k8s使用calico網絡

calico是一個安全的 L3 網絡和網絡策略提供者。

calico使用bgp的原因：why bgp not ospf

有關BGP rr的介紹

安裝方式

標準託管安裝（ETCD存儲）

• 需要提前安裝etcd集羣

# 創建calico連接etcd的secret
kubectl create secret generic calico-etcd-secrets \
--from-file=etcd-key=/etc/kubernetes/ssl/kubernetes-key.pem \
--from-file=etcd-cert=/etc/kubernetes/ssl/kubernetes.pem \
--from-file=etcd-ca=/etc/kubernetes/ssl/ca.pem

# 部署
kubectl create -f https://docs.projectcalico.org/v3.0/getting-started/kubernetes/installation/hosted/calico.yaml # rbac
kubectl apply -f https://docs.projectcalico.org/v3.0/getting-started/kubernetes/installation/rbac.yaml

kubeadm 託管部署

依賴

• k8s1.7+
• 沒有其他cni插件(華爲開源的CNI-Genie可以同時運行多個CNI)
• –pod-network-cidr參數需要和calico ip pool保持一致
• –service-cidr 不能和calico ip pool重疊

部署

kubectl apply -f https://docs.projectcalico.org/v3.0/getting-started/kubernetes/installation/hosted/kubeadm/1.7/calico.yaml

Kubernetes 數據存儲託管安裝(不需要etcd)

依賴

• 暫時不支持ipam,推薦使用 host-local ipam與pod cidr結合使用
• 默認使用node-to-node mesh模式
• k8s1.7+
• 配置使用CNI
• controller-manager配置cluster-cidr

部署

# rbac
kubectl create -f https://docs.projectcalico.org/v3.0/getting-started/kubernetes/installation/hosted/rbac-kdd.yaml # 部署
kubectl create -f https://docs.projectcalico.org/v3.0/getting-started/kubernetes/installation/hosted/kubernetes-datastore/calico-networking/1.7/calico.yaml

僅使用網絡策略

kubectl create -f https://docs.projectcalico.org/v3.0/getting-started/kubernetes/installation/hosted/kubernetes-datastore/policy-only/1.7/calico.yaml

canal

canal旨在讓用戶能夠輕鬆地將Calico和flannel網絡作爲一個統一的網絡解決方案進行部署.

kubectl apply -f https://raw.githubusercontent.com/projectcalico/canal/master/k8s-install/1.7/rbac.yaml
kubectl apply -f https://raw.githubusercontent.com/projectcalico/canal/master/k8s-install/1.7/canal.yaml

配置

環境設置

# etcd數據存儲 export ETCD_ENDPOINTS=http://xxx:2379 # k8s數據存儲 export DATASTORE_TYPE=kubernetes KUBECONFIG=~/.kube/config

typha模式

k8s數據存儲模式超過50各節點推薦啓用typha,Typha組件可以幫助Calico擴展到大量的節點，而不會對Kubernetes API服務器造成過度的影響。 修改typha_service_name "none"改爲"calico-typha"。

禁用snat

calicoctl get ipPool -o yaml | sed 's/natOutgoing: true/natOutgoing: false/g' | calicoctl apply -f -

關閉node-to-node mesh (節點網絡全互聯)

cat << EOF
apiVersion: projectcalico.org/v3
kind: BGPConfiguration
metadata:
 name: default
spec:
 logSeverityScreen: Info
 nodeToNodeMeshEnabled: false
 asNumber: 64512
EOF | calicoctl apply -f -

calicoctl node status

創建IP Pool

calicoctl get ippool default-ipv4-ippool -o yaml

配置bird服務

yum install bird
service bird start

cat >> /etc/bird.conf < EOF
log syslog { debug, trace, info, remote, warning, error, auth, fatal, bug };
log stderr all; # Override router ID
router id 172.26.6.1;


filter import_kernel { if ( net != 0.0.0.0/0 ) then {
 accept; }
reject; } # Turn on global debugging of all protocols
debug protocols all; # This pseudo-protocol watches all interface up/down events.
protocol device {
 scan time 2; # Scan interfaces every 2 seconds }

protocol bgp {
 description "172.26.6.2"; local as 64512;
 neighbor 172.26.6.2 as 64512;
 multihop;
 rr client;
 graceful restart; import all; export all; }
protocol bgp {
 description "172.26.6.3"; local as 64512;
 neighbor 172.26.6.3 as 64512;
 multihop;
 rr client;
 graceful restart; import all; export all; }
EOF

IP-IN-IP

calicoctl get ippool default-ipv4-ippool -o yaml > pool.yaml
# 修改Off/Always/CrossSubnet
calicoctl apply -f pool.yaml
例： # 所有工作負載

$ calicoctl apply -f - << EOF
apiVersion: projectcalico.org/v3
kind: IPPool
metadata:
 name: ippool-ipip-1
spec:
 cidr: 192.168.0.0/16
 ipipMode: Always
 natOutgoing: true
EOF

# CrossSubnet

$ calicoctl apply -f - << EOF
apiVersion: projectcalico.org/v3
kind: IPPool
metadata:
 name: ippool-cs-1
spec:
 cidr: 192.168.0.0/16
 ipipMode: CrossSubnet
 natOutgoing: true
EOF


#通過修改配置文件環境變量
CALICO_IPV4POOL_IPIP 參數值 Off, Always, CrossSubnet 如果您的網絡結構執行源/目標地址檢查，並在未識別這些地址時丟棄流量，則可能需要啓用工作負載間流量的IP-in-IP封裝

bgp peer

查看狀態

calicoctl node status

配置全局 bgp peer(rr)

cat << EOF | calicoctl create -f -
apiVersion: projectcalico.org/v3
kind: BGPPeer
metadata:
 name: bgppeer-global-3040
spec:
 peerIP: 172.26.6.1
 asNumber: 64567
EOF

# 刪除
$ calicoctl delete bgpPeer 172.26.6.1

特定 BGP peer

$ cat << EOF | calicoctl create -f -
apiVersion: projectcalico.org/v3
kind: BGPPeer
metadata:
 name: bgppeer-node-aabbff
spec:
 peerIP: aa:bb::ff
 node: node1
 asNumber: 64514
EOF

calicoctl delete bgpPeer aa:bb::ff --scope=node --node=node1
calicoctl get bgpPeer

本文轉自kubernetes中文社區-k8s使用calico網絡