0.0.2 ping statistics ---2 packets transmitted, 2 received, % packet loss, time 999msrtt min/avg/max/mdev = 0.127/0.130/0.134/0.011 ms[root@k8s01 ~]# ^C[root@k8s01 ~]# ^C[root@k8s01 ~]# ip netns exec ns2 ping 10.0.0.3PING 10.0.0.3 (10.0.0.3) 56(84) bytes of data.64 bytes from 10.0..3: icmp_seq=1 ttl=64 time=.136 ms64 bytes from 10.0..3: icmp_seq=2 ttl=64 time=.115 ms64 bytes from 10.0..3: icmp_seq=3 ttl=64 time=.118 ms^C--- 10.0.0.3 ping statistics ---3 packets transmitted, 3 received, % packet loss, time 1999msrtt min/avg/max/mdev = 0.115/0.123/0.136/0.009 ms04
Overlay
05
Tunnel
[root@k8s01 ~]# ip netns exec ns1 ping 10.0.0.2PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data.64 bytes from 10.0..2: icmp_seq=1 ttl=64 time=.127 ms64 bytes from 10.0..2: icmp_seq=2 ttl=64 time=.134 ms^C--- 10.0.0.2 ping statistics ---2 packets transmitted, 2 received, % packet loss, time 999msrtt min/avg/max/mdev = 0.127/0.130/0.134/0.011 ms[root@k8s01 ~]# ^C[root@k8s01 ~]# ^C[root@k8s01 ~]# ip netns exec ns2 ping 10.0.0.3PING 10.0.0.3 (10.0.0.3) 56(84) bytes of data.64 bytes from 10.0..3: icmp_seq=1 ttl=64 time=.136 ms64 bytes from 10.0..3: icmp_seq=2 ttl=64 time=.115 ms64 bytes from 10.0..3: icmp_seq=3 ttl=64 time=.118 ms^C--- 10.0.0.3 ping statistics ---3 packets transmitted, 3 received, % packet loss, time 1999msrtt min/avg/max/mdev = 0.115/0.123/0.136/0.009 msipip：即IPv4 in IPv4，在IPv4报文的基础上封装一个IPv4报文； GRE：即通用路由封装（Generic Routing Encapsulation），定义了在任意一种网络层协议上封装其他任意一种网络层协议的机制，适用于IPv4和IPv6； sit：和ipip类似，不同的是sit用IPv4报文封装IPv6报文，即IPv6 over IPv4； ISATAP：即站内自动隧道寻址协议（Intra-Site Automatic Tunnel Addressing Protocol），与sit类似，也用于IPv6的隧道封装； VTI：即虚拟隧道接口（Virtual Tunnel Interface），是思科提出的一种IPSec隧道技术。
# 查询是否加载了ipip模块，没有的话使用modprobe ipip加载[root@MiWiFi-R3P-srv ~]# lsmod | grep ipipipip 13465 tunnel4 13252 1 ipipip_tunnel 25163 1 ipip
# node1操作# 创建ipip设备，名为ipip2# underlay 网卡为eth0，对端地址为 192.168.31.191，本机为 192.168.31.132ip tunnel add tun0 mode ipip remote 192.168.31.191 local 192.168.31.132 dev eth0# 启动ip link set tun0 up# 设置隧道内层ipip addr add 100.0.0.2 peer 100.0.0.3 dev tun0
# node2操作ip tunnel add tun0 mode ipip remote 192.168.31.132 local 192.168.31.191 dev eth0ip link set tun0 upip addr add 100.0.0.3 peer 100.0.0.2 dev tun0
# 验证，node1ping 100.0.0.306
VxLAN
A framework for overlaying virtualized layer 2 networks over lay 3 networks.# id: VxLan的id标识，需要与对端相同# dev: bond1.1810 实验主机的underlay网卡ip link add vxlan1 type vxlan id 100 dstport 4789 remote 100.73.10.36 local 100.73.10.31 dev bond1.1810ip link set vxlan1 upip addr add 10.10.10.2/24 dev vxlan1
ip link add vxlan1 type vxlan id 100 dstport 4789 remote 100.73.10.31 local 100.73.10.36 dev bond1.1810ip link set vxlan1 upip addr add 10.10.10.3/24 dev vxlan1
# 测试ping 10.10.10.3# 100.73.10.31节点ip link add vxlan0 type vxlan id 88 dstport 4788 remote 100.73.10.36 local 100.73.10.31 dev bond1.1810ip link add br0 type bridgeip link set vxlan0 master br0#避免影响宿主机，通过vrf隔离root network namespaceip link add vrf0 type vrf table 10 ip link set br0 master vrf0ip link set vxlan0 upip link set br0 upip link set vrf0 upip netns add ns0ip link add veth0 type veth peer name eth0 netns ns0ip link set veth0 master br0ip link set veth0 upip -n ns0 link set lo upip -n ns0 addr add 172.66.1.2/24 dev eth0ip -n ns0 link set eth0 up
# 100.73.10.36ip link add vxlan0 type vxlan id 88 dstport 4788 remote 100.73.10.31 local 100.73.10.36 dev bond1.1810ip link add br0 type bridgeip link set vxlan0 master br0ip link add vrf0 type vrf table 10ip link set br0 master vrf0ip link set vxlan0 upip link set br0 upip link set vrf0 upip netns add ns0ip link add veth0 type veth peer name eth0 netns ns0ip link set veth0 master br0ip link set veth0 upip -n ns0 link set lo upip -n ns0 addr add 172.66.1.3/24 dev eth0ip -n ns0 link set eth0 up相关文章