{"id":72308,"date":"2026-02-05T12:06:06","date_gmt":"2026-02-05T04:06:06","guid":{"rendered":"https:\/\/www.wsisp.com\/helps\/72308.html"},"modified":"2026-02-05T12:06:06","modified_gmt":"2026-02-05T04:06:06","slug":"k8s%ef%bc%9acni%e7%bd%91%e7%bb%9c%e6%8f%92%e4%bb%b6flannel%e4%b8%8ecalico","status":"publish","type":"post","link":"https:\/\/www.wsisp.com\/helps\/72308.html","title":{"rendered":"k8s\uff1aCNI\u7f51\u7edc\u63d2\u4ef6flannel\u4e0ecalico"},"content":{"rendered":"

\"\"<\/h3>\n

\u4e00\u3001\u524d\u8a00：<\/h3>\n

1\u3001\u4ec0\u4e48\u662fCNI？<\/h3>\n

\"\"<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0CNI （Container Network Interface，\u5bb9\u5668\u7f51\u7edcAPI\u63a5\u53e3），\u662f\u7531 CoreOS \u63d0\u51fa\u7684\u5bb9\u5668\u7f51\u7edc\u89c4\u8303，\u5b83\u4f7f\u7528\u4e86\u63d2\u4ef6（Plugin）\u6a21\u578b\u521b\u5efa\u5bb9\u5668\u7684\u7f51\u7edc\u6808\u3002<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0CNI\u7528\u4e8e\u8fde\u63a5\u5bb9\u5668\u7ba1\u7406\u7cfb\u7edf\u548c\u7f51\u7edc\u63d2\u4ef6，\u8fd9\u4e3aK8s\u63d0\u4f9b\u7684\u4e00\u79cd\u901a\u7528\u7f51\u7edc\u6807\u51c6\u89c4\u8303，\u56e0\u4e3ak8s\u672c\u8eab\u4e0d\u63d0\u4f9b\u7f51\u7edc\u89e3\u51b3\u65b9\u6848\u3002\u76ee\u524d\u6bd4\u8f83\u77e5\u540d\u7684\u7f51\u7edc\u89e3\u51b3\u65b9\u6848\u6709:<\/p>\n

  • Flannel：\u80fd\u63d0\u4f9bip\u5730\u5740，\u4f46\u4e0d\u652f\u6301\u7f51\u7edc\u7b56\u7565<\/li>\n
  • calico：\u65e2\u63d0\u4f9bip\u5730\u5740，\u53c8\u652f\u6301\u7f51\u7edc\u7b56\u7565<\/li>\n
  • canal：flannel\u548ccalico\u7ed3\u5408，\u901a\u8fc7flannel\u63d0\u4f9bip\u5730\u5740，calico\u63d0\u4f9b\u7f51\u7edc\u7b56\u7565<\/li>\n

    \u4ec0\u4e48\u53eb\u505a\u7f51\u7edc\u7b56\u7565？<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u7f51\u7edc\u7b56\u7565：\u53ef\u4ee5\u8fbe\u5230\u591a\u79df\u6237\u7f51\u7edc\u9694\u79bb，\u53ef\u4ee5\u63a7\u5236\u5165\u7f51\u548c\u51fa\u7f51\u6d41\u91cf，\u5165\u7f51\u548c\u51fa\u7f51ip\u8bbf\u95ee\u7684\u4e00\u79cd\u7b56\u7565<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u7b80\u5355\u6765\u8bf4，CNI \u505a\u4e24\u4ef6\u4e8b，\u5bb9\u5668\u521b\u5efa\u65f6\u7684\u7f51\u7edc\u5206\u914d，\u548c\u5f53\u5bb9\u5668\u88ab\u5220\u9664\u65f6\u91ca\u653e\u7f51\u7edc\u8d44\u6e90\u3002<\/p>\n

    k8s\u901a\u8fc7cni\u914d\u7f6e\u6587\u4ef6\u6765\u51b3\u5b9a\u4f7f\u7528\u4ec0\u4e48cni\u63d2\u4ef6，\u57fa\u672c\u4f7f\u7528\u65b9\u6cd5\u5982\u4e0b：<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u9996\u5148\u5728\u6bcf\u4e2a\u8282\u70b9\u4e0a\u914d\u7f6eCNI\u914d\u7f6e\u6587\u4ef6(\/etc\/cni\/net.d\/xxx.conf)，xxx.conf\u8868\u793a\u67d0\u4e00\u4e2a\u7f51\u7edc\u914d\u7f6e\u6587\u4ef6\u7684\u540d\u79f0<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u5b89\u88c5CNI\u914d\u7f6e\u6587\u4ef6\u4e2d\u6240\u5bf9\u5e94\u7684\u4e8c\u8fdb\u5236\u63d2\u4ef6<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u5728\u8fd9\u4e2a\u8282\u70b9\u521b\u5efaPod\u65f6，kubelet\u5c31\u4f1a\u6839\u636eCNI\u914d\u7f6e\u6587\u4ef6\u8c03\u7528\u5bf9\u5e94\u7684CNI\u63d2\u4ef6\u6765\u5b8c\u6210Pod\u7f51\u7edc\u914d\u7f6e<\/p>\n

    \"\"<\/p>\n

    \n

    2\u3001\u5bb9\u5668\u865a\u62df\u5316\u7f51\u7edc\u65b9\u6848<\/h4>\n

    \u5bb9\u5668\u865a\u62df\u5316\u7f51\u7edc\u65b9\u6848，\u603b\u4f53\u5206\u4e3a2\u79cd\u622a\u7136\u4e0d\u540c\u7684\u53d1\u5c55\u8def\u7ebf：<\/p>\n

    \u57fa\u4e8e\u96a7\u9053<\/h5>\n

    1）\u96a7\u9053\u65b9\u6848\u6700\u5177\u666e\u9002\u6027，\u5728\u4efb\u4f55\u7f51\u7edc\u73af\u5883\u4e0b\u90fd\u53ef\u4ee5\u6b63\u5e38\u5de5\u4f5c，\u8fd9\u4e0e\u5b83\u7684\u539f\u7406\u5bc6\u4e0d\u53ef\u5206\u3002<\/p>\n

    2）\u6700\u5e38\u89c1\u7684\u96a7\u9053\u65b9\u6848\u662fflannel vxlan\u6a21\u5f0f，\u4ee5\u53cacalico\u7684ipip\u6a21\u5f0f\u3002<\/p>\n

    \u4f18\u52bf\/\u52a3\u52bf<\/p>\n

    \u4f18\u52bf\u5c31\u662f\u5bf9\u7269\u7406\u7f51\u7edc\u73af\u5883\u6ca1\u6709\u7279\u6b8a\u8981\u6c42，\u53ea\u8981\u5bbf\u4e3b\u673aIP\u5c42\u53ef\u4ee5\u8def\u7531\u4e92\u901a\u5373\u53ef\u3002<\/p>\n

    \u52a3\u52bf\u5c31\u662f\u6027\u80fd\u5dee，\u8fd9\u9700\u8981\u4ece\u4ee5\u4e0b\u65b9\u9762\u770b：<\/p>\n

    1）\u5c01\u5305\u548c\u89e3\u5305\u8017\u8d39CPU\u6027\u80fd；<\/p>\n

    2）\u989d\u5916\u7684\u5c01\u88c5\u5bfc\u81f4\u5e26\u5bbd\u6d6a\u8d39，\u5927\u7ea6\u670930%\u5de6\u53f3\u7684\u5e26\u5bbd\u635f\u8017；<\/p>\n

    \u57fa\u4e8e\u8def\u7531<\/h5>\n

    1）\u8def\u7531\u65b9\u6848\u6027\u80fd\u6700\u597d，\u539f\u56e0\u662f\u8be5\u65b9\u6848\u4e0d\u9700\u8981\u5c01\u5305\u548c\u89e3\u5305，\u6240\u4ee5\u6ca1\u6709\u96a7\u9053\u65b9\u6848\u7684\u52a3\u52bf，\u7f51\u7edc\u6027\u80fd\u5f88\u597d\u3002<\/p>\n

    2）\u5e38\u89c1\u7684\u8def\u7531\u65b9\u6848\u5305\u62ec\u4e86flannel\u7684host-gw\u6a21\u5f0f，\u4ee5\u53cacalico\u7684bgp\u6a21\u5f0f\u3002<\/p>\n

    \u4f18\u52bf\/\u52a3\u52bf<\/h5>\n

    \u4f18\u52bf\u5c31\u662f\u6ca1\u6709\u5c01\u5305\u548c\u89e3\u5305\u8fc7\u7a0b，\u5b8c\u5168\u57fa\u4e8e\u4e24\u7aef\u5bbf\u4e3b\u673a\u7684\u8def\u7531\u8868\u8fdb\u884c\u8f6c\u53d1\u3002<\/p>\n

    \u52a3\u52bf\u5305\u542b2\u65b9\u9762：<\/h5>\n

    1）\u8981\u6c42\u5bbf\u4e3b\u673a\u5904\u4e8e\u540c\u4e00\u4e2a2\u5c42\u7f51\u7edc\u4e0b，\u4e5f\u5c31\u662f\u8fde\u5728\u4e00\u53f0\u4ea4\u6362\u673a\u4e0a，\u8fd9\u6837\u624d\u80fd\u57fa\u4e8eMAC\u901a\u8baf，\u800c\u4e0d\u9700\u8981\u5728IP\u4e0a\u52a8\u5c01\u5305\/\u89e3\u5305\u7684\u624b\u811a\u3002<\/p>\n

    2）\u8def\u7531\u8868\u81a8\u80c0\u5bfc\u81f4\u6027\u80fd\u964d\u4f4e，\u56e0\u4e3a\u5bbf\u4e3b\u673a\u4e0a\u6bcf\u4e2a\u5bb9\u5668\u9700\u8981\u5728\u672c\u673a\u6dfb\u52a0\u4e00\u6761\u8def\u7531\u89c4\u5219，\u800c\u4e0d\u540c\u5bbf\u4e3b\u673a\u4e4b\u95f4\u9700\u8981\u5e7f\u64ad\u81ea\u5df1\u7684\u7f51\u6bb5\u8def\u7531\u89c4\u5219\u3002<\/p>\n

    \n

    3\u3001Kubernetes\u4e3b\u8981\u5b58\u57284\u79cd\u7c7b\u578b\u7684\u901a\u4fe1:<\/h4>\n
  • container-to-container:\u00a0\u4e00\u4e2aPod\u5185\u5404\u5bb9\u5668\u5171\u4eab\u540c\u4e00\u7f51\u7edc\u540d\u79f0\u7a7a\u95f4，\u5b83\u901a\u5e38\u7531\u6784\u5efaPod\u5bf9\u8c61\u7684\u57fa\u7840\u5bb9\u5668pause\u6240\u63d0\u4f9b\u3002\u56e0\u6b64\u540c\u4e00Pod\u5185\u7684\u5404\u5bb9\u5668\u53ef\u4ee5\u76f4\u63a5\u901a\u8fc7lo\u63a5\u53e3\u5b8c\u6210\u4ea4\u4e92<\/span><\/span>;<\/span><\/span><\/li>\n
  • Pod-to-Pod: Pod\u95f4\u7684\u901a\u4fe1，k8s\u81ea\u8eab\u5e76\u672a\u89e3\u51b3\u8be5\u7c7b\u901a\u4fe1，\u800c\u662f\u501f\u52a9\u4e8eCNI\u63a5\u53e3，\u4ea4\u7ed9\u7b2c\u4e09\u65b9\u89e3\u51b3\u65b9\u6848;CNI\u4e4b\u524d\u7684\u63a5\u53e3\u53ebkubenet;<\/li>\n
  • Service-to-Pod:\u501f\u52a9\u4e8ekube-proxy\u751f\u6210\u7684iptables\u6216ipvs\u89c4\u5219\u5b8c\u6210;<\/li>\n
  • ExternalClients-to-Service:\u5f15\u5165\u96c6\u7fa4\u5916\u90e8\u6d41\u91cf hostPort\u3001hostNletwork\u3001nodeport\/service\u3001loadbalancer\/service\u3001exteralP\/service\u3001Ingress\u3002<\/li>\n
    1）\u5bb9\u5668\u548c\u5bb9\u5668\u4e4b\u95f4\u7684\u7f51\u7edc<\/h5>\n

    \"\"<\/p>\n

    1.\u5728k8s\u4e2d\u6bcf\u4e2aPod\u4e2d\u7ba1\u7406\u7740\u4e00\u7ec4Docker\u5bb9\u5668，\u8fd9\u4e9bDocker\u5bb9\u5668\u5171\u4eab\u540c\u4e00\u4e2a\u7f51\u7edc\u547d\u540d\u7a7a\u95f4\u3002<\/p>\n

    2.Pod\u4e2d\u7684\u6bcf\u4e2aDocker\u5bb9\u5668\u62e5\u6709\u4e0ePod\u76f8\u540c\u7684IP\u548cport\u5730\u5740\u7a7a\u95f4，\u5e76\u4e14\u7531\u4e8e\u4ed6\u4eec\u5728\u540c\u4e00\u4e2a\u7f51\u7edc\u547d\u540d\u7a7a\u95f4，\u4ed6\u4eec\u4e4b\u95f4\u53ef\u4ee5\u901a\u8fc7localhost\u76f8\u4e92\u8bbf\u95ee\u3002<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u4ec0\u4e48\u673a\u5236\u8ba9\u540c\u4e00\u4e2aPod\u5185\u7684\u591a\u4e2adocker\u5bb9\u5668\u76f8\u4e92\u901a\u4fe1\u90a3？\u5176\u5b9e\u662f\u4f7f\u7528Docker\u7684\u4e00\u79cd\u7f51\u7edc\u6a21\u578b：–net=container<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0container\u6a21\u5f0f\u6307\u5b9a\u65b0\u521b\u5efa\u7684Docker\u5bb9\u5668\u548c\u5df2\u7ecf\u5b58\u5728\u7684\u4e00\u4e2a\u5bb9\u5668\u5171\u4eab\u4e00\u4e2a\u7f51\u7edc\u547d\u540d\u7a7a\u95f4，\u800c\u4e0d\u662f\u548c\u5bbf\u4e3b\u673a\u5171\u4eab\u3002\u65b0\u521b\u5efa\u7684Docker\u5bb9\u5668\u4e0d\u4f1a\u521b\u5efa\u81ea\u5df1\u7684\u7f51\u5361\u3001\u914d\u7f6e\u81ea\u5df1\u7684 IP，\u800c\u662f\u548c\u4e00\u4e2a\u6307\u5b9a\u7684\u5bb9\u5668\u5171\u4eab IP\u3001\u7aef\u53e3\u8303\u56f4\u7b49<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u6bcf\u4e2aPod\u5bb9\u5668\u6709\u6709\u4e00\u4e2apause\u5bb9\u5668\u5176\u6709\u72ec\u7acb\u7684\u7f51\u7edc\u547d\u540d\u7a7a\u95f4，\u5728Pod\u5185\u542f\u52a8Docker\u5bb9\u5668\u65f6\u5019\u4f7f\u7528 –net=container\u5c31\u53ef\u4ee5\u8ba9\u5f53\u524dDocker\u5bb9\u5668\u52a0\u5165\u5230Pod\u5bb9\u5668\u62e5\u6709\u7684\u7f51\u7edc\u547d\u540d\u7a7a\u95f4（pause\u5bb9\u5668）<\/p>\n

    \"\"<\/p>\n

    2）Pod\u4e0ePod\u4e4b\u95f4\u7684\u7f51\u7edc（\u540c\u4e00\u4e2aNode\u4e2d\u7684Pod\u4e4b\u95f4\u7684\u901a\u4fe1）<\/h5>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0k8s\u4e2d，\u6bcf\u4e2aPod\u62e5\u6709\u4e00\u4e2aip\u5730\u5740，\u4e0d\u540c\u7684Pod\u4e4b\u95f4\u53ef\u4ee5\u76f4\u63a5\u4f7f\u7528\u8be5ip\u4e0e\u5f7c\u6b64\u8fdb\u884c\u901a\u8baf\u3002<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u5728\u540c\u4e00\u4e2aNode\u4e0a，\u4ecePod\u7684\u89c6\u89d2\u770b，\u5b83\u5b58\u5728\u4e8e\u81ea\u5df1\u7684\u7f51\u7edc\u547d\u540d\u7a7a\u95f4\u4e2d，\u5e76\u4e14\u9700\u8981\u4e0e\u8be5Node\u4e0a\u7684\u5176\u4ed6\u7f51\u7edc\u547d\u540d\u7a7a\u95f4\u4e0a\u7684Pod\u8fdb\u884c\u901a\u4fe1\u3002<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Linux\u4ee5\u592a\u7f51\u6865（Linux Ethernet bridge）\u662f\u4e00\u4e2a\u865a\u62df\u76842\u5c42\u7f51\u7edc\u8bbe\u5907，\u76ee\u7684\u662f\u628a\u591a\u4e2apod\u8fde\u63a5\u8d77\u6765，\u7f51\u6865\u7ef4\u62a4\u4e86\u4e00\u4e2a\u8f6c\u53d1\u8868（MAC\u8868），\u901a\u8fc7\u5b83\u4f20\u8f93\u6570\u636e\u5305\u5e76\u51b3\u5b9a\u662f\u5426\u5c06\u6570\u636e\u5305\u4f20\u9012\u5230\u8fde\u63a5\u5230\u7f51\u6865\u7684\u5176\u4ed6pod\u3002<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u7f51\u6865\u5b9e\u73b0\u4e86ARP\u534f\u8bae\u7528\u6765\u6839\u636e\u7ed9\u5b9a\u7684ip\u5730\u5740\u627e\u5230\u5bf9\u5e94\u673a\u5668\u7684\u6570\u636e\u94fe\u8def\u5c42\u7684mac\u5730\u5740，\u4e00\u5f00\u59cb\u8f6c\u53d1\u8868\u4e3a\u7a7a，\u5f53\u4e00\u4e2a\u6570\u636e\u5e27\u88ab\u7f51\u6865\u63a5\u53d7\u540e，\u7f51\u6865\u4f1a\u5e7f\u64ad\u8be5\u5e27\u5230\u6240\u6709\u7684\u8fde\u63a5\u8bbe\u5907（\u9664\u4e86\u53d1\u9001\u65b9\u8bbe\u5907），\u5e76\u4e14\u628a\u54cd\u5e94\u8fd9\u4e2a\u5e7f\u64ad\u7684\u8bbe\u5907\u8bb0\u5f55\u5230\u8f6c\u53d1\u8868；\u968f\u540e\u53d1\u5f80\u76f8\u540cip\u5730\u5740\u7684\u6d41\u91cf\u4f1a\u76f4\u63a5\u4ece\u8f6c\u53d1\u8868\u67e5\u627e\u6b63\u786e\u7684mac\u5730\u5740，\u7136\u540e\u8f6c\u53d1\u5305\u5230\u5bf9\u5e94\u7684\u8bbe\u5907\u3002<\/p>\n

    \"\"<\/p>\n

    \u4e0a\u56fe\u7684\u4e24\u4e2aPod\u901a\u8fc7veth\u5bf9\u94fe\u63a5\u5230root\u7f51\u7edc\u547d\u540d\u7a7a\u95f4，\u5e76\u4e14\u901a\u8fc7\u7f51\u6865\u8fdb\u884c\u901a\u4fe1\u3002<\/p>\n

    \n

    \u540c\u4e00\u4e2aNode\u4e2d\u7684Pod\u4e4b\u95f4\u7684\u4e00\u6b21\u901a\u4fe1<\/h6>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u9274\u4e8e\u6bcf\u4e2aPod\u6709\u81ea\u5df1\u72ec\u7acb\u7684\u7f51\u7edc\u547d\u540d\u7a7a\u95f4，\u6211\u4eec\u4f7f\u7528\u865a\u62df\u4ee5\u592a\u7f51\u8bbe\u5907\u628a\u591a\u4e2aPod\u7684\u547d\u540d\u7a7a\u95f4\u94fe\u63a5\u5230\u4e86root\u547d\u540d\u7a7a\u95f4，\u5e76\u4e14\u4f7f\u7528\u7f51\u6865\u8ba9\u591a\u4e2aPod\u4e4b\u95f4\u8fdb\u884c\u901a\u4fe1，\u4e0b\u9762\u6211\u4eec\u770b\u5982\u4f55\u5728\u4e24\u4e2apod\u4e4b\u95f4\u8fdb\u884c\u901a\u4fe1:<\/p>\n

    \"\"<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a01.\u901a\u8fc7\u7f51\u6865\u8fd9\u91cc\u628aveth0\u548cveth1\u7ec4\u6210\u4e3a\u4e00\u4e2a\u4ee5\u592a\u7f51，\u4ed6\u4eec\u76f4\u63a5\u662f\u53ef\u4ee5\u76f4\u63a5\u901a\u4fe1\u7684，\u53e6\u5916\u8fd9\u91cc\u901a\u8fc7veth\u5bf9\u8ba9pod1\u7684eth0\u548cveth0\u3001pod2\u7684eth0\u548cveth1\u5173\u8054\u8d77\u6765，\u4ece\u800c\u8ba9pod1\u548cpod2\u76f8\u4e92\u901a\u4fe1\u3002<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a02.Pod 1\u901a\u8fc7\u81ea\u5df1\u9ed8\u8ba4\u7684\u4ee5\u592a\u7f51\u8bbe\u5907eth0\u53d1\u9001\u4e00\u4e2a\u6570\u636e\u5305，eth0\u628a\u6570\u636e\u4f20\u9012\u7ed9veth0,\u6570\u636e\u5305\u5230\u8fbe\u7f51\u6865\u540e，\u7f51\u6865\u901a\u8fc7\u8f6c\u53d1\u8868\u628a\u6570\u636e\u4f20\u9012\u7ed9veth1，\u7136\u540e\u865a\u62df\u8bbe\u5907veth1\u76f4\u63a5\u628a\u5305\u4f20\u9012\u7ed9Pod2\u7f51\u7edc\u547d\u540d\u7a7a\u95f4\u4e2d\u7684\u865a\u62df\u8bbe\u5907eth0.<\/p>\n

    3）\u4e0d\u540cNode\u4e2d\u7684Pod\u4e4b\u95f4\u901a\u4fe1<\/h5>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0k8s\u7f51\u7edc\u6a21\u578b\u9700\u8981\u6bcf\u4e2apod\u5fc5\u987b\u901a\u8fc7ip\u5730\u5740\u53ef\u4ee5\u8fdb\u884c\u8bbf\u95ee，\u6bcf\u4e2apod\u7684ip\u5730\u5740\u603b\u662f\u5bf9\u7f51\u7edc\u4e2d\u7684\u5176\u4ed6pod\u53ef\u89c1，\u5e76\u4e14\u6bcf\u4e2apod\u770b\u5f85\u81ea\u5df1\u7684ip\u4e0e\u522b\u7684pod\u770b\u5f85\u7684\u662f\u4e00\u6837\u7684，\u4e0b\u9762\u6211\u4eec\u770b\u4e0d\u540cNode\u95f4Pod\u5982\u4f55\u4ea4\u4e92<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0k8s\u4e2d\u6bcf\u4e2a\u96c6\u7fa4\u4e2d\u7684\u6bcf\u4e2aNode\u90fd\u4f1a\u88ab\u5206\u914d\u4e86\u4e00\u4e2aCIDR\u5757（\u65e0\u7c7b\u522b\u57df\u95f4\u8def\u7531\u9009\u62e9，\u628a\u7f51\u7edc\u524d\u7f00\u90fd\u76f8\u540c\u7684\u8fde\u7eed\u5730\u5740\u7ec4\u6210\u7684\u5730\u5740\u7ec4\u79f0\u4e3aCIDR\u5730\u5740\u5757）\u7528\u6765\u7ed9\u8be5Node\u4e0a\u7684Pod\u5206\u914dIP\u5730\u5740\u3002(\u4fdd\u8bc1pod\u7684ip\u4e0d\u4f1a\u51b2\u7a81)<\/p>\n

    \u53e6\u5916\u8fd8\u9700\u8981\u628apod\u7684ip\u4e0e\u6240\u5728\u7684nodeip\u5173\u8054\u8d77\u6765<\/p>\n

    \"\"<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a01.\u5982\u4e0a\u56feNode1(host1)\u4e0a\u7684Pod1\u4e0eNode2(host2)\u4e0aPod4\u4e4b\u95f4\u8fdb\u884c\u4ea4\u4e92\u3002<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a02.\u9996\u5148pod1\u901a\u8fc7\u81ea\u5df1\u7684\u4ee5\u592a\u7f51\u8bbe\u5907eth0\u628a\u6570\u636e\u5305\u53d1\u9001\u5230\u5173\u8054\u5230root\u547d\u540d\u7a7a\u95f4\u7684veth0\u4e0a，\u7136\u540e\u6570\u636e\u5305\u88abNode1\u4e0a\u7684\u7f51\u6865\u8bbe\u5907cbr0\u63a5\u6536\u5230，\u7f51\u6865\u67e5\u627e\u8f6c\u53d1\u8868\u53d1\u73b0\u627e\u4e0d\u5230pod4\u7684Mac\u5730\u5740，\u5219\u4f1a\u628a\u5305\u8f6c\u53d1\u5230\u9ed8\u8ba4\u8def\u7531（root\u547d\u540d\u7a7a\u95f4\u7684eth0\u8bbe\u5907），\u7136\u540e\u6570\u636e\u5305\u7ecf\u8fc7eth0\u5c31\u79bb\u5f00\u4e86Node1，\u88ab\u53d1\u9001\u5230\u7f51\u7edc\u3002<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a03.\u6570\u636e\u5305\u5230\u8fbeNode2\u540e，\u9996\u5148\u4f1a\u88abroot\u547d\u540d\u7a7a\u95f4\u7684eth0\u8bbe\u5907，\u7136\u540e\u901a\u8fc7\u7f51\u6865cbr0\u628a\u6570\u636e\u8def\u7531\u5230\u865a\u62df\u8bbe\u5907veth1,\u6700\u7ec8\u6570\u636e\u4f1a\u88ab\u6d41\u8f6c\u5230\u4e0eveth1\u914d\u5bf9\u7684\u53e6\u5916\u4e00\u7aef（pod4\u7684eth0）<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u6bcf\u4e2aNode\u90fd\u77e5\u9053\u5982\u4f55\u628a\u6570\u636e\u5305\u8f6c\u53d1\u5230\u5176\u5185\u90e8\u8fd0\u884c\u7684Pod，\u5f53\u4e00\u4e2a\u6570\u636e\u5305\u5230\u8fbeNode\u540e，\u5176\u5185\u90e8\u6570\u636e\u6d41\u5c31\u548cNode\u5185Pod\u4e4b\u95f4\u7684\u6d41\u8f6c\u7c7b\u4f3c\u4e86\u3002<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u5bf9\u4e8e\u5982\u4f55\u6765\u914d\u7f6e\u7f51\u7edc，k8s\u5728\u7f51\u7edc\u8fd9\u5757\u81ea\u8eab\u5e76\u6ca1\u6709\u5b9e\u73b0\u7f51\u7edc\u89c4\u5212\u7684\u5177\u4f53\u903b\u8f91，\u800c\u662f\u5236\u5b9a\u4e86\u4e00\u5957CNI（Container Network Interface）\u63a5\u53e3\u89c4\u8303，\u5f00\u653e\u7ed9\u793e\u533a\u6765\u5b9e\u73b0\u3002<\/p>\n

    Kubernetes\u8de8\u4e3b\u673a\u5bb9\u5668\u4e4b\u95f4\u7684\u901a\u4fe1\u7ec4\u4ef6，\u76ee\u524d\u4e3b\u6d41\u7684\u662fflannel\u548ccalico\u3002<\/p>\n

    \u6211\u4eec\u5c06\u96c6\u4e2d\u63a2\u7d22\u4e0e\u5bf9\u6bd4\u76ee\u524d\u6700\u6d41\u884c\u7684CNI\u63d2\u4ef6：Flannel\u3001Calico<\/p>\n

    \"\"<\/p>\n

    \n

    \u4e8c\u3001Kubernetes-\u57fa\u4e8eflannel\u7684\u96c6\u7fa4\u7f51\u7edc<\/h3>\n

    Flannel\u5b98\u7f51：<\/span><\/span>https:\/\/github.com\/coreos\/flannel<\/p>\n

    1\u3001Flannel\u7b80\u4ecb<\/h4>\n

    \"\"<\/p>\n

  • Flannel\u662f\u7531CoreOS\u5f00\u6e90\u7684\u9488\u5bf9k8s\u7684\u7f51\u7edc\u670d\u52a1，\u5176\u76ee\u7684\u662f\u4e3a\u89e3\u51b3k8s\u96c6\u7fa4\u4e2d\u5404\u4e3b\u673a\u4e0aPod\u4e4b\u95f4\u7684\u901a\u4fe1\u95ee\u9898，\u5176\u501f\u52a9etcd\u7ef4\u62a4\u7f51\u7edcIP\u5730\u5740\u5206\u914d，\u5e76\u4e3a\u6bcf\u4e2aNode\u8282\u70b9\u5206\u914d\u4e00\u4e2a\u4e0d\u540c\u7684IP\u5730\u5740\u6bb5\u3002\u7b80\u5355\u6765\u8bf4，\u5b83\u7684\u529f\u80fd\u662f\u8ba9\u96c6\u7fa4\u4e2d\u7684\u4e0d\u540c\u8282\u70b9\u4e3b\u673a\u521b\u5efa\u7684Docker\u5bb9\u5668\u90fd\u5177\u6709\u5168\u96c6\u7fa4\u552f\u4e00\u7684\u865a\u62dfIP\u5730\u5740\u3002<\/span><\/span><\/li>\n
  • \u5728\u9ed8\u8ba4\u7684Docker\u914d\u7f6e\u4e2d，\u6bcf\u4e2a\u8282\u70b9\u4e0a\u7684Docker\u670d\u52a1\u4f1a\u5206\u522b\u8d1f\u8d23\u6240\u5728\u8282\u70b9\u5bb9\u5668\u7684IP\u5206\u914d\u3002\u8fd9\u6837\u5bfc\u81f4\u7684\u4e00\u4e2a\u95ee\u9898\u662f，\u4e0d\u540c\u8282\u70b9\u4e0a\u5bb9\u5668\u53ef\u80fd\u83b7\u5f97\u76f8\u540c\u7684IP\u5730\u5740\u3002<\/li>\n
  • Flannel\u7684\u8bbe\u8ba1\u76ee\u7684\u5c31\u662f\u4e3a\u96c6\u7fa4\u4e2d\u7684\u6240\u6709\u8282\u70b9\u91cd\u65b0\u89c4\u5212IP\u5730\u5740\u7684\u4f7f\u7528\u89c4\u5219，\u4ece\u800c\u4f7f\u5f97\u4e0d\u540c\u8282\u70b9\u4e0a\u7684\u5bb9\u5668\u80fd\u591f\u83b7\u5f97\u201c\u540c\u5c5e\u4e00\u4e2a\u5185\u7f51\u201d\u4e14\u201d\u4e0d\u91cd\u590d\u7684\u201dIP\u5730\u5740，\u5e76\u8ba9\u5c5e\u4e8e\u4e0d\u540c\u8282\u70b9\u4e0a\u7684\u5bb9\u5668\u80fd\u591f\u76f4\u63a5\u901a\u8fc7\u5185\u7f51IP\u901a\u4fe1\u3002<\/li>\n
  • Flannel\u5b9e\u8d28\u4e0a\u662f\u4e00\u79cd\u201c\u8986\u76d6\u7f51\u7edc(overlaynetwork)\u201d，\u4e5f\u5c31\u662f\u5c06TCP\u6570\u636e\u5305\u88c5\u5728\u53e6\u4e00\u79cd\u7f51\u7edc\u5305\u91cc\u9762\u8fdb\u884c\u8def\u7531\u8f6c\u53d1\u548c\u901a\u4fe1\u3002<\/li>\n
    \u7b80\u5355\u603b\u7ed3Flannel\u7279\u70b9：<\/h5>\n
  • \u4f7f\u96c6\u7fa4\u4e2d\u7684\u4e0d\u540cNode\u4e3b\u673a\u521b\u5efa\u7684Docker\u5bb9\u5668\u90fd\u5177\u6709\u5168\u96c6\u7fa4\u552f\u4e00\u7684\u865a\u62dfIP\u5730\u5740\u3002<\/li>\n
  • \u5efa\u7acb\u4e00\u4e2a\u8986\u76d6\u7f51\u7edc（overlay network），\u901a\u8fc7\u8fd9\u4e2a\u8986\u76d6\u7f51\u7edc，\u5c06\u6570\u636e\u5305\u539f\u5c01\u4e0d\u52a8\u7684\u4f20\u9012\u5230\u76ee\u6807\u5bb9\u5668\u3002\u8986\u76d6\u7f51\u7edc\u662f\u5efa\u7acb\u5728\u53e6\u4e00\u4e2a\u7f51\u7edc\u4e4b\u4e0a\u5e76\u7531\u5176\u57fa\u7840\u8bbe\u65bd\u652f\u6301\u7684\u865a\u62df\u7f51\u7edc\u3002\u8986\u76d6\u7f51\u7edc\u901a\u8fc7\u5c06\u4e00\u4e2a\u5206\u7ec4\u5c01\u88c5\u5728\u53e6\u4e00\u4e2a\u5206\u7ec4\u5185\u6765\u5c06\u7f51\u7edc\u670d\u52a1\u4e0e\u5e95\u5c42\u57fa\u7840\u8bbe\u65bd\u5206\u79bb\u3002\u5728\u5c06\u5c01\u88c5\u7684\u6570\u636e\u5305\u8f6c\u53d1\u5230\u7aef\u70b9\u540e，\u5c06\u5176\u89e3\u5c01\u88c5\u3002<\/li>\n
  • \u521b\u5efa\u4e00\u4e2a\u65b0\u7684\u865a\u62df\u7f51\u5361flannel0\u63a5\u6536docker\u7f51\u6865\u7684\u6570\u636e，\u901a\u8fc7\u7ef4\u62a4\u8def\u7531\u8868，\u5bf9\u63a5\u6536\u5230\u7684\u6570\u636e\u8fdb\u884c\u5c01\u5305\u548c\u8f6c\u53d1（vxlan）\u3002<\/li>\n
  • etcd\u4fdd\u8bc1\u4e86\u6240\u6709node\u4e0aflannel\u6240\u770b\u5230\u7684\u914d\u7f6e\u662f\u4e00\u81f4\u7684\u3002\u540c\u65f6\u6bcf\u4e2anode\u4e0a\u7684flannel\u76d1\u542cetcd\u4e0a\u7684\u6570\u636e\u53d8\u5316，\u5b9e\u65f6\u611f\u77e5\u96c6\u7fa4\u4e2dnode\u7684\u53d8\u5316\u3002<\/li>\n

    \n

    2\u3001flannel\u652f\u6301\u7684\u8def\u7531\u8f6c\u53d1\u65b9\u5f0f<\/h4>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Flannel\u5728\u6bcf\u4e2a\u8282\u70b9\u8fd0\u884c\u4e00\u4e2a\u540d\u4e3aflanneld\u7684\u4e8c\u8fdb\u5236\u4ee3\u7406\u7a0b\u5e8f，\u5b83\u8d1f\u8d23\u4ece\u9884\u7559\u7684\u7f51\u7edc\u4e2d\u6309\u7167\u6307\u5b9a\u6216\u8005\u9ed8\u8ba4\u7684\u63a9\u7801\u957f\u5ea6\u4e3a\u5f53\u524d\u8282\u70b9\u7533\u8bf7\u5206\u914d\u4e00\u4e2a\u5b50\u7f51，\u5e76\u5c06\u7f51\u7edc\u914d\u7f6e\u3001\u5df2\u5206\u914d\u7684\u5b50\u7f51\u548c\u8f85\u52a9\u6570\u636e（\u6bd4\u5982\u4e3b\u673a\u7684\u516c\u7f51IP\u7b49）\u5b58\u50a8\u5728Kubernetes API\u6216\u72ec\u7acb\u7684etcd\u4e2d\u3002Flannel\u901a\u8fc7\u4e0d\u540c\u7684\u540e\u7aef\u6765\u5b9e\u73b0\u8de8\u8282\u70b9Pod\u95f4\u7684\u901a\u4fe1，Flannel\u652f\u6301\u4e09\u79cdPod\u7f51\u7edc\u6a21\u578b，\u6bcf\u4e2a\u6a21\u578b\u5728flannel\u4e2d\u79f0\u4e3a\u4e00\u79cd"backend"，\u76ee\u524d\u652f\u6301\u7684\u540e\u7aef\u5982\u4e0b：<\/p>\n

    vxlan：<\/h5>\n

    1）vxlan: \u53e0\u52a0\u7f51\u7edc\u6a21\u5f0f，\u5229\u7528\u5185\u6838\u7ea7\u522b\u7684VXLAN\u6765\u5c01\u88c5host\u4e4b\u95f4\u4f20\u9001\u7684\u5305，Pod\u4e0ePod\u7ecf\u7531\u96a7\u9053\u5c01\u88c5\u540e\u901a\u4fe1\u3002\u5404\u8282\u70b9\u5f7c\u6b64\u95f4\u80fd\u901a\u4fe1\u5c31\u884c，\u4e0d\u8981\u6c42\u5728\u540c\u4e00\u4e2a\u4e8c\u5c42\u7f51\u7edc\u3002vxlan\u6a21\u578b\u4e2d，flanneld\u76d1\u542cudp 8472\u7aef\u53e3\u63a5\u53d7\u548c\u53d1\u9001\u5c01\u88c5\u7684\u6570\u636e\u5305; \u7f3a\u70b9:\u7531\u4e8e\u7ecf\u8fc72\u6b21\u5c01\u88c5,\u541e\u5410\u91cf\u76f8\u5bf9\u53d8\u4f4e,\u4f18\u70b9:\u4e0d\u8981\u6c42\u8282\u70b9\u5904\u4e8e\u540c\u4e00\u4e2a2\u5c42\u7f51\u7edc<\/p>\n

    2）vxlan directrouting:\u76f4\u63a5\u8def\u7531\u6a21\u5f0f，\u4f4d\u4e8e\u540c\u4e00\u4e2a\u4e8c\u5c42\u7f51\u7edc\u4e0a\u7684\u3001\u4e0d\u540c\u8282\u70b9\u4e0a\u7684Pod\u95f4\u901a\u4fe1，\u65e0\u987b\u96a7\u9053\u5c01\u88c5，\u901a\u8fc7\u8def\u7531\u6a21\u5f0f\u76f4\u63a5\u53d1\u9001，\u4e5f\u5c31\u662f\u5f53\u5404\u4e2a\u8282\u70b9\u4f4d\u4e8e\u540c\u4e00\u5b50\u7f51\u65f6，\u542f\u7528\u76f4\u63a5\u8def\u7531（\u7c7b\u4f3chost-gw），\u901a\u8fc7\u5bbf\u4e3b\u673a\u7684\u7269\u7406\u7f51\u5361\u901a\u4fe1;\u4f46\u975e\u540c\u4e00\u4e2a\u4e8c\u5c42\u7f51\u7edc\u4e0a\u7684\u8282\u70b9\u4e0a\u7684Pod\u95f4\u901a\u4fe1，\u4ecd\u987b\u96a7\u9053\u5c01\u88c5; \u6700\u4f18\u7684\u65b9\u6848\u3002<\/p>\n

    host-gw：<\/h5>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u7c7b\u4f3c\u4e8eVXLAN\u540e\u7aef\u7684\u76f4\u63a5\u8def\u7531\u6a21\u5f0f，\u4f46\u4e0d\u652f\u6301\u8de8\u4e8c\u5c42\u7f51\u7edc\u7684\u8282\u70b9，\u56e0\u6b64\u8fd9\u79cd\u6a21\u5f0f\u8981\u6c42\u5404\u8282\u70b9\u5904\u4e8e\u540c\u4e00\u4e2a\u4e8c\u5c42\u7f51\u7edc\u4e2d，\u4e0d\u592a\u9002\u7528\u4e8e\u89c4\u6a21\u8f83\u5927\u7684\u73af\u5883，\u4f46\u8f6c\u53d1\u6027\u80fd\u8f83\u597d\u3002<\/p>\n

    udp：<\/h5>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u4f7f\u7528\u5e38\u89c4UDP\u62a5\u6587\u5c01\u88c5\u5b8c\u6210\u96a7\u9053\u8f6c\u53d1，\u6027\u80fd\u6bd4vxlan\u548chost-gw\u76f8\u6bd4\u8f83\u5dee，\u4ec5\u5728\u4e0d\u652f\u6301vxlan\u548chost-gw\u65f6\u4f7f\u7528；UDP\u540e\u7aef\u6a21\u5f0f\u4e2d，flanneld\u76d1\u542cUDP 8285\u7aef\u53e3\u53d1\u9001\u62a5\u6587\u3002<\/p>\n

    3\u3001\u793a\u4f8b1: \u90e8\u7f72flannel \u4ee5Vxlan\u7c7b\u578b\u8fd0\u884c<\/h4>\n

    \u67e5\u770bflannel\u90e8\u7f72\u6e05\u5355yaml\u6587\u4ef6\u4e2d\u6709\u5173\u4e8e\u7f51\u7edc\u7c7b\u578b\u7684\u63cf\u8ff0<\/p>\n

    [root@k8s-master1 ~]# cat kube-flannel.yml<\/p>\n

    \u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026<\/p>\n

    kind: ConfigMap<\/p>\n

    apiVersion: v1<\/p>\n

    metadata:<\/p>\n

    name: kube-flannel-cfg<\/p>\n

    namespace: kube-system<\/p>\n

    labels:<\/p>\n

    tier: node<\/p>\n

    app: flannel<\/p>\n

    data:<\/p>\n

    cni-conf.json: |<\/p>\n

    {<\/p>\n

    "name": "cbr0",<\/p>\n

    "cniVersion": "0.3.1",<\/p>\n

    "plugins": [<\/p>\n

    {<\/p>\n

    "type": "flannel", #flannel\u865a\u62df\u7f51\u7edc<\/p>\n

    "delegate": {<\/p>\n

    "hairpinMode": true,<\/p>\n

    "isDefaultGateway": true<\/p>\n

    }<\/p>\n

    },<\/p>\n

    {<\/p>\n

    "type": "portmap", #\u7aef\u53e3\u6620\u5c04 \u5982:NodePort<\/p>\n

    "capabilities": {<\/p>\n

    "portMappings": true<\/p>\n

    }<\/p>\n

    }<\/p>\n

    ]<\/p>\n

    }<\/p>\n

    net-conf.json: |<\/p>\n

    {<\/p>\n

    "Network": "10.244.0.0\/16",<\/p>\n

    "Backend": {<\/p>\n

    "Type": "vxlan" #\u9ed8\u8ba4\u4e3avxlan\u6a21\u5f0f<\/p>\n

    }<\/p>\n

    }<\/p>\n

    \u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026 <\/p>\n

    \u5982\u4e0a\u6240\u793a，\u5176\u914d\u7f6e\u662fjson\u683c\u5f0f，\u5e38\u7528\u7684\u952e\u6709\u5982\u4e0b\u51e0\u4e2a：<\/h5>\n
  • Network：Flannel\u5168\u5c40\u4f7f\u7528\u7684\u5b50\u7f51，\u5373pod cidr\u7684\u503c<\/li>\n
  • SubnetLen：\u5b50\u7f51\u5206\u5272\u7684\u957f\u5ea6，\u5728\u5168\u5c40\u5b50\u7f51\u63a9\u7801\u5c0f\u4e8e24\u65f6（\u4f8b\u598216），\u9ed8\u8ba4\u4e3a24<\/li>\n
  • SubnetMin：\u5206\u914d\u7ed9\u8282\u70b9\u4f7f\u7528\u7684\u8d77\u59cb\u5b50\u7f51，\u9ed8\u8ba4\u4e3a\u5207\u5272\u5b8c\u6210\u540e\u7684\u7b2c\u4e00\u4e2a\u5b50\u7f51<\/li>\n
  • SubnetMax：\u5206\u7ed9\u7ed9\u8282\u70b9\u4f7f\u7528\u7684\u6700\u5927\u5b50\u7f51，\u9ed8\u8ba4\u4e3a\u5207\u5272\u5b8c\u6210\u540e\u7684\u6700\u540e\u4e00\u4e2a\u5b50\u7f51<\/li>\n
  • Backend：Flannel\u4f7f\u7528\u7684\u540e\u7aef，\u4ee5\u53ca\u540e\u7aef\u7684\u914d\u7f6e<\/li>\n

    \u53e6\u5916，flannel\u8fd8\u4f1a\u5728\u8fd0\u884c\u7684\u8282\u70b9\u4e0a\u751f\u6210\u4e00\u4e2a\u73af\u5883\u53d8\u91cf\u6587\u4ef6，\u9ed8\u8ba4\u662f\/run\/flannel\/subnet.env，\u5176\u5305\u542b\u672c\u8282\u70b9\u4f7f\u7528\u7684\u5b50\u7f51\u3001mtu\u7b49\u4fe1\u606f\u3002\u4f8b\u5982\u4e0b\u9762\u7684\u793a\u4f8b：<\/p>\n

  • FLANNEL_NETWORK=10.244.0.0\/16 #flannel\u5168\u5c40\u7f51\u6bb5<\/li>\n
  • FLANNEL_SUBNET=10.244.0.1\/24 #\u672c\u8282\u70b9\u5b50\u7f51<\/li>\n
  • FLANNEL_MTU=1450 #\u5bb9\u5668\u63a5\u53e3mtu\u503c<\/li>\n
  • FLANNEL_IPMASQ=true #\u5730\u5740\u6620\u5c04<\/li>\n
    vxlan\u6a21\u5f0f\u4e0b,\u8def\u7531\u8868Pod\u5730\u5740\u6307\u5411flannel.1<\/h5>\n

    [root@k8s-master1 ~]# route -n<\/p>\n

    Kernel IP routing table<\/p>\n

    Destination Gateway Genmask Flags Metric Ref Use Iface<\/p>\n

    0.0.0.0 192.168.211.2 0.0.0.0 UG 100 0 0 ens33<\/p>\n

    10.244.0.0 0.0.0.0 255.255.255.0 U 0 0 0 cni0 #\u672c\u673a\u865a\u62df\u7f51\u7edc\u63a5\u53e3<\/p>\n

    10.244.1.0 10.244.1.0 255.255.255.0 UG 0 0 0 flannel.1<\/p>\n

    10.244.2.0 10.244.2.0 255.255.255.0 UG 0 0 0 flannel.1<\/p>\n

    172.17.0.0 0.0.0.0 255.255.0.0 U 0 0 0 docker0<\/p>\n

    192.168.211.0 0.0.0.0 255.255.255.0 U 10 0 0 ens33<\/p>\n

    [root@k8s-node01 ~]# route -n<\/p>\n

    Kernel IP routing table<\/p>\n

    Destination Gateway Genmask Flags Metric Ref Use Iface<\/p>\n

    0.0.0.0 192.168.211.2 0.0.0.0 UG 100 0 0 ens33<\/p>\n

    10.244.0.0 10.244.0.0 255.255.255.0 UG 0 0 0 flannel.1<\/p>\n

    10.244.1.0 0.0.0.0 255.255.255.0 U 0 0 0 flannel.a <\/p>\n

    10.244.2.0 10.244.2.0 255.255.255.0 UG 0 0 0 flannel.1<\/p>\n

    172.17.0.0 0.0.0.0 255.255.0.0 U 0 0 0 docker0<\/p>\n

    192.168.211.0 0.0.0.0 255.255.255.0 U 100 0 0 ens33<\/p>\n

    #\u6293\u5305flannel\u7f51\u7edc \u5176\u4e2d udp 8472\u4e3aflannel\u7f51\u7edc\u9ed8\u8ba4\u7aef\u53e3<\/p>\n

    [root@k8s-node1 ~]# tcpdump -i ens33 -nn udp port 8472<\/p>\n

    tcpdump: verbose output suppressed, use -v or -vv for full protocol decode<\/p>\n

    listening on eth4, link-type EN10MB (Ethernet), capture size 262144 bytes<\/p>\n

    17:08:15.113389 IP 192.168.211.11.46879 > 192.168.211.12.8472: OTV, flags [I] (0x08), overlay 0, instance 1<\/p>\n

    IP 10.244.1.9 > 10.244.2.5: ICMP echo request, id 2816, seq 61, length 64<\/p>\n

    17:08:15.113498 IP 192.168.211.12.55553 > 192.168.211.11.8472: OTV, flags [I] (0x08), overlay 0, instance 1<\/p>\n

    IP 10.244.2.5 > 10.244.1.9: ICMP echo reply, id 2816, seq 61, length 64<\/p>\n

    \u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026 <\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u53ef\u4ee5\u770b\u523010.244.1.9 > 10.244.2.5 Pod\u95f4\u7684\u4f20\u8f93 \u901a\u8fc7\u5c01\u88c5\u4ece\u8282\u70b9192.168.211.11.46879 \u4f20\u8f93\u5230\u8282\u70b9 192.168.211.12.8472 \u7ecf\u8fc7\u4e00\u5c42\u6570\u636e\u5c01\u88c5<\/p>\n

    Vxlan\u7c7b\u578bPod\u901a\u4fe1\u5206\u6790：<\/h5>\n

    \"\"<\/p>\n

    \u5982\u4e0a\u56fe\u6240\u793a，\u4e24\u4e2aPod\u7684\u901a\u4fe1\u6d41\u7a0b\u5927\u81f4\u5982\u4e0b：<\/h5>\n
    1.\u5728client Pod\u4e0a\u5411nginx Pod\u53d1\u8d77\u8bf7\u6c42，\u56e0\u4e3a\u5b83\u4eec\u4e0d\u5728\u540c\u4e00\u7f51\u6bb5，\u6240\u4ee5\u62a5\u6587\u4f1a\u6839\u636e\u9ed8\u8ba4\u8def\u7531\u5230\u8fbecni0，\u6b64\u65f6<\/h6>\n

    src-ip：10.224.1.9（client-pod） dst-ip：10.224.2.5（nginx-pod）<\/p>\n

    src-mac：1a:d0:98:5f:ff:ce（client-pod） dst-mac：86:8c:53:15:25:d4（cni0）<\/p>\n

    \u5728cni0\u4e0a\u6293\u5305\u5982\u4e0b：<\/span><\/span><\/p>\n

    \"\"<\/p>\n

    2.cni0\u53d1\u73b0\u76ee\u7684\u5730\u5740\u5e76\u975e\u672c\u673aPod\u5730\u5740，\u81ea\u5df1\u4e0d\u80fd\u8f6c\u53d1\u3002\u7136\u540e\u4f1a\u5339\u914d\u4e3b\u673a\u8def\u7531，\u53d1\u73b0\u5230\u8fbe10.244.2.0\/24\u9700\u8981\u901a\u8fc7flannel.1，\u5c06\u62a5\u6587\u8f6c\u7ed9flannel.1<\/h6>\n
    3.flannel.1\u6536\u5230\u62a5\u6587\u540e\u4f1a\u5c06\u5176\u5c01\u88c5\u4e3avxlan\u62a5\u6587\u5185\u5c42\u7684\u6570\u636e\u5e27，\u6b64\u65f6<\/h6>\n

    src-ip：10.224.1.9（client-pod） dst-ip：10.224.2.5（nginx-pod）<\/p>\n

    src-mac：d6:60:8c:f3:ba:37（node-01 flannel.1） dst-mac：4a:4a:ee:b9:cb:2d（node-02 flannel.1）<\/p>\n

    flannel.1\u4e0a\u6293\u5305\u5982\u4e0b：<\/p>\n

    \"\"<\/p>\n

    4.\u00a0\u6700\u540e\u6570\u636e\u5305\u901a\u8fc7\u5185\u6838vxlan\u6a21\u5757\u5c01\u88c5\u6210vxlan\u62a5\u6587，\u7136\u540e\u901a\u8fc7\u8282\u70b9\u7f51\u5361ens33\u53d1\u5f80node-02，\u6b64\u65f6<\/h6>\n

    inner-src-ip：10.224.1.9（client-pod ) inner-dst-ip：10.224.2.5（nginx-pod）<\/p>\n

    inner-src-mac：d6:60:8c:f3:ba:37（node-01 flannel.1） inner-dst-mac：4a:4a:ee:b9:cb:2d（node-02 flannel.1）<\/p>\n

    outer-src-ip：192.168.211.11（node-01 ens33） outer-dst-ip：192.168.211.12（node-02 ens33）<\/p>\n

    outer-src-mac：00:0c:29:51:81:05（node-01 ens33） outer-dst-mac：00:0c:29:99:52:7b192.168.211.12（node-02 ens33）<\/p>\n

    \u5728ens33\u4e0a\u6293\u5305\u5982\u4e0b\u56fe\u6240\u793a：<\/span><\/span><\/p>\n

    \"\"<\/p>\n

    5.node-02\u6536\u5230\u62a5\u6587\u540e\u8fdb\u884cvxlan\u89e3\u5c01\u88c5，\u7136\u540e\u518d\u6309\u7167\u76f8\u53cd\u7684\u987a\u5e8f\u8f6c\u53d1\u5230nginx-pod<\/h6>\n

    \u6b64\u65f6\u8fd8\u5b58\u5728\u4e24\u4e2a\u95ee\u9898：<\/p>\n

    node-01 \u7684flannel.1\u662f\u5982\u4f55\u77e5\u9053node-02\u7684flannel.1\u7684\u5730\u5740\u6765\u8fdb\u884c\u62a5\u6587\u5c01\u88c5\u7684\u5462？\u901a\u8fc7ARP？<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u9519，Flannel\u5e76\u4e0d\u4f9d\u8d56ARP\u8fdb\u884cMAC\u5730\u5740\u5b66\u4e60，\u800c\u662f\u7531\u8282\u70b9\u4e0a\u7684flanneld\u8fdb\u7a0b\u52a8\u6001\u751f\u6210\u76f8\u5e94\u7684\u89e3\u6790\u8bb0\u5f55\u3002\u4f8b\u5982\u4e0b\u9762\u7684\u89e3\u6790\u8bb0\u5f55\u662f\u5728node-01\u8282\u70b9\u4e0a\u67e5\u8be2\u7684，\u5b83\u4eec\u5206\u522b\u6307\u660e\u4e86\u96c6\u7fa4\u4e0a\u5176\u5b83\u8282\u70b9flannel.1\u63a5\u53e3\u7684MAC\u5730\u5740，PERMANENT\u8868\u793a\u6c38\u4e45\u6709\u6548<\/p>\n

    \"\"<\/p>\n

    \u5728node-01 \u7684ens33\u63a5\u53e3\u6293\u53d6VXLAN\u62a5\u6587\u4e2d，\u5916\u5c42\u62a5\u6587\u76ee\u6807\u5730\u5740\u662fnode-02\u7684ens33\u63a5\u53e3\u7684\u5730\u5740，\u4f46\u662f\u672c\u5730\u8282\u70b9\u4e0a\u5e76\u6ca1\u6709\u4efb\u4f55\u8def\u7531\u4fe1\u606f\u5e2e\u52a9\u6307\u5411\u76ee\u6807\u8282\u70b9，\u7531flanneld\u751f\u6210\u7684\u8def\u7531\u4e2d\u4ec5\u6307\u660e\u4e86\u5230\u8fbe\u96a7\u9053\u51fa\u53e3\u65f6flannel.1\u63a5\u53e3\u7684IP\u5730\u5740，\u90a3\u4e48\u5916\u5c42\u62a5\u6587\u7684\u76ee\u6807\u5730\u5740\u662f\u5982\u4f55\u83b7\u53d6\u7684\u5462？<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u4e8b\u5b9e\u4e0aFlannel\u628aflannel.1\u63a5\u53e3\u4e5f\u4f5c\u4e3a\u7f51\u6865\u8bbe\u5907\u4f7f\u7528，\u8be5\u8bbe\u5907\u4e0a\u9644\u52a0\u4e86\u4e00\u4e2a\u540c\u6837\u7531flanneld\u7ef4\u62a4\u7684\u79f0\u4e3aFDB\u7684\u8f6c\u53d1\u6570\u636e\u5e93，FDB\u6307\u5b9a\u4e86\u5230\u8fbe\u76ee\u6807\u8282\u70b9flannel.1\u63a5\u53e3\u9700\u8981\u7ecf\u7531\u7684\u4e0b\u4e00\u8df3IP，\u8be5IP\u662f\u76ee\u6807Pod\u6240\u5728\u8282\u70b9\u7684\u67d0\u63a5\u53e3\u7684IP（\u5728\u4e0a\u9762\u7684\u62a5\u6587\u4e2d\u662fnode-02\u7684ens33\u63a5\u53e3IP），\u5373VXLAN\u5916\u90e8\u62a5\u6587\u7684\u76ee\u6807IP\u3002<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u4f8b\u5982\u4e0b\u56fe\u7684\u8f6c\u53d1\u6761\u76ee\u662f\u5728node-01\u4e0a\u67e5\u8be2\u7684，\u8fd9\u4e9b\u6761\u76ee\u5206\u522b\u6307\u5b9a\u4e86\u5230\u8fbe\u96c6\u7fa4\u4e2d\u5176\u5b83\u8282\u70b9flannel.1\u63a5\u53e3\u65f6\u9700\u8981\u7ecf\u7531\u7684\u4e0b\u4e00\u8df3IP\u5730\u5740\u3002<\/p>\n

    \"\"<\/p>\n

    4\u3001\u793a\u4f8b2: \u6dfb\u52a0flannel\u7f51\u7edc\u7c7b\u578bDirectRouting<\/h4>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u6dfb\u52a0DirectRouting\u540e,2\u5c42\u7f51\u7edc\u8282\u70b9\u4f1a\u4f7f\u7528\u5bbf\u4e3b\u673a\u7f51\u7edc\u63a5\u53e3\u76f4\u63a5\u901a\u4fe1,3\u5c42\u7f51\u7edc\u7684\u8282\u70b9\u4f1a\u4f7f\u7528Vxlan \u96a7\u9053\u5c01\u88c5\u540e\u901a\u4fe1,\u7ec4\u5408\u4f7f\u7528\u662fflannel\u6700\u7406\u60f3\u7684\u7f51\u7edc\u7c7b\u578b<\/p>\n

    \u56e0\u4e3a\u6d4b\u8bd5\u73af\u5883\u6240\u6709\u8282\u70b9\u90fd\u5904\u4e8e\u540c\u4e002\u5c42\u7f51\u7edc,\u6240\u4ee5\u4ece\u8def\u7531\u8868\u65e0\u6cd5\u770b\u5230flannel.1\u63a5\u53e3\u540c\u65f6\u5b58\u5728\u3002<\/p>\n

    [root@k8s-master1 ~]# kubectl get cm -n kube-system<\/p>\n

    NAME DATA AGE<\/p>\n

    coredns 1 57d<\/p>\n

    extension-apiserver-authentication 6 57d<\/p>\n

    kube-flannel-cfg 2 57d<\/p>\n

    kube-proxy 2 57d<\/p>\n

    kubeadm-config 2 57d<\/p>\n

    kubelet-config-1.19 1 57d<\/p>\n

    [root@k8s-master1 ~]# kubectl edit cm kube-flannel-cfg -n kube-system<\/p>\n

    net-conf.json: |<\/p>\n

    {<\/p>\n

    "Network": "10.244.0.0\/16",<\/p>\n

    "Backend": {<\/p>\n

    "Type": "vxlan", \u6ce8\u610f\u9017\u53f7<\/p>\n

    "DirectRouting": true #\u6dfb\u52a0<\/p>\n

    }<\/p>\n

    } <\/p>\n

    \u91cd\u542fPod,\u6b63\u5f0f\u73af\u5883\u7528\u84dd\u7eff\u66f4\u65b0<\/p>\n

    [root@k8s-master1 ~]# kubectl get pod -n kube-system –show-labels<\/p>\n

    [root@k8s-master1 ~]# kubectl delete pod -n kube-system -l app=flannel<\/p>\n

    \u518d\u6b21\u67e5\u770bmaster\u3001node\u8def\u7531\u8868<\/p>\n

    [root@k8s-master1 ~]# route -n <\/p>\n

    Kernel IP routing table<\/p>\n

    Destination Gateway Genmask Flags Metric Ref Use Iface<\/p>\n

    0.0.0.0 192.168.211.2 0.0.0.0 UG 100 0 0 ens33<\/p>\n

    10.244.0.0 0.0.0.0 255.255.255.0 U 0 0 0 cni0<\/p>\n

    10.244.1.0 10.244.1.0 255.255.255.0 UG 0 0 0 ens33<\/p>\n

    10.244.2.0 192.168.54.172 255.255.255.0 UG 0 0 0 ens33<\/p>\n

    172.17.0.0 0.0.0.0 255.255.0.0 U 0 0 0 docker0<\/p>\n

    192.168.211.0 0.0.0.0 255.255.255.0 U 100 0 0 ens33<\/p>\n

    [root@k8s-node01 ~]# route -n<\/p>\n

    Kernel IP routing table<\/p>\n

    Destination Gateway Genmask Flags Metric Ref Use Iface<\/p>\n

    0.0.0.0 192.168.211.2 0.0.0.0 UG 100 0 0 ens33<\/p>\n

    10.244.0.0 192.168.211.11 255.255.255.0 UG 0 0 0 ens33<\/p>\n

    10.244.1.0 0.0.0.0 255.255.255.0 U 0 0 0 cni0<\/p>\n

    10.244.2.0 192.168.211.112 255.255.255.0 UG 0 0 0 ens33<\/p>\n

    172.17.0.0 0.0.0.0 255.255.0.0 U 0 0 0 docker0<\/p>\n

    192.168.211.0 0.0.0.0 255.255.255.0 U 101 0 0 ens33 <\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0VXLAN\u540e\u7aef\u652f\u6301DirectRouting\u6a21\u5f0f，\u5373\u5728\u96c6\u7fa4\u7684\u5404\u8282\u70b9\u4e0a\u6dfb\u52a0\u5fc5\u8981\u7684\u8def\u7531\u4fe1\u606f，\u8ba9Pod\u95f4\u7684\u62a5\u6587\u901a\u8fc7\u8282\u70b9\u7684\u4e8c\u5c42\u7f51\u7edc\u76f4\u63a5\u4f20\u9001\u3002\u5982\u4e0b\u56fe\u6240\u793a，\u53ea\u6709\u901a\u4fe1\u53cc\u65b9Pod\u6240\u5728\u8282\u70b9\u4e0d\u5728\u540c\u4e00\u4e2a\u4e8c\u5c42\u7f51\u7edc\u65f6\u624d\u542f\u7528\u4f20\u7edf\u7684VXLAN\u96a7\u9053\u65b9\u5f0f\u8f6c\u53d1\u6d41\u91cf\u3002\u5047\u5982k8s\u96c6\u7fa4\u7684\u8282\u70b9\u90fd\u4f4d\u4e8e\u540c\u4e00\u4e2a\u4e8c\u5c42\u7f51\u7edc\u4e2d，DirectRouting\u6a21\u5f0f\u4e0b\u7684Pod\u901a\u4fe1\u57fa\u672c\u63a5\u8fd1\u4e8e\u76f4\u63a5\u4f7f\u7528\u4e8c\u5c42\u7f51\u7edc\u3002\u5373\u4f7f\u8282\u70b9\u5206\u5e03\u5728\u4e0d\u540c\u7684\u7f51\u7edc\u4e2d，\u5408\u7406\u4f7f\u7528\u4e5f\u53ef\u4ee5\u8282\u7701\u4e00\u90e8\u5206\u96a7\u9053\u5f00\u9500\u3002<\/p>\n

    \"\"<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u4fee\u6539kube-flannel（v1.24\u4ee5\u540e\u7684\u7248\u672c）\u540d\u79f0\u7a7a\u95f4\u4e0bconfigmap\/kube-flannel-cfg\u8d44\u6e90，\u4e3aVXLAN\u540e\u7aef\u6dfb\u52a0Directrouting: true\u952e\u503c\u5bf9\u5c31\u53ef\u4ee5\u5f00\u542fDirectRouting\u6a21\u5f0f\u3002\u5982\u4e0b\u56fe：<\/p>\n

    \"\"<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u4fee\u6539\u5b8c\u6210\u540e\u53ef\u4ee5\u9010\u4e2a\u5220\u9664\u4e4b\u524d\u7684flannel Pod\u4ee5\u89e6\u53d1\u66f4\u65b0\u3002\u66f4\u65b0\u5b8c\u6210\u540e\u8282\u70b9\u4e0a\u7684\u8def\u7531\u89c4\u5219\u4e5f\u4f1a\u53d1\u751f\u76f8\u5e94\u7684\u53d8\u52a8，\u5230\u8fbe\u4e0e\u672c\u8282\u70b9\u540c\u4e00\u4e8c\u5c42\u7f51\u7edc\u7684\u5176\u5b83\u8282\u70b9，Pod\u5b50\u7f51\u7684\u4e0b\u4e00\u8df3\u5730\u5740\u4f1a\u7531\u5bf9\u7aefflannel1.1\u63a5\u53e3\u7684\u5730\u5740\u53d8\u4e3a\u5bbf\u4e3b\u673a\u7684\u7269\u7406\u63a5\u53e3\u5730\u5740，\u672c\u5730\u7528\u4e8e\u53d1\u51fa\u62a5\u6587\u7684\u63a5\u53e3\u4e5f\u4eceflannel.1\u53d8\u4e3a\u672c\u5730\u7269\u7406\u63a5\u53e3\u3002<\/p>\n

    \u4ee5node-01\u4e3a\u4f8b，\u542f\u7528Directrouting\u6a21\u5f0f\u540e，\u8282\u70b9\u4e0a\u7684\u8def\u7531\u53d8\u6210\u5982\u4e0b\u56fe<\/p>\n

    \"\"<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u6b64\u65f6，node-01\u4e0a\u7684Pod\u8bbf\u95eenode-02\u4e0a\u7684Pod\u5c31\u4e0d\u9700\u8981\u901a\u8fc7VXLAN\u5c01\u88c5\u62a5\u6587\u4e86，\u76f4\u63a5\u901a\u8fc7\u8def\u7531\u5373\u53ef\u5b9e\u73b0\u3002\u4f8b\u5982\u4e0b\u9762\u6293\u53d6\u7684\u62a5\u6587\u6240\u793a：<\/p>\n

    \"\"<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u4f46\u662f\u663e\u7136，\u8fd9\u79cd\u6a21\u5f0f\u65e0\u6cd5\u6ee1\u8db3\u8de8\u4e8c\u5c42\u7f51\u7edc\u8282\u70b9\u4e0aPod\u7684\u901a\u4fe1\u9700\u6c42，\u56e0\u4e3a\u5230\u8fbePod\u5b50\u7f51\u7684\u4e0b\u4e00\u8df3\u5730\u5740\u65e0\u6cd5\u6307\u5411\u53e6\u4e00\u4e2a\u4e8c\u5c42\u7f51\u7edc\u4e2d\u7684\u8282\u70b9\u5730\u5740\u3002\u6240\u4ee5\u8282\u70b9\u4e0a\u4f9d\u7136\u4fdd\u7559flannel.1\u63a5\u53e3\u7528\u4e8e\u8de8\u4e8c\u5c42\u7f51\u7edc\u8282\u70b9\u4e0aPod\u7684\u901a\u4fe1\u9700\u6c42\u3002<\/p>\n

    \n

    5\u3001\u793a\u4f8b3: \u4fee\u6539flannel\u7f51\u7edc\u7c7b\u578bhost-gw \u9700\u8981\u6ce8\u610fhost-gw\u53ea\u652f\u63012\u5c42\u7f51\u7edc<\/h4>\n

    \u56e0\u4e3a\u6240\u6709\u8282\u70b9\u90fd\u5904\u57282\u5c42\u7f51\u7edc\u4e2d,\u7406\u8bba\u4e0a\u548c\u524d\u9762\u6dfb\u52a0DirectRouting \u6548\u679c\u662f\u4e00\u6837\u7684\u3002<\/p>\n

    [root@k8s-master1 ~]# vim kube-flannel.yml<\/p>\n

    …<\/p>\n

    net-conf.json: |<\/p>\n

    {<\/p>\n

    "Network": "10.244.0.0\/16",<\/p>\n

    "Backend": {<\/p>\n

    "Type": "host-gw" #\u4fee\u6539\u7c7b\u578b\u4e3ahost-gw<\/p>\n

    }<\/p>\n

    }<\/p>\n

    …<\/p>\n

    #\u67e5\u770b\u8def\u7531\u8868 <\/p>\n

    [root@k8s-master plugin]# kubectl apply -f kube-flannel.yml<\/p>\n

    Kernel IP routing table<\/p>\n

    Destination Gateway Genmask Flags Metric Ref Use Iface<\/p>\n

    0.0.0.0 192.168.211.2 0.0.0.0 UG 100 0 0 ens33<\/p>\n

    10.244.0.0 0.0.0.0 255.255.255.0 U 0 0 0 cni0<\/p>\n

    10.244.1.0 192.168.211.11 255.255.255.0 UG 0 0 0 ens33<\/p>\n

    10.244.2.0 192.168.211.12 255.255.255.0 UG 0 0 0 ens33<\/p>\n

    172.17.0.0 0.0.0.0 255.255.0.0 U 0 0 0 docker0<\/p>\n

    192.168.211.0 0.0.0.0 255.255.255.0 U 101 0 0 ens33 <\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0host-gw\u540e\u7aef\u901a\u8fc7\u6dfb\u52a0\u8def\u7531\u4fe1\u606f，\u4f7f\u7528\u8282\u70b9\u4e0a\u7684\u4e8c\u5c42\u7f51\u7edc\u76f4\u63a5\u53d1\u9001Pod\u95f4\u7684\u901a\u4fe1\u62a5\u6587，\u5176\u5de5\u4f5c\u65b9\u5f0f\u7c7b\u4f3c\u4e8eVXLAN\u540e\u7aef\u7684DirectRouting\u6a21\u5f0f，\u4f46\u4e0d\u5177\u5907DirectRouting\u6a21\u5f0f\u4e2dVXLAN\u96a7\u9053\u8f6c\u53d1\u80fd\u529b，\u8fd9\u610f\u5473\u7740host-gw\u540e\u7aef\u4e0b\u6240\u6709\u8282\u70b9\u5fc5\u987b\u4f4d\u4e8e\u540c\u4e00\u4e2a\u4e8c\u5c42\u7f51\u7edc\u4e2d\u3002<\/p>\n

    host-gw\u540e\u7aef\u5de5\u4f5c\u6a21\u578b\u793a\u610f\u56fe\u5982\u4e0b：<\/p>\n

    \"\"<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u540c\u6837，\u76f4\u63a5\u4fee\u6539kube-flannel\u540d\u79f0\u7a7a\u95f4\u4e0bconfigmap\/kube-flannel-cf\u8d44\u6e90\u5bf9\u8c61，\u5c06Backend.Type\u7684\u503c\u4fee\u6539\u4e3ahost-gw，\u7136\u540e\u91cd\u5efaPod\u5373\u53ef\u542f\u7528host-gw\u540e\u7aef，\u5982\u4e0b\u6240\u793a：<\/p>\n

    \"\"<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u914d\u7f6e\u5b8c\u6210\u540e，\u5404\u8282\u70b9\u4e0a\u5c31\u4f1a\u751f\u6210\u7c7b\u4f3c\u4e8eVXLAN\u540e\u7aef\u76f4\u63a5\u8def\u7531\u6a21\u5f0f\u7684\u8def\u7531\u89c4\u5219，\u4ee5\u8f6c\u53d1Pod\u7684\u901a\u4fe1\u62a5\u6587，\u5b83\u5b8c\u5168\u7701\u53bb\u4e86\u96a7\u9053\u8f6c\u53d1\u7684\u989d\u5916\u5f00\u9500，\u6240\u4ee5\u4e5f\u4e0d\u5728\u9700\u8981flannel.1\u63a5\u53e3\u3002\u4f46\u662f，\u5982\u679c\u8282\u70b9\u5904\u4e8e\u4e0d\u540c\u7684\u4e8c\u5c42\u7f51\u7edc，host-gw\u540e\u7aef\u5c31\u65e0\u6cd5\u5b9e\u73b0Pod\u95f4\u7684\u901a\u4fe1\u3002\u56e0\u6b64，\u76f8\u5bf9\u6765\u8bf4，VXLAN\u7684DirectRouting\u6a21\u5f0f\u517c\u5177VXLAN\u540e\u7aef\u548chost-gw\u540e\u7aef\u7684\u4f18\u52bf，\u65e2\u80fd\u4fdd\u8bc1\u4f20\u8f93\u6027\u80fd，\u53c8\u53ef\u4ee5\u8de8\u4e8c\u5c42\u7f51\u7edc\u8f6c\u53d1Pod\u62a5\u6587\u3002<\/p>\n

    \n

    \u4e09\u3001Kubernetes-\u57fa\u4e8ecalico\u7684\u96c6\u7fa4\u7f51\u7edc<\/h3>\n

    1\u3001calico\u7b80\u4ecb<\/h4>\n

    Calico\u5b98\u65b9\u6587\u6863：https:\/\/docs.tigera.io\/calico\/latest\/getting-started\/kubernetes\/quickstart<\/p>\n

    \"\"<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Calico\u662f\u4e00\u5957\u5f00\u6e90\u7684\u7f51\u7edc\u548c\u7f51\u7edc\u5b89\u5168\u89e3\u51b3\u65b9\u6848，\u7528\u4e8e\u5bb9\u5668\u3001\u865a\u62df\u673a\u3001\u5bbf\u4e3b\u673a\u4e4b\u524d\u7684\u7f51\u7edc\u8fde\u63a5，\u5b83\u662f\u4e00\u4e2a\u7eaf\u4e09\u5c42\u7684\u865a\u62df\u5316\u7f51\u7edc\u89e3\u51b3\u65b9\u6848，\u5b83\u628a\u6bcf\u4e2a\u8282\u70b9\u90fd\u4f5c\u4e3a\u4e00\u4e2a\u865a\u62df\u8def\u7531\u5668，\u5e76\u628a\u6bcf\u4e2a\u8282\u70b9\u4e0a\u7684Pod\u5f53\u4f5c\u662f\u8282\u70b9\u8def\u7531\u5668\u540e\u7684\u4e00\u4e2a\u7ec8\u7aef\u8bbe\u5907\u5e76\u4e3a\u5176\u5206\u914d\u4e00\u4e2aIP\u5730\u5740\u3002\u5404\u8282\u70b9\u8def\u7531\u5668\u901a\u8fc7BGP\u534f\u8bae\u751f\u6210\u8def\u7531\u89c4\u5219，\u4ece\u800c\u5b9e\u73b0\u4e0d\u901a\u8282\u70b9\u4e0aPod\u95f4\u7684\u901a\u4fe1，\u6b64\u5916，Calico\u8fd8\u5b9e\u73b0\u4e86 Kubernetes \u7f51\u7edc\u7b56\u7565，\u63d0\u4f9bACL\u529f\u80fd，\u5373\u4f7f\u7528 iptables \u6765\u505a\u5b89\u5168\u8bbf\u95ee\u7b56\u7565<\/span><\/span>\u3002\u5982\u4e0b\u56fe：<\/p>\n

    \"\"<\/p>\n

    \n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u4e0eFlannel\u76f8\u6bd4，Calico\u7684\u4e00\u4e2a\u663e\u8457\u4f18\u52bf\u662f\u5bf9\u7f51\u7edc\u7b56\u7565\u7684\u652f\u6301，\u5b83\u5141\u8bb8\u7528\u6237\u5b9a\u4e49\u8bbf\u95ee\u63a7\u5236\u89c4\u5219\u4ee5\u7ba1\u63a7\u8fdb\u51faPod\u7684\u6570\u636e\u62a5\u6587，\u4ece\u800c\u4e3aPod\u95f4\u7684\u901a\u4fe1\u65bd\u52a0\u5b89\u5168\u7b56\u7565\u3002<\/p>\n

    \u6240\u4ee5Calico\u63d0\u4f9b\u4e24\u79cd\u4e3b\u8981\u670d\u52a1：<\/p>\n

  • \u8282\u70b9\u4e4b\u95f4\u7684\u7f51\u7edc\u8fde\u63a5\u3002<\/li>\n
  • \u8282\u70b9\u4e4b\u95f4\u7684\u7f51\u7edc\u5b89\u5168\u7b56\u7565\u5b9e\u65bd\u3002<\/li>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0BGP\u662f\u4e00\u4e2a\u53bb\u4e2d\u5fc3\u5316\u81ea\u6cbb\u8def\u7531\u534f\u8bae，\u5b83\u901a\u8fc7\u7ef4\u62a4IP\u8def\u7531\u8868\u6216\u201c\u524d\u7f00\u201d\u6765\u5b9e\u73b0\u81ea\u6cbb\u7cfb\u7edf\u4e4b\u95f4\u7684\u53ef\u8fbe\u6027，\u901a\u5e38\u4f5c\u4e3a\u5927\u89c4\u6a21\u6570\u636e\u4e2d\u5fc3\u7ef4\u62a4\u4e0d\u540c\u81ea\u6cbb\u7cfb\u7edf\u4e4b\u95f4\u8def\u7531\u4fe1\u606f\u7684\u77e2\u91cf\u8def\u7531\u534f\u8bae\u3002Linux\u5185\u6838\u539f\u751f\u652f\u6301BGP，\u56e0\u6b64\u53ef\u4ee5\u628a\u4e00\u53f0Linux\u4e3b\u673a\u914d\u7f6e\u4e3a\u8fb9\u754c\u7f51\u5173\u3002<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Calico\u628a\u6bcf\u4e2a\u8282\u70b9\u4e0aPod\u7ec4\u6210\u7684\u7f51\u7edc\u89c6\u4e3a\u4e00\u4e2a\u81ea\u6cbb\u7cfb\u7edf（AS），\u800c\u6bcf\u4e2a\u8282\u70b9\u5c31\u76f8\u5f53\u4e8e\u81ea\u6cbb\u7cfb\u7edf\u7684\u8fb9\u754c\u7f51\u5173\u3002\u5404\u8282\u70b9\u4e4b\u95f4\u901a\u8fc7BGP\u534f\u8bae\u4ea4\u6362\u8def\u7531\u4fe1\u606f\u5e76\u751f\u6210\u8def\u7531\u89c4\u5219\u3002\u4f46\u5e76\u975e\u6240\u6709\u7684\u7f51\u7edc\u73af\u5883\u90fd\u80fd\u652f\u6301BGP，\u800c\u4e14BGP\u8def\u7531\u6a21\u578b\u8981\u6c42\u6240\u6709\u8282\u70b9\u4f4d\u4e8e\u540c\u4e00\u4e2a\u4e8c\u5c42\u7f51\u7edc\u4e2d，\u6240\u4ee5Calico\u8fd8\u652f\u6301\u57fa\u4e8eIPIP\u548cVXLAN\u7684Overlay\u7f51\u7edc\u6a21\u578b\u3002<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u53e6\u5916，\u7c7b\u4f3c\u4e8eFlannel\u7684 VXALN\u540e\u7aef\u542f\u7528Directrouting\u65f6\u7684\u7f51\u7edc\u6a21\u578b，Calico\u4e5f\u652f\u6301\u6df7\u5408\u4f7f\u7528\u8def\u7531\u548cOverlay\u7f51\u7edc\u6a21\u578b，BGP\u8def\u7531\u6a21\u578b\u7528\u4e8e\u4e8c\u5c42\u7f51\u7edc\u7684\u9ad8\u6027\u80fd\u901a\u4fe1，IPIP\u6216VXLAN\u7528\u4e8e\u8de8\u4e8c\u5c42\u7f51\u7edc\u8282\u70b9\u95f4Pod\u62a5\u6587\u7684\u8f6c\u53d1，\u5982\u4e0b\u56fe\u6240\u793a：<\/p>\n

    \"\"<\/h4>\n

    2\u3001Calico \u7f51\u7edcNode\u4e4b\u95f4\u901a\u4fe1\u7f51\u7edc<\/h4>\n

    1）IPIP(\u53ef\u8de8\u7f51\u6bb5\u901a\u4fe1)<\/h5>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u4ece\u5b57\u9762\u6765\u7406\u89e3，\u5c31\u662f\u628a\u4e00\u4e2aIP\u6570\u636e\u5305\u53c8\u5957\u5728\u4e00\u4e2aIP\u5305\u91cc，\u5373\u628a IP \u5c42\u5c01\u88c5\u5230 IP \u5c42\u7684\u4e00\u4e2a tunnel\u3002\u5b83\u7684\u4f5c\u7528\u5176\u5b9e\u57fa\u672c\u4e0a\u5c31\u76f8\u5f53\u4e8e\u4e00\u4e2a\u57fa\u4e8eIP\u5c42\u7684\u7f51\u6865！\u4e00\u822c\u6765\u8bf4，\u666e\u901a\u7684\u7f51\u6865\u662f\u57fa\u4e8emac\u5c42\u7684，\u6839\u672c\u4e0d\u9700 IP，\u800c\u8fd9\u4e2a ipip \u5219\u662f\u901a\u8fc7\u4e24\u7aef\u7684\u8def\u7531\u505a\u4e00\u4e2a tunnel，\u628a\u4e24\u4e2a\u672c\u6765\u4e0d\u901a\u7684\u7f51\u7edc\u901a\u8fc7\u70b9\u5bf9\u70b9\u8fde\u63a5\u8d77\u6765\u3002<\/p>\n

    \"\"<\/p>\n

    \u7c7b\u4f3cvxlan \u4f46\u5c01\u88c5\u5f00\u9500\u6bd4vxlan\u5c0f \u6548\u7387\u76f8\u5bf9\u66f4\u9ad8\u4e00\u4e9b，\u4f46\u5b89\u5168\u6027\u4e5f\u66f4\u5dee<\/p>\n

    2）Vxlan(\u53ef\u8de8\u7f51\u6bb5\u901a\u4fe1)<\/h5>\n

    \u4e0eFlannel Vxlan\u539f\u7406\u76f8\u540c<\/p>\n

    3）BGP\u8def\u7531\u6a21\u5f0f(\u4e8c\u5c42\u7f51\u7edc\u901a\u4fe1)<\/h5>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u8fb9\u754c\u7f51\u5173\u534f\u8bae（Border Gateway Protocol, BGP）\u662f\u4e92\u8054\u7f51\u4e0a\u4e00\u4e2a\u6838\u5fc3\u7684\u53bb\u4e2d\u5fc3\u5316\u81ea\u6cbb\u8def\u7531\u534f\u8bae\u3002\u5b83\u901a\u8fc7\u7ef4\u62a4IP\u8def\u7531\u8868\u6216\u2018\u524d\u7f00\u2019\u8868\u6765\u5b9e\u73b0\u81ea\u6cbb\u7cfb\u7edf（AS）\u4e4b\u95f4\u7684\u53ef\u8fbe\u6027，\u5c5e\u4e8e\u77e2\u91cf\u8def\u7531\u534f\u8bae\u3002<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u5b9e\u9645\u4e0a，Calico \u9879\u76ee\u63d0\u4f9b\u7684 BGP \u7f51\u7edc\u89e3\u51b3\u65b9\u6848，\u4e0e Flannel \u7684 host-gw \u6a21\u5f0f\u51e0\u4e4e\u4e00\u6837\u3002\u4e5f\u5c31\u662f\u8bf4，Calico\u4e5f\u662f\u57fa\u4e8e\u8def\u7531\u8868\u5b9e\u73b0\u5bb9\u5668\u6570\u636e\u5305\u8f6c\u53d1，\u4f46\u4e0d\u540c\u4e8eFlannel\u4f7f\u7528flanneld\u8fdb\u7a0b\u6765\u7ef4\u62a4\u8def\u7531\u4fe1\u606f\u7684\u505a\u6cd5，\u800cCalico\u9879\u76ee\u4f7f\u7528BGP\u534f\u8bae\u6765\u81ea\u52a8\u7ef4\u62a4\u6574\u4e2a\u96c6\u7fa4\u7684\u8def\u7531\u4fe1\u606f\u3002<\/p>\n

    \n

    \u90e8\u7f72\u63a8\u8350\u65b9\u6848:<\/h5>\n

    BGP+Vxlan<\/p>\n

    \n

    3\u3001calico\u67b6\u6784<\/h4>\n

    \"\"<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u5982\u4e0a\u56fe\u6240\u793a，Calico\u7684\u7ec4\u4ef6\u4e3b\u8981\u6709Felix\u3001etcd\u5b58\u50a8\u7cfb\u7edf\u3001BIRD\u548cBGP\u8def\u7531\u53cd\u5c04\u5668\u7b49，\u5404\u7ec4\u4ef6\u7684\u4f5c\u7528\u5982\u4e0b：<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a01）Felix：\u8fd0\u884c\u5728\u6bcf\u4e00\u53f0Host\u7684agent\u8fdb\u7a0b，\u4e3b\u8981\u8d1f\u8d23\u7f51\u7edc\u63a5\u53e3\u7ba1\u7406\u548c\u76d1\u542c\u3001\u8def\u7531\u3001ARP\u7ba1\u7406\u3001ACL\u7ba1\u7406\u548c\u540c\u6b65\u3001\u72b6\u6001\u4e0a\u62a5\u7b49\u3002Felix\u4f1a\u76d1\u542cEtcd\u4e2d\u5fc3\u7684\u5b58\u50a8，\u4ece\u5b83\u83b7\u53d6\u4e8b\u4ef6，\u6bd4\u5982\u8bf4\u7528\u6237\u5728\u8fd9\u53f0\u673a\u5668\u4e0a\u52a0\u4e86\u4e00\u4e2aIP，\u6216\u8005\u662f\u521b\u5efa\u4e86\u4e00\u4e2a\u5bb9\u5668\u7b49，\u7528\u6237\u521b\u5efaPod\u540e，Felix\u8d1f\u8d23\u5c06\u5176\u7f51\u5361\u3001IP\u3001MAC\u90fd\u8bbe\u7f6e\u597d，\u7136\u540e\u5728\u5185\u6838\u7684\u8def\u7531\u8868\u91cc\u9762\u5199\u4e00\u6761，\u6ce8\u660e\u8fd9\u4e2aIP\u5e94\u8be5\u5230\u8fd9\u5f20\u7f51\u5361\u3002\u540c\u6837，\u7528\u6237\u5982\u679c\u5236\u5b9a\u4e86\u9694\u79bb\u7b56\u7565，Felix\u540c\u6837\u4f1a\u5c06\u8be5\u7b56\u7565\u521b\u5efa\u5230ACL\u4e2d，\u4ee5\u5b9e\u73b0\u9694\u79bb\u3002<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a02）etcd：\u5206\u5e03\u5f0f\u952e\u503c\u5b58\u50a8，\u4e3b\u8981\u8d1f\u8d23\u7f51\u7edc\u5143\u6570\u636e\u4e00\u81f4\u6027，\u786e\u4fddCalico\u7f51\u7edc\u72b6\u6001\u7684\u51c6\u786e\u6027，\u53ef\u4ee5\u4e0ekubernetes\u5171\u7528\u3002<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a03）BGP Client（BIRD）：Calico\u4e3a\u6bcf\u4e00\u53f0Host\u90e8\u7f72\u4e00\u4e2aBGP Client，\u5728Calico\u7684\u89d2\u8272\u662f\u76d1\u542cHost\u4e0a\u7531Felix\u6ce8\u5165\u7684\u8def\u7531\u4fe1\u606f，\u7136\u540e\u901a\u8fc7BGP\u534f\u8bae\u5e7f\u64ad\u544a\u8bc9\u5269\u4f59Host\u8282\u70b9，\u4ece\u800c\u5b9e\u73b0\u7f51\u7edc\u4e92\u901a（\u5373\u8d1f\u8d23\u5c06Felix\u751f\u6210\u7684\u8def\u7531\u4fe1\u606f\u8f7d\u5165\u5185\u6838\u5e76\u901a\u544a\u5230\u6574\u4e2a\u7f51\u7edc\u4e2d）\u3002BIRD\u662f\u4e00\u4e2a\u6807\u51c6\u7684\u8def\u7531\u7a0b\u5e8f，\u5b83\u4f1a\u4ece\u5185\u6838\u91cc\u9762\u83b7\u53d6\u54ea\u4e00\u4e9bIP\u7684\u8def\u7531\u53d1\u751f\u4e86\u53d8\u5316，\u7136\u540e\u901a\u8fc7\u6807\u51c6BGP\u7684\u8def\u7531\u534f\u8bae\u6269\u6563\u5230\u6574\u4e2a\u5176\u4ed6\u7684\u5bbf\u4e3b\u673a\u4e0a，\u8ba9\u5916\u754c\u90fd\u77e5\u9053\u8fd9\u4e2aIP\u5728\u8fd9\u91cc，\u4f60\u4eec\u8def\u7531\u7684\u65f6\u5019\u5f97\u5230\u8fd9\u91cc\u6765\u3002\u3002<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a04）BGP Route Reflector（BGP\u8def\u7531\u53cd\u5c04\u5668）：\u5728\u5927\u578b\u7f51\u7edc\u89c4\u6a21\u4e2d，\u5982\u679c\u4ec5\u4ec5\u4f7f\u7528BGP client\u5f62\u6210\u5168\u7f51\u4e92\u8054\u7684\u65b9\u6848\u5c31\u4f1a\u5bfc\u81f4\u89c4\u6a21\u9650\u5236，\u56e0\u4e3a\u6240\u6709\u8282\u70b9\u4e4b\u95f4\u4fe9\u4fe9\u4e92\u8054，\u9700\u8981N^2\u4e2a\u8fde\u63a5，\u4e3a\u4e86\u89e3\u51b3\u8fd9\u4e2a\u89c4\u6a21\u95ee\u9898，\u53ef\u4ee5\u91c7\u7528BGP\u7684Router Reflector\u7684\u65b9\u6cd5，\u4f7f\u6240\u6709BGP Client\u4ec5\u4e0e\u7279\u5b9aRR\u8282\u70b9\u4e92\u8054\u5e76\u505a\u8def\u7531\u540c\u6b65，\u4ece\u800c\u5927\u5927\u51cf\u5c11\u8fde\u63a5\u6570\u3002<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u53e6\u5916，Calico\u53ef\u4ee5\u5c06\u5173\u952e\u914d\u7f6e\u62bd\u8c61\u4e3a\u8d44\u6e90\u7c7b\u578b，\u5e76\u5141\u8bb8\u7528\u6237\u6309\u9700\u81ea\u5b9a\u4e49\u8d44\u6e90\u5bf9\u8c61\u5df2\u5b8c\u6210\u7cfb\u7edf\u914d\u7f6e，\u8fd9\u4e9b\u8d44\u6e90\u5bf9\u8c61\u4fdd\u5b58\u5728Datastore\u4e2d，Datastore\u53ef\u4ee5\u662f\u72ec\u7acb\u7684etcd，\u4e5f\u53ef\u4ee5\u662fk8s\u96c6\u7fa4\u4f7f\u7528\u7684etcd\u3002Calico\u4e13\u6709\u8d44\u6e90\u7c7b\u578b\u6709\u5341\u51e0\u79cd，\u5305\u62ecIPPool（IP\u5730\u5740\u6c60）\u3001NetworkPolicy（\u7f51\u7edc\u7b56\u7565）\u3001BGPConfiguration（BGP\u914d\u7f6e\u53c2\u6570）\u7b49\u3002\u7c7b\u4f3c\u4e8eKubernetes API\u8d44\u6e90\u7684\u5b9a\u4e49，\u8fd9\u4e9b\u8d44\u6e90\u7684\u914d\u7f6e\u683c\u5f0f\u540c\u6837\u4ee5JSON\u4f7f\u7528apiVersion\u3001kind\u3001metadata\u548cspec\u7b49\u4e00\u7ea7\u5b57\u6bb5\u8fdb\u884c\u5b9a\u4e49，\u5e76\u80fd\u591f\u4f7f\u7528calicoctl\u5ba2\u6237\u7aef\u5de5\u5177\u8fdb\u884c\u7ba1\u7406，\u4e5f\u652f\u6301\u7531kubelet\u501f\u52a9CRD\u8fdb\u884c\u8fd9\u7c7b\u8d44\u6e90\u7684\u7ba1\u7406\u3002<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u5176\u4e2dBGP\u5728\u5b98\u65b9\u7684\u63a8\u8350\u65b9\u6848\u4e2d\u4ee550\u4e2a\u8282\u70b9\u4e3a\u754c\u533a\u522b\u4e86\u4e0d\u540c\u89c4\u6a21\u4f7f\u7528\u4e0d\u540c\u7684\u90e8\u7f72\u65b9\u6848<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u5c0f\u89c4\u6a21\u7f51\u7edc:BGP peer \u4e00\u5bf9\u4e00\u7f51\u7edc：\u6bcf\u4e2a\u8282\u70b9\u90fd\u662f\u6709N-1\u6761\u8def\u7531，\u5c0f\u578b\u7f51\u7edc\u9002\u7528，\u5f53\u8282\u70b9\u6570N\u53d8\u591a\u65f6，\u8def\u7531\u8868\u66f4\u65b0\u90fd\u9700\u8981\u627f\u53d7\u5f88\u5927\u7684\u538b\u529b,\u7c7b\u4f3c\u7f51\u7edc\u62d3\u6251\u7ed3\u6784\u4e2d\u7684\u7f51\u72b6\u62d3\u6251\u7ed3\u6784<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u5927\u89c4\u6a21\u7f51\u7edc:BGP Reflector \u8def\u7531\u53cd\u5c04\u5668：\u9009\u62e9\u4e00\u5230\u591a\u4e2a\u8282\u70b9\u505a\u4e3aReflector，\u6240\u6709\u8282\u70b9\u8def\u7531\u90fd\u6c47\u603b\u7ed9Reflector，\u6240\u6709\u8282\u70b9\u90fd\u8def\u7531\u90fd\u6307\u5411Reflector ，\u9002\u5408\u5927\u578b\u7f51\u7edc，\u7c7b\u4f3c\u7f51\u7edc\u62d3\u6251\u7ed3\u6784\u4e2d\u7684\u661f\u578b\u7f51\u7edc<\/p>\n

    \n

    4\u3001Calico\u90e8\u7f72<\/h4>\n

    \u5b98\u65b9\u94fe\u63a5：<\/p>\n

    https:\/\/archive-os-3-25.netlify.app\/calico\/3.25\/getting-started\/kubernetes\/self-managed-onprem\/onpremises\/<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u5728k8s\u96c6\u7fa4\u4e0a\u5b9e\u9645\u90e8\u7f72\u65f6，Calico\u5206\u4e3acalico-node\u548ccalico-kube-controllers\u4e24\u4e2a\u7ec4\u4ef6，\u5b83\u4eec\u901a\u8fc7Datastore\u8bfb\u53d6\u4e0e\u81ea\u8eab\u76f8\u5173\u7684\u8d44\u6e90\u5b9a\u4e49\u5b8c\u6210\u914d\u7f6e<\/p>\n

  • calico-node：Calico\u5728k8s\u96c6\u7fa4\u4e2d\u6bcf\u4e2a\u8282\u70b9\u8fd0\u884c\u7684\u4ee3\u7406\u7a0b\u5e8f，\u8d1f\u8d23\u63d0\u4f9bFelxi\u3001bird4\u3001bird6\u548cconfd\u7b49\u5b88\u62a4\u8fdb\u7a0b<\/li>\n
  • calico-kube-controllers：Calico\u8fd0\u884c\u5728k8s\u96c6\u7fa4\u4e0a\u7684\u81ea\u5b9a\u4e49\u63a7\u5236\u5668，\u662fCalico\u534f\u540ck8s\u7684\u63d2\u4ef6<\/li>\n

    \u4ece\u5b98\u7f51\u4e0b\u8f7d\u90e8\u7f72\u6587\u4ef6：<\/p>\n

    https:\/\/raw.githubusercontent.com\/projectcalico\/calico\/v3.24.5\/manifests\/calico.yaml<\/p>\n

    \u4fee\u6539\u90e8\u7f72\u6587\u4ef6\u4ee5\u9002\u914dk8s\u96c6\u7fa4\u73af\u5883<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u9996\u5148\u4fee\u6539\u90e8\u7f72\u6587\u4ef6\u4e2dCALICO_IPV4POOL_CIDR\u53d8\u91cf\u7684\u503c，\u5c06\u5176\u8bbe\u7f6e\u4e3a\u521d\u59cbk8s\u5316\u96c6\u7fa4\u65f6\u8bbe\u5b9a\u7684–pod-network-cidr，\u4f8b\u5982：<\/p>\n

    \"\"<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u7136\u540e\u4fee\u6539CALICO_IPV4POOL_BLOCK_SIZE\u53d8\u91cf\u7684\u503c，\u6307\u5b9aCalico\u4e3a\u8282\u70b9\u5206\u914d\u5730\u5740\u6bb5\u7684\u63a9\u7801\u957f\u5ea6，\u9ed8\u8ba426\u3002<\/p>\n

    \"\"<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Calico\u7684\u90e8\u7f72\u6587\u4ef6\u9ed8\u8ba4\u4f7f\u7528\u7684\u662fIPIP \u96a7\u9053\u6a21\u5f0f，\u8fd9\u91cc\u5c31\u4fdd\u6301\u9ed8\u8ba4，\u4e0d\u518d\u8fdb\u884c\u4fee\u6539\u3002\u5982\u679c\u8981\u4f7f\u7528\u7eafBGP\u8def\u7531\u6a21\u5f0f\u6216\u8005\u6df7\u5408\u6a21\u5f0f\u53ef\u4ee5\u4fee\u6539\u53d8\u91cfCALICO_IPV4POOL_IPIP\u7684\u503c，\u53ef\u7528\u503c\u5982\u4e0b：<\/p>\n

  • Always：\u53ea\u4f7f\u7528IPIP\u96a7\u9053\u7f51\u7edc，\u9ed8\u8ba4\u503c<\/li>\n
  • Never：\u4e0d\u4f7f\u7528IPIP\u96a7\u9053\u7f51\u7edc<\/li>\n
  • CrossSubnet：\u542f\u7528\u6df7\u5408\u7f51\u7edc\u6a21\u5f0f<\/li>\n

    \"\"<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u5982\u679c\u60f3\u8981\u4f7f\u7528VXLAN\u96a7\u9053\u7f51\u7edc，\u800c\u4e0d\u662fIPIP\u96a7\u9053\u7f51\u7edc，\u53ef\u4ee5\u4fee\u6539\u53d8\u91cfCALICO_IPV4POOL_VXLAN\u7684\u503c，\u53ef\u7528\u503c\u548c\u53d8\u91cfCALICO_IPV4POOL_IPIP\u4e00\u81f4\u3002<\/p>\n

    \n

    \u66f4\u591a\u53d8\u91cf\u7684\u914d\u7f6e\u548c\u4ecb\u7ecd\u53ef\u4ee5\u53c2\u8003\u5b98\u7f51\u4ecb\u7ecd：<\/p>\n

    https:\/\/docs.tigera.io\/calico\/latest\/reference\/configure-calico-node<\/p>\n

    \u5c06\u90e8\u7f72\u6587\u4ef6\u5e94\u7528\u5230\u96c6\u7fa4\u4e4b\u4e0a，\u7b49\u5f85Calico\u76f8\u5173Pod\u6210\u529f\u8fd0\u884c\u4e14\u65e0\u62a5\u9519\u5c31\u8868\u793aCalico\u90e8\u7f72\u6210\u529f\u3002<\/p>\n

    [root@k8s-master1 ~]# kubectl apply -f calico.yaml<\/p>\n

    [root@k8s-master1 ~]# kubectl get pods -A<\/p>\n

    \"\"<\/p>\n

    \n

    5\u3001IPIP\u96a7\u9053\u7f51\u7edc<\/h4>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u5de5\u4f5c\u5728IPIP\u6a21\u5f0f\u7684Calico\u4f1a\u5728\u6bcf\u4e2a\u8282\u70b9\u521b\u5efa\u4e00\u4e2atunl0\u63a5\u53e3\u4f5c\u4e3a\u96a7\u9053\u51fa\u5165\u53e3\u8bbe\u5907\u6765\u5c01\u88c5IPIP\u96a7\u9053\u62a5\u6587\u3002Calico\u4f1a\u4e3a\u6bcf\u4e2aPod\u8d44\u6e90\u521b\u5efa\u4e00\u5bf9veth\u8bbe\u5907，\u5176\u4e2d\u4e00\u7aef\u4f5c\u4e3aPod\u7684\u7f51\u7edc\u63a5\u53e3，\u53e6\u4e00\u7aef（\u540d\u4e3acalixxx）\u7559\u5728\u5bbf\u4e3b\u673a\u7684\u7f51\u7edc\u540d\u79f0\u7a7a\u95f4，\u5b83\u4e0d\u4f7f\u7528\u865a\u62df\u7f51\u6865\u3002\u5982\u4e0b\u56fe\u6240\u793a：<\/p>\n

    \"\"<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0IPIP\u96a7\u9053\u7f51\u7edc\u4e5f\u662f\u4f9d\u8d56BGP\u6765\u7ef4\u62a4\u8282\u70b9\u7684\u8def\u7531\u4fe1\u606f\u3002\u90e8\u7f72\u5b8c\u6210\u540e，Calico\u4f1a\u901a\u8fc7BGP\u534f\u8bae\u5728\u6bcf\u4e2a\u8282\u70b9\u4e0a\u751f\u6210\u5230\u8fbe\u5176\u5b83\u8282\u70b9Pod\u5b50\u7f51\u7684\u8def\u7531\u4fe1\u606f\u3002\u4f8b\u5982\u4e0b\u9762node-01\u4e0a\u7684\u8def\u7531\u4fe1\u606f，\u5b83\u4eec\u662f\u7531\u5404\u8282\u70b9\u4e0a\u7684BIRD\u4ee5\u70b9\u5bf9\u70b9\u7684\u65b9\u5f0f\u5411\u7f51\u7edc\u4e2d\u7684\u5176\u5b83\u8282\u70b9\u8fdb\u884c\u901a\u544a\u5e76\u5b66\u4e60\u5176\u5b83\u8282\u70b9\u7684\u901a\u544a\u800c\u751f\u6210\u3002<\/p>\n

    \"\"<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u5bf9\u4e8e\u6bcf\u4e2aPod，Calico\u90fd\u4f1a\u5728\u8282\u70b9\u4e0a\u4e3a\u5176\u751f\u6210\u4e00\u4e2a\u4e13\u7528\u8def\u7531\u6761\u76ee，\u7528\u4e8e\u786e\u4fdd\u4ee5Pod IP\u4e3a\u76ee\u6807\u7684\u62a5\u6587\u53ef\u4ee5\u901a\u8fc7\u8282\u70b9\u4e0a\u7684calixxx\u63a5\u53e3\u9001\u8fbe，\u8fd9\u662f\u56e0\u4e3aCalico\u6ca1\u6709\u50cfFlannel\u4e00\u6837\u4f7f\u7528\u865a\u62df\u7f51\u6865\u8fdb\u884c\u62a5\u6587\u8f6c\u53d1\u5bfc\u81f4\u7684\u3002\u76f8\u5173\u8def\u7531\u6761\u76ee\u5982\u4e0b\u6240\u793a：<\/p>\n

    \"\"<\/p>\n

    Pod\u901a\u4fe1\u6d41\u7a0b\u5206\u6790<\/h5>\n

    \u96c6\u7fa4\u4e2dnode-02\u4e0a\u8fd0\u884c\u4e00\u4e2anginx-pod（10.244.89.5），\u5728node-01\u4e0a\u7684client-pod（10.244.169.3）\u4e0a\u8bf7\u6c42nginx-pod，\u5176\u8fc7\u7a0b\u5927\u81f4\u5982\u4e0b：<\/p>\n

    1）client-pod\u53d1\u9001\u8bf7\u6c42，\u6839\u636ePod\u4e2d\u7684\u9ed8\u8ba4\u8def\u7531\u5c06\u62a5\u6587\u9001\u5230\u4e3b\u673a\u4e0a\u5bf9\u5e94\u7684calixxx\u63a5\u53e3，\u6b64\u65f6<\/h5>\n

    src-ip：10.244.89.5 dst-ip：10.244.169.3<\/p>\n

    src-mac：b2:65:39:08:87:b0 dst-mac：ee:ee:ee:ee:ee:ee<\/p>\n

    \u5728calixxx\u63a5\u53e3\u6293\u5305\u5982\u4e0b：<\/p>\n

    \"\"\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u6b64\u65f6\u53d1\u73b0\u4e00\u4e2a\u95ee\u9898，\u6211\u4eec\u5728client-pod\u5185\u67e5\u770b\u8def\u7531，\u53d1\u73b0\u9ed8\u8ba4\u8def\u7531\u662f169.254.1.1，\u5982\u4e0b\u56fe\u6240\u793a\u3002\u4f46\u662f169.254.1.1\u8fd9\u4e2a\u5730\u5740\u662f\u4e0d\u5b58\u5728\u7684，\u8fd9\u662f\u4ec0\u4e48\u60c5\u51b5？<\/p>\n

    \"\"<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u6839\u636e\u7f51\u7edc\u5e38\u8bc6，\u5f53\u6570\u636e\u5305\u76ee\u7684\u5730\u5740\u4e0d\u662f\u672c\u673a\u65f6，\u4f1a\u6839\u636e\u8def\u7531\u8868\u67e5\u8be2\u7f51\u5173，\u67e5\u8be2\u5230\u7f51\u5173\u540e\u53d1\u9001ARP\u8bf7\u6c42\u67e5\u8be2\u7f51\u5173MAC，\u7136\u540e\u4fee\u6539\u6570\u636e\u7684\u7684\u76ee\u6807MAC，\u6240\u4ee5\u65e0\u8bba\u8fd9\u4e2a\u5730\u5740\u662f\u4e0d\u662f\u5b58\u5728，\u53ea\u8981ARP\u8bf7\u6c42\u53ef\u4ee5\u83b7\u53d6\u5b83\u7684MAC\u5373\u53ef\u3002<\/p>\n

    \u6240\u4ee5，\u5728Pod\u5185\u67e5\u770b\u4e00\u4e0b169.254.1.1\u5bf9\u5e94\u7684MAC，\u5982\u4e0b\u56fe：<\/p>\n

    \"\"<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0169.254.1.1\u5bf9\u5e94\u7684MAC\u662fee:ee:ee:ee:ee:ee，\u8fd9\u662f\u4e3b\u673a\u4e0acalixxx\u63a5\u53e3\u7684MAC，\u4f46\u8fd9\u4e5f\u4e0d\u7b26\u5408\u903b\u8f91，\u4e3b\u673a\u4e0a\u7684calixxx\u63a5\u53e3\u6ca1\u6709\u8fd9\u4e2a\u5730\u5740，\u4e3a\u4ec0\u4e48ARP\u83b7\u53d6\u5230\u7684MAC\u662f\u5b83\u7684MAC？<\/p>\n

    \"\"<\/p>\n

    \u8fd9\u5176\u5b9e\u662f\u56e0\u4e3acalixxx\u63a5\u53e3\u542f\u7528\u4e86\u7f51\u5361\u7684ARP\u4ee3\u7406\u529f\u80fd，\u5982\u4e0b\u56fe：<\/p>\n

    \"\"<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u4ee3\u7406\u00a0ARP \u662f ARP \u534f\u8bae\u7684\u4e00\u4e2a\u53d8\u79cd，\u5f53 ARP \u8bf7\u6c42\u76ee\u6807\u8de8\u7f51\u6bb5\u65f6，\u7f51\u5173\u8bbe\u5907\u6536\u5230\u6b64 ARP \u8bf7\u6c42，\u4f1a\u7528\u81ea\u5df1\u7684 MAC \u5730\u5740\u8fd4\u56de\u7ed9\u8bf7\u6c42\u8005，\u8fd9\u4fbf\u662f\u4ee3\u7406 ARP（Proxy ARP）\u3002\u6240\u4ee5，Pod\u5185\u53d1\u9001\u7684ARP\u8bf7\u6c42\u5230\u8fbecalixxx\u63a5\u53e3\u65f6，calixxx\u63a5\u53e3\u76f4\u63a5\u8fd4\u56de\u4e86\u81ea\u5df1\u7684MAC\u3002<\/p>\n

    2）\u6570\u636e\u62a5\u6587\u6839\u636e\u4e3b\u673a\u8def\u7531\u8868，\u5c06\u62a5\u6587\u8f6c\u7ed9tunl0\u63a5\u53e3\u8fdb\u884cIPIP\u5c01\u88c5<\/h5>\n

    tunl0\u63a5\u53e3\u6293\u5305\u5982\u4e0b：<\/p>\n

    \"\"<\/p>\n

    \u6b64\u65f6\u5e94\u8be5\u662f\u628a\u5916\u5c42\u7684MAC\u5934\u90e8\u7ed9\u53bb\u6389\u4e86，\u7136\u540e\u8fdb\u884cIPIP\u5c01\u88c5<\/span><\/span><\/p>\n

    3）\u5c01\u88c5\u597d\u7684IPIP\u6570\u636e\u62a5\u6587\u901a\u8fc7\u4e3b\u673a\u63a5\u53e3ens33\u53d1\u51fa ，\u6b64\u65f6<\/h5>\n

    inner-src-ip: 10.224.89.5 inner-dst-ip：10.224.169.3<\/p>\n

    outer-src-ip：192.168.211.11 outer-dst-ip：192.168.211.12<\/p>\n

    src-mac：00:0c:29:51:81:05 dst-mac：00:0c:29:99:52:7b<\/p>\n

    192.168.211.12\u4e3b\u673a\u73e0\u5b9d\u5982\u4e0b<\/p>\n

    \u6355\u83b7\u4e3b\u673a\u00a0192.168.211.11 \u548c\u4e3b\u673a192.168.211.12\u7684\u6240\u6709\u901a\u4fe1\u6570\u636e\u5305<\/p>\n

    tcpdump -i ens33 -nn host 192.168.211.11 and 192.168.211.12 <\/p>\n

    \"\"<\/p>\n

    4）node-02\u6536\u5230\u62a5\u6587\u540e\u8fdb\u884c\u89e3\u5c01\u88c5，\u7136\u540e\u53d1\u9001\u7ed9ngix-pod<\/h5>\n

    \u5173\u4e8eCalico\u5176\u5b83\u6a21\u5f0f\u7684\u914d\u7f6e\u548c\u4f7f\u7528，\u53ef\u4ee5\u53c2\u8003\u5b98\u7f51：<\/span><\/span><\/p>\n

    https:\/\/projectcalico.docs.tigera.io\/about\/about-calico<\/p>\n

    \n

    \u56db\u3001k8s\u7f51\u7edc\u7b56\u7565<\/h3>\n

    \"\"<\/h4>\n

    1\u3001\u7f51\u7edc\u7b56\u7565\u4ecb\u7ecd<\/h4>\n

    \u7f51\u7edc\u7b56\u7565\u5b98\u65b9\u6587\u6863：<\/p>\n

    https:\/\/kubernetes.io\/zh-cn\/docs\/concepts\/services-networking\/network-policies\/<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u7f51\u7edc\u7b56\u7565\u662f\u63a7\u5236Pod\u4e4b\u95f4\u5982\u4f55\u8fdb\u884c\u901a\u4fe1\u7684\u89c4\u5219，\u5b83\u4f7f\u7528\u6807\u7b7e\u6765\u7b5b\u9009Pod，\u5e76\u5728\u8be5\u7ec4Pod\u4e4b\u4e0a\u5b9a\u4e49\u89c4\u5219\u6765\u5b9a\u4e49\u7ba1\u63a7\u5176\u6d41\u91cf，\u4ece\u800c\u4e3ak8s\u63d0\u4f9b\u66f4\u7cbe\u7ec6\u7684\u6d41\u91cf\u63a7\u5236\u548c\u79df\u6237\u9694\u79bb\u673a\u5236\u3002\u7ba1\u7406\u5458\u548c\u7528\u6237\u53ef\u4ee5\u901a\u8fc7NetworkPolicy\u8d44\u6e90\u6309\u9700\u5b9a\u4e49\u7f51\u7edc\u8bbf\u95ee\u63a7\u5236\u7b56\u7565<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u7f51\u7edc\u7b56\u7565\u7684\u5177\u4f53\u5b9e\u73b0\u8981\u4f9d\u9760CNI\u7f51\u7edc\u63d2\u4ef6\u5b8c\u6210，\u4f8b\u5982Calico\u3001Weave\u548cAntrea\u7b49\u3002\u56e0\u6b64，\u4ec5\u5728\u4f7f\u7528\u652f\u6301\u7f51\u7edc\u7b56\u7565\u7684\u7f51\u7edc\u63d2\u4ef6\u65f6\u624d\u80fd\u8ba9\u81ea\u5b9a\u4e49\u7684\u7f51\u7edc\u7b56\u7565\u751f\u6548\u3002\u4e0d\u540c\u7684\u7f51\u7edc\u63d2\u4ef6\u5b9e\u73b0\u7f51\u7edc\u7b56\u7565\u7684\u65b9\u5f0f\u4e5f\u662f\u4e0d\u4e00\u6837\u7684\u3002<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u672c\u6587\u4ee5Calico\u7f51\u7edc\u63d2\u4ef6\u4e3a\u4f8b，\u5b83\u7684calico-kube-contollers\u662f\u7528\u4e8e\u5c06\u7528\u6237\u81ea\u5b9a\u4e49\u7684\u7f51\u7edc\u7b56\u7565\u8fdb\u884c\u5b9e\u73b0\u7684\u7ec4\u4ef6，\u5b83\u4e3b\u8981\u4f9d\u8d56\u4e8e\u5728\u8282\u70b9\u4e0a\u6784\u5efaiptales\u89c4\u5219\u5b9e\u73b0\u8bbf\u95ee\u63a7\u5236\u529f\u80fd\u3002<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u9ed8\u8ba4\u60c5\u51b5\u4e0b，k8s\u5e76\u672a\u5bf9Pod\u7684\u6d41\u91cf\u505a\u4efb\u4f55\u9650\u5236\u3002Pod\u5bf9\u8c61\u80fd\u591f\u4e0e\u96c6\u7fa4\u4e0a\u5176\u4ed6\u4efb\u4f55Pod\u901a\u4fe1，\u4e5f\u80fd\u591f\u4e0e\u96c6\u7fa4\u5916\u90e8\u7684\u7f51\u7edc\u7aef\u70b9\u901a\u4fe1\u3002NetworkPolicy\u662f\u540d\u79f0\u7a7a\u95f4\u7ea7\u522b\u8d44\u6e90，\u5141\u8bb8\u7528\u6237\u5728\u901a\u8fc7\u6807\u7b7e\u9009\u62e9\u5668\u7b5b\u9009\u7684\u4e00\u7ec4Pod\u4e0a\u5206\u522b\u7ba1\u7406\u5165\u7ad9（Ingress）\u548c\u51fa\u7ad9（Egress）\u6d41\u91cf\u3002\u5c06NetworkPolicy\u5e94\u7528\u5230\u540d\u79f0\u7a7a\u95f4\u4e2d\u540e，\u88ab\u6807\u7b7e\u9009\u62e9\u5668\u9009\u4e2d\u7684Pod\u5c06\u9ed8\u8ba4\u62d2\u7edd\u6240\u6709\u6d41\u91cf，\u4ec5\u653e\u884c\u7531NetworkPolicy\u8d44\u6e90\u660e\u786e\u5141\u8bb8\u7684\u6d41\u91cf\u3002\u672a\u88abNetworkPolicy\u8d44\u6e90\u7684\u6807\u7b7e\u9009\u62e9\u5668\u9009\u4e2d\u7684Pod\u5bf9\u8c61\u7684\u6d41\u91cf\u5219\u4e0d\u53d7\u5f71\u54cd\u3002<\/p>\n

    \n

    NetworkPolicy\u662fKubernetes API\u4e2d\u6807\u51c6\u7684\u8d44\u6e90\u7c7b\u578b，\u5b83\u7684\u90e8\u7f72\u6587\u4ef6\u5e38\u7528\u5b57\u6bb5\u5982\u4e0b：<\/p>\n

    apiVersion: networking.k8s.io\/v1<\/p>\n

    kind: NetworkPolicy<\/p>\n

    metadata:<\/p>\n

    name: …<\/p>\n

    namespace: …<\/p>\n

    spec:<\/p>\n

    podSelector: <Object> #Pod\u6807\u7b7e\u9009\u62e9\u5668，\u7528\u6765\u5728\u5f53\u524d\u540d\u79f0\u7a7a\u95f4\u4e0b\u7b5b\u9009\u51fa\u4e00\u7ec4Pod，\u4e4b\u540e\u5b9a\u4e49\u7684\u51fa\u5165\u7ad9\u89c4\u5219\u5bf9\u6b64\u7ec4Pod\u751f\u6548<\/p>\n

    policyTypes: <[]string> #\u7f51\u7edc\u7b56\u7565\u7c7b\u578b，Ingress\u8868\u793a\u5bf9\u5165\u7ad9\u6d41\u91cf\u9650\u5236；Egress\u8868\u793a\u5bf9\u51fa\u7ad9\u6d41\u91cf\u9650\u5236，\u540c\u65f6\u63d0\u4f9b\u8868\u793a\u90fd\u9650\u5236<\/p>\n

    ingress: #\u5141\u8bb8\u901a\u8fc7\u7684\u5165\u7ad9\u6d41\u91cf\u7684\u89c4\u5219\u5b9a\u4e49，\u7a7a\u503c\u8868\u793a\u5141\u8bb8\u6240\u6709\u7684\u5165\u7ad9\u6d41\u91cf\u901a\u8fc7<\/p>\n

    – from: #\u5141\u8bb8\u901a\u8fc7\u7684\u5165\u7ad9\u6d41\u91cf\u7684\u6e90\u7aef\u70b9\u5217\u8868，\u7a7a\u503c\u8868\u793a\u6240\u6709\u7aef\u70b9<\/p>\n

    – ipBlock: #\u7528IP\u5730\u5740\u8303\u56f4\u5339\u914d\u6e90\u7aef\u70b9，\u4e0d\u80fd\u4e0e\u4e0b\u9762\u7684namespacesSelector\u548cpodSelector\u540c\u65f6\u4f7f\u7528<\/p>\n

    cidr: <string> #\u6e90\u7aef\u70b9\u7684IP\u7f51\u6bb5<\/p>\n

    except: <[]string> #\u4ececidr\u4e2d\u6392\u9664\u7684\u7f51\u6bb5\u8303\u56f4\u6216\u5730\u5740，\u8fd9\u4e9b\u6e90\u7aef\u70b9\u4e0d\u80fd\u8bbf\u95ee\u6307\u5b9a\u7684Pod<\/p>\n

    namespacesSelector: <Object> #\u7531\u6807\u7b7e\u9009\u62e9\u5668\u7b5b\u9009\u7684\u540d\u79f0\u7a7a\u95f4\u4e2d\u7684\u7aef\u70b9，\u7a7a\u503c\u8868\u793a\u6240\u6709\u540d\u79f0\u7a7a\u95f4<\/p>\n

    podSelector: <Object> #\u7531\u6807\u7b7e\u9009\u62e9\u5668\u7b5b\u9009\u7684Pod\u7aef\u70b9，\u7a7a\u503c\u8868\u793anone<\/p>\n

    ports: <[]Object> #\u5165\u7ad9\u6d41\u91cf\u7684\u76ee\u6807\u7aef\u53e3\u5217\u8868，\u7a7a\u503c\u8868\u793a\u6240\u6709\u7aef\u53e3<\/p>\n

    egress: #\u5141\u8bb8\u901a\u8fc7\u7684\u51fa\u7ad9\u6d41\u91cf\u7684\u89c4\u5219\u5b9a\u4e49，\u7a7a\u503c\u8868\u793a\u5141\u8bb8\u6240\u6709\u51fa\u7ad9\u6d41\u91cf\u901a\u8fc7<\/p>\n

    – to: <[]Object> #\u5141\u8bb8\u51fa\u7ad9\u6d41\u91cf\u8bbf\u95ee\u7684\u76ee\u6807\u7aef\u70b9\u5bf9\u8c61\u5217\u8868，\u7a7a\u503c\u8868\u793a\u6240\u6709\u7aef\u70b9，\u53ef\u5d4c\u5957\u5b57\u6bb5\u901aingress.from<\/p>\n

    ports: <[]Object> #\u5141\u8bb8\u51fa\u7ad9\u6d41\u91cf\u8bbf\u95ee\u7684\u76ee\u6807\u7aef\u53e3\u5bf9\u8c61\u5217\u8868，\u7a7a\u503c\u8868\u793a\u6240\u6709\u7aef\u53e3 <\/p>\n

    \n

    \u4e3a\u4e86\u65b9\u4fbf\u7406\u89e3NetworkPolicy\u8d44\u6e90\u53ca\u5176\u529f\u80fd，\u5e38\u7528\u7684\u672f\u8bed\u5982\u4e0b：<\/h5>\n
  • Pod\u7ec4：\u7531NetworkPolicy\u901a\u8fc7\u6807\u7b7e\u9009\u62e9\u5668\u7b5b\u9009\u51fa\u7684\u4e00\u7ec4Pod，\u5b83\u4eec\u662f\u7f51\u7edc\u7b56\u7565\u89c4\u5219\u7ba1\u63a7\u7684\u76ee\u6807<\/li>\n
  • Egress\u89c4\u5219：\u51fa\u7ad9\u6d41\u91cf\u76f8\u5173\u7684\u89c4\u5219，\u8d1f\u8d23\u7ba1\u63a7\u9009\u5b9a\u7684Pod\u7ec4\u53d1\u5f80\u5176\u5b83\u7aef\u70b9\u7684\u6d41\u91cf，\u53ef\u7531\u6d41\u91cf\u7684\u76ee\u6807\u7aef\u70b9（spec.egress.to）\u548c\u76ee\u6807\u7aef\u53e3（spec.egress.ports）\u6765\u5b9a\u4e49<\/li>\n
  • Ingress\u89c4\u5219：\u5165\u7ad9\u6d41\u91cf\u7684\u76f8\u5173\u89c4\u5219，\u8d1f\u8d23\u7ba1\u63a7\u9009\u5b9a\u7684Pod\u7ec4\u6240\u80fd\u63a5\u6536\u7684\u6d41\u91cf，\u53ef\u7531\u6d41\u91cf\u7684\u6e90\u7aef\u70b9（spec.ingress.from）\u548c\u6d41\u91cf\u7684\u76ee\u6807\u7aef\u53e3（spec.ingress.ports）\u6765\u5b9a\u4e49<\/li>\n
  • \u5bf9\u7aef\u7aef\u70b9：\u4e0e\u9009\u5b9a\u7684Pod\u7ec4\u4ea4\u4e92\u7684\u5bf9\u7aef\u4e3b\u673a，\u53ef\u4ee5\u7531CIDR\u683c\u5f0f\u7684\u5730\u5740\u6bb5（ipBlock）\u6765\u5339\u914d\u6307\u5b9a\u5730\u5740\u6bb5\u5185\u7684Pod\u5bf9\u8c61\u3001\u540d\u79f0\u7a7a\u95f4\u9009\u62e9\u5668（namespacesSelector）\u6765\u5339\u914d\u540d\u79f0\u7a7a\u95f4\u5185\u7684\u6240\u6709Pod\u5bf9\u8c61，\u4e5f\u53ef\u4ee5\u7ed3\u5408Pod\u9009\u62e9\u5668（podSelector）\u5728\u6307\u5b9a\u540d\u79f0\u7a7a\u95f4\u9009\u51fa\u4e00\u7ec4Pod\u5bf9\u8c61<\/li>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u5728Ingress\u89c4\u5219\u4e2d，\u7531from\u5b57\u6bb5\u6307\u5b9a\u7684\u7aef\u70b9\u79f0\u4e3a\u6e90\u7aef\u70b9；\u800c\u5728Egress\u89c4\u5219\u4e2d，\u7f51\u7edc\u7aef\u70b9\u4e5f\u79f0\u4e3a\u76ee\u6807\u7aef\u70b9，\u7528to\u5b57\u6bb5\u6807\u8bc6\u3002\u5bf9\u4e8e\u672a\u542f\u7528Ingress\u6216Egress\u89c4\u5219\u7684Pod\u7ec4，\u51fa\u7ad9\u548c\u5165\u7ad9\u6d41\u91cf\u9ed8\u8ba4\u5747\u4e3a\u5141\u8bb8\u3002\u4e00\u65e6\u5728networkpolicy.spec\u4e2d\u5b9a\u4e49\u4e86ingress\u6216egress\u5b57\u6bb5，\u5219\u5b83\u4eec\u7684from\u6216to\u5b57\u6bb5\u5c31\u4ee3\u8868\u767d\u540d\u5355\u5217\u8868，\u7a7a\u503c\u610f\u5473\u7740\u9009\u5b9a\u6240\u6709\u7aef\u70b9，\u5373\u5141\u8bb8\u76f8\u5e94\u65b9\u5411\u4e0a\u6240\u6709\u6d41\u91cf\u901a\u8fc7，\u6b64\u65f6ingress\u548cegress\u5b57\u6bb5\u4f5c\u7528\u4e0e\u672a\u542f\u7528\u6d41\u91cf\u65b9\u5411\u8bbe\u7f6e（\u5373spec.policyTypes\u5b57\u6bb5\u4e3a\u7a7a）\u65f6\u76f8\u540c\u3002<\/p>\n

    Ingress\u548cEgress\u7684\u751f\u6548\u903b\u8f91\u7565\u5fae\u590d\u6742，Egress\u89c4\u5219\u751f\u6548\u903b\u8f91\u548cIngress\u7c7b\u4f3c，\u4ee5Ingress\u89c4\u5219\u4e3a\u4f8b：<\/p>\n

    1）\u5b9a\u4e49\u4e86spec.policyTypes\u503c\u4e3aIngress，\u4f46\u672a\u5b9a\u4e49spec.ingress\u5b57\u6bb5\u65f6，\u5b83\u65e0\u6cd5\u5339\u914d\u4efb\u4f55\u6d41\u91cf，\u56e0\u6b64\u9009\u5b9a\u7684Pod\u7ec4\u4e0d\u63a5\u53d7\u4efb\u4f55\u7aef\u70b9\u8bbf\u95ee<\/p>\n

    2）\u5b9a\u4e49\u4e86spec.policyTypes\u503c\u4e3aIngress，\u4f46\u4f7f\u7528\u7a7a\u503c\u7684spec.ingress\u6216spec.ingress.from\u5b57\u6bb5，\u8868\u793a\u5339\u914d\u6240\u6709\u7684\u7aef\u70b9，\u56e0\u800c\u9009\u51fa\u7684Pod\u7ec4\u53ef\u4ee5\u88ab\u4efb\u610f\u7aef\u70b9\u8bbf\u95ee<\/p>\n

    3）\u6700\u540e，\u5373\u4f7fEgress\u89c4\u5219\u62d2\u7edd\u6240\u6709\u6d41\u91cf，\u4f46\u7531Ingress\u89c4\u5219\u653e\u884c\u7684\u8bf7\u6c42\u6d41\u91cf\u7684\u54cd\u5e94\u62a5\u6587\u4f9d\u7136\u80fd\u591f\u6b63\u5e38\u51fa\u7ad9，\u5b83\u5e76\u4e0d\u53d7\u9650\u4e8eEgress\u89c4\u5219\u7684\u9650\u5236，\u53cd\u4e4b\u4ea6\u7136<\/p>\n

    \n

    2\u3001Ingress\u89c4\u5219<\/h4>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u5728\u5b9e\u9645\u73af\u5883\u4e2d，\u6709\u4e9bPod\u63d0\u4f9b\u7684\u670d\u52a1\u4e0d\u9700\u8981\u6216\u4e0d\u80fd\u516c\u5f00\u7ed9\u6240\u6709\u4eba\u8bbf\u95ee，\u8fd9\u65f6\u5019\u5c31\u9700\u8981\u5bf9\u5b83\u4eec\u65bd\u52a0\u8bbf\u95ee\u63a7\u5236\u3002\u5728\u9700\u8981\u7ba1\u63a7\u7684Pod\u5bf9\u8c61\u6240\u5728\u7684\u540d\u79f0\u7a7a\u95f4\u521b\u5efa\u4e00\u4e2aNetworkPolicy\u8d44\u6e90，\u4f7f\u7528spec.podSelector\u7b5b\u9009\u8981\u7ba1\u63a7\u7684Pod，\u5e76\u4f7f\u7528spec.ingress\u5b9a\u4e49\u5165\u7ad9\u89c4\u5219\u5c31\u5b9e\u73b0\u5165\u7ad9\u6d41\u91cf\u7ba1\u63a7\u3002<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0spec.ingress\u53ef\u5d4c\u5957\u7684from\u548cports\u5747\u4e3a\u53ef\u9009\u5b57\u6bb5，\u7a7a\u503c\u8868\u793a\u5141\u8bb8\u6240\u6709\u5165\u7ad9\u6d41\u91cf\u901a\u8fc7\u3002\u4ec5\u5b9a\u4e49from\u5b57\u6bb5\u65f6\u8868\u793a\u5165\u7ad9\u6d41\u91cf\u7684\u76ee\u6807\u7aef\u53e3\u4e0d\u505a\u9650\u5236，\u4ec5\u5b9a\u4e49ports\u5b57\u6bb5\u65f6\u8868\u793a\u5165\u7ad9\u6d41\u91cf\u7684\u6e90\u7aef\u70b9\u4e0d\u505a\u9650\u5236\u3002from\u548cports\u5b9a\u4e49\u5728\u4e00\u4e2a\u5217\u8868\u9879\u65f6，\u5b83\u4eec\u662f\u903b\u8f91\u4e0e\u5173\u7cfb，\u8868\u793a\u5339\u914d\u90a3\u4e9b\u540c\u65f6\u6ee1\u8db3from\u548cports\u7684\u5165\u7ad9\u6d41\u91cf<\/p>\n

    ingress.from\u5b57\u6bb5<\/h5>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0from\u5b57\u6bb5\u7684\u503c\u662f\u4e00\u4e2a\u5217\u8868，\u7528\u4e8e\u6307\u5b9a\u8bbf\u95ee\u76ee\u6807Pod\u7ec4\u5165\u7ad9\u6d41\u91cf\u7684\u6765\u6e90，\u53ef\u5d4c\u5957\u4f7f\u7528ipBlock\u3001namespaceSelector\u548cpodSelector 3\u4e2a\u5b57\u6bb5\u3002\u8fd93\u4e2a\u5b57\u6bb5\u5339\u914dPod\u7684\u65b9\u5f0f\u5404\u6709\u4e0d\u540c，\u4e14ipBlock\u4e0d\u80fd\u548c\u53e6\u5916\u4e24\u4e2a\u5b57\u6bb5\u540c\u65f6\u4f7f\u7528，\u540c\u65f6\u4f7f\u7528namespaceSelector\u548cpodSelector\u8fd9\u4e24\u4e2a\u5b57\u6bb5\u65f6\u5b83\u4eec\u662f\u903b\u8f91\u4e0e\u5173\u7cfb\u3002from\u4e0b\u7684\u591a\u4e2a\u5217\u8868\u9879\u662f\u903b\u8f91\u6216\u5173\u7cfb，\u5165\u7ad9\u6d41\u91cf\u53ea\u8981\u80fd\u5339\u914d\u5176\u4e2d\u4e00\u4e2a\u5c31\u53ef\u4ee5\u3002<\/p>\n

    1）ipBlock：\u6839\u636eIP\u5730\u5740\u6216\u7f51\u7edc\u5730\u5740\u6765\u5339\u914d\u6e90\u7aef\u70b9<\/p>\n

    2）namespaceSelector：\u4f7f\u7528\u6807\u7b7e\u9009\u62e9\u5668\u7b5b\u9009\u540d\u79f0\u7a7a\u95f4，\u5b83\u5c06\u5339\u914d\u7b5b\u9009\u51fa\u7684\u540d\u79f0\u7a7a\u95f4\u5185\u7684\u6240\u6709Pod\u5bf9\u8c61；\u7a7a\u503c\u8868\u793a\u5339\u914d\u6240\u6709\u540d\u79f0\u7a7a\u95f4，\u5373\u6e90\u7aef\u70b9\u53ef\u4ee5\u662f\u96c6\u7fa4\u4e0a\u7684\u4efb\u610fPod\u5bf9\u8c61<\/p>\n

    3）podSelector：\u5728NetworkPolicy\u8d44\u6e90\u6240\u5728\u7684\u540d\u79f0\u7a7a\u95f4\u4e2d\u57fa\u4e8e\u6807\u7b7e\u9009\u62e9\u5668\u7b5b\u9009Pod\u5bf9\u8c61，\u7a7a\u503c\u8868\u793a\u9009\u4e2d\u5f53\u524d\u540d\u79f0\u7a7a\u95f4\u6240\u6709Pod\u5bf9\u8c61\u3002\u4e0enamespaceSelector\u540c\u65f6\u4f7f\u7528\u65f6，\u4f5c\u7528\u57df\u4e3anamespaceSelector\u7b5b\u9009\u51fa\u7684\u540d\u79f0\u7a7a\u95f4<\/p>\n

    ingress.ports \u5b57\u6bb5<\/h5>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0ports\u5b57\u6bb5\u7684\u503c\u4e5f\u662f\u4e00\u4e2a\u5bf9\u8c61\u5217\u8868，\u7528\u4e8e\u5b9a\u4e49\u5165\u7ad9\u6d41\u91cf\u53ef\u4ee5\u8bbf\u95ee\u7684\u76ee\u6807\u7aef\u53e3，\u53ef\u4ee5\u5d4c\u5957\u4f7f\u7528port\u548cprotocol\u5b57\u6bb5<\/p>\n

    1）port：\u7aef\u53e3\u53f7\u6216\u5728container\u4e0a\u5b9a\u4e49\u7684\u7aef\u53e3\u540d\u79f0，\u672a\u5b9a\u4e49\u65f6\u5339\u914d\u6240\u6709\u7aef\u53e3<\/p>\n

    2）protocol： \u534f\u8bae，TCP\u6216UDP，\u9ed8\u8ba4TCP<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u4e0b\u9762\u521b\u5efa\u4e00\u4e9b\u8d44\u6e90，\u7528\u6765\u540e\u7eed\u6d4b\u8bd5\u7f51\u7edc\u7b56\u7565\u7684\u529f\u80fd，\u5305\u62ec\u4e24\u4e2a\u540d\u79f0\u7a7a\u95f4project1\u548cproject2，\u5728project1\u540d\u79f0\u7a7a\u95f4\u4e0b\u90e8\u7f72\u4e00\u4e2anginx\u548ctomcat，\u5728project2\u540d\u79f0\u7a7a\u95f4\u4e0b\u90e8\u7f72\u4e00\u4e2anginx，\u90e8\u7f72\u6587\u4ef6\u5982\u4e0b：<\/p>\n

    [root@k8s-master1 ~]# cat ingress.yaml<\/p>\n

    apiVersion: v1<\/p>\n

    kind: Namespace<\/p>\n

    metadata:<\/p>\n

    name: project1<\/p>\n

    labels:<\/p>\n

    name: project1<\/p>\n

    —<\/p>\n

    apiVersion: v1<\/p>\n

    kind: Namespace<\/p>\n

    metadata:<\/p>\n

    name: project2<\/p>\n

    labels:<\/p>\n

    name: project2<\/p>\n

    —<\/p>\n

    apiVersion: apps\/v1<\/p>\n

    kind: Deployment<\/p>\n

    metadata:<\/p>\n

    name: nginx-project1<\/p>\n

    namespace: project1<\/p>\n

    spec:<\/p>\n

    replicas: 1<\/p>\n

    selector:<\/p>\n

    matchLabels:<\/p>\n

    app: nginx<\/p>\n

    project: project1<\/p>\n

    template:<\/p>\n

    metadata:<\/p>\n

    labels:<\/p>\n

    app: nginx<\/p>\n

    project: project1<\/p>\n

    tier: fronted<\/p>\n

    spec:<\/p>\n

    containers:<\/p>\n

    – name: nginx<\/p>\n

    image: nginx<\/p>\n

    imagePullPolicy: IfNotPresent<\/p>\n

    ports:<\/p>\n

    – name: http<\/p>\n

    containerPort: 80<\/p>\n

    —<\/p>\n

    apiVersion: apps\/v1<\/p>\n

    kind: Deployment<\/p>\n

    metadata:<\/p>\n

    name: tomcat-project1<\/p>\n

    namespace: project1<\/p>\n

    spec:<\/p>\n

    replicas: 1<\/p>\n

    selector:<\/p>\n

    matchLabels:<\/p>\n

    app: tomcat<\/p>\n

    project: project1<\/p>\n

    tier: backend<\/p>\n

    template:<\/p>\n

    metadata:<\/p>\n

    labels:<\/p>\n

    app: tomcat<\/p>\n

    project: project1<\/p>\n

    tier: backend<\/p>\n

    spec:<\/p>\n

    containers:<\/p>\n

    – name: tomcat<\/p>\n

    image: tomcat:10.1.2<\/p>\n

    imagePullPolicy: IfNotPresent<\/p>\n

    ports:<\/p>\n

    – name: http<\/p>\n

    containerPort: 8080<\/p>\n

    —<\/p>\n

    apiVersion: v1<\/p>\n

    kind: Service<\/p>\n

    metadata:<\/p>\n

    name: nginx-svc-project1<\/p>\n

    namespace: project1<\/p>\n

    spec:<\/p>\n

    type: NodePort<\/p>\n

    selector:<\/p>\n

    app: nginx<\/p>\n

    project: project1<\/p>\n

    ports:<\/p>\n

    – name: http<\/p>\n

    port: 80<\/p>\n

    targetPort: 80<\/p>\n

    protocol: TCP<\/p>\n

    —<\/p>\n

    apiVersion: apps\/v1<\/p>\n

    kind: Deployment<\/p>\n

    metadata:<\/p>\n

    name: nginx-project2<\/p>\n

    namespace: project2<\/p>\n

    spec:<\/p>\n

    replicas: 1<\/p>\n

    selector:<\/p>\n

    matchLabels:<\/p>\n

    app: nginx<\/p>\n

    project: project2<\/p>\n

    template:<\/p>\n

    metadata:<\/p>\n

    labels:<\/p>\n

    app: nginx<\/p>\n

    project: project2<\/p>\n

    spec:<\/p>\n

    containers:<\/p>\n

    – name: nginx<\/p>\n

    image: nginx<\/p>\n

    imagePullPolicy: IfNotPresent<\/p>\n

    ports:<\/p>\n

    – name: http<\/p>\n

    containerPort: 80<\/p>\n

    —<\/p>\n

    apiVersion: v1<\/p>\n

    kind: Service<\/p>\n

    metadata:<\/p>\n

    name: nginx-svc-project2<\/p>\n

    namespace: project2<\/p>\n

    spec:<\/p>\n

    type: NodePort<\/p>\n

    selector:<\/p>\n

    app: nginx<\/p>\n

    project: project2<\/p>\n

    ports:<\/p>\n

    – name: http<\/p>\n

    port: 80<\/p>\n

    targetPort: 80<\/p>\n

    protocol: TCP <\/p>\n

    [root@k8s-master1 ~]# kubectl apply -f ingress.yaml<\/p>\n

    [root@k8s-master1 ~]# kubectl get pod -n project1 -o wide –show-labels<\/p>\n

    [root@k8s-master1 ~]# kubectl get pod -n project2 -o wide –show-labels<\/p>\n

    \"\"<\/p>\n

    \u5728tomcat\u5bb9\u5668\u4e2d\u521b\u5efa\u6d4b\u8bd5\u9875<\/p>\n

    [root@k8s-master1 ~]# kubectl -n project1 exec -it tomcat-project1-df99dd58c-ncc82 — sh<\/p>\n

    # mkdir \/usr\/local\/tomcat\/webapps\/ROOT<\/p>\n

    # echo "project1 tomcat web page" > index.html<\/p>\n

    # curl localhost:8080<\/p>\n

    project1 tomcat web page <\/p>\n

    \n

    \u793a\u4f8b1：\u9650\u5b9a\u6307\u5b9a\u7684\u6807\u7b7e\u7684Pod\u624d\u80fd\u8bbf\u95eeproject1\u540d\u79f0\u7a7a\u95f4\u4e0b\u7684tomcat pod<\/h5>\n

    [root@k8s-master1 ~]# cat ingress_networkpolicy1.yaml<\/p>\n

    apiVersion: networking.k8s.io\/v1<\/p>\n

    kind: NetworkPolicy<\/p>\n

    metadata:<\/p>\n

    name: network-policy-demo1<\/p>\n

    namespace: project1<\/p>\n

    spec:<\/p>\n

    policyTypes: ["Ingress"]<\/p>\n

    podSelector: #\u89c4\u5219\u9488\u5bf9tomcat Pod\u751f\u6548<\/p>\n

    matchLabels:<\/p>\n

    app: tomcat<\/p>\n

    project: project1<\/p>\n

    tier: backend<\/p>\n

    ingress:<\/p>\n

    – from:<\/p>\n

    – podSelector: #\u62e5\u6709\u4e0b\u9762\u6307\u5b9a\u6807\u7b7e\u7684Pod\u624d\u80fd\u8bbf\u95eetomcat Pod，\u9ed8\u8ba4\u662f\u5728\u5f53\u524d\u540d\u79f0\u7a7a\u95f4\u4e0b\u7b5b\u9009<\/p>\n

    matchLabels:<\/p>\n

    app: nginx<\/p>\n

    project: project1<\/p>\n

    tier: fronted<\/p>\n

    ports: #\u53ea\u80fd\u8bbf\u95eetomcat Pod\u76848080\u7aef\u53e3<\/p>\n

    – port: 8080<\/p>\n

    protocol: TCP <\/p>\n

    \u521b\u5efa\u5e76<\/span><\/span>\u67e5\u770bnetworkpPolicy\u8d44\u6e90<\/span><\/span><\/p>\n

    [root@k8s-master1 ~]# kubectl apply -f ingress_networkpolicy1.yaml<\/p>\n

    networkpolicy.networking.k8s.io\/network-policy-demo1 created<\/p>\n

    [root@k8s-master1 ~]# kubectl get networkpolicy -n project1<\/p>\n

    NAME POD-SELECTOR AGE<\/p>\n

    network-policy-demo1 app=tomcat,project=project1,tier=backend 32s<\/p>\n

    [root@k8s-master1 ~]# kubectl describe networkpolicy\/network-policy-demo1 -n project1<\/p>\n

    Name: network-policy-demo1<\/p>\n

    Namespace: project1<\/p>\n

    Created on: 2023-03-06 13:46:14 +0800 CST<\/p>\n

    Labels: <none><\/p>\n

    Annotations: <none><\/p>\n

    Spec:<\/p>\n

    PodSelector: app=tomcat,project=project1,tier=backend<\/p>\n

    Allowing ingress traffic:<\/p>\n

    To Port: 8080\/TCP<\/p>\n

    From:<\/p>\n

    PodSelector: app=nginx,project=project1,tier=fronted<\/p>\n

    Not affecting egress traffic<\/p>\n

    Policy Types: Ingress <\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u7528\u540c\u540d\u79f0\u7a7a\u95f4\u4e0bnginx pod\u8bbf\u95eetomcat Pod，\u53ef\u4ee5\u8bbf\u95ee，\u56e0\u4e3anginx pod\u7684\u6807\u7b7e\u7b26\u5408NetworkPolicy\u7684\u8bbe\u5b9a\u3002 \u00a0<\/p>\n

    [root@k8s-master1 ~]# kubectl -n project1 exec -it pods\/nginx-project1-7b9c9d6f59-rx7v8 — sh<\/p>\n

    # curl 10.224.85.200:8080<\/p>\n

    project1 tomcat web page<\/p>\n

    # <\/p>\n

    \"\"<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u5728default\u540d\u79f0\u7a7a\u95f4\u4e2d\u4f7f\u7528pod\u8bbf\u95eeproject1\u540d\u79f0\u7a7a\u95f4\u4e0b\u7684tomcat，\u65e0\u6cd5\u8bbf\u95ee，\u56e0\u4e3apod\u7684\u6807\u7b7e\u4e0d\u7b26\u5408NetworkPolicy\u7684\u8bbe\u5b9a<\/p>\n

    \"\"<\/p>\n

    [root@k8s-master1 ~]# kubectl exec -it pods\/nginx-5df7494dc-qlvlm — sh<\/p>\n

    # curl 10.224.85.200:8080<\/p>\n

    curl: (28) Failed to connect to 10.224.85.200 port 8080: Connection timed out<\/span><\/p>\n

    \"\"<\/h5>\n
    \u793a\u4f8b2：\u901a\u8fc7ip\u5730\u5740\u9650\u5b9a\u53ef\u4ee5\u8bbf\u95eetomcat\u7684Pod<\/h5>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u5728node-01\u548cnode-02\u4e0a\u5206\u522b\u8fd0\u884c\u4e00\u4e2apod，\u7136\u540e\u53bb\u8bbf\u95eetomcat，node-01\u4e0a\u7684pod\u53ef\u4ee5\u8bbf\u95ee，node-02\u4e0a\u7684pod\u4e0d\u80fd\u8bbf\u95ee，\u56e0\u4e3a\u5b83\u5c5e\u4e8e10.224.58.192\/26\u7f51\u6bb5<\/p>\n

    \"\"<\/p>\n

    \u521b\u5efa\u5e76\u67e5\u770bnetworkpolicy<\/h5>\n

    [root@k8s-master1 ~]# cat ingress_networkpolicy2.yaml<\/p>\n

    apiVersion: networking.k8s.io\/v1<\/p>\n

    kind: NetworkPolicy<\/p>\n

    metadata:<\/p>\n

    name: network-policy-demo2<\/p>\n

    namespace: project1<\/p>\n

    spec:<\/p>\n

    policyTypes: ["Ingress"]<\/p>\n

    podSelector:<\/p>\n

    matchLabels:<\/p>\n

    app: tomcat<\/p>\n

    project: project1<\/p>\n

    tier: backend<\/p>\n

    ingress:<\/p>\n

    – from:<\/p>\n

    – ipBlock:<\/p>\n

    cidr: 10.224.0.0\/16<\/p>\n

    except:<\/p>\n

    – 10.224.58.192\/26<\/p>\n

    ports:<\/p>\n

    – port: 8080<\/p>\n

    protocol: TCP <\/p>\n

    \u521b\u5efanetworkpolicy<\/p>\n

    [root@k8s-master1 ~]# kubectl apply -f ingress_networkpolicy2.yaml<\/p>\n

    networkpolicy.networking.k8s.io\/network-policy-demo2 created<\/p>\n

    [root@k8s-master1 ~]# kubectl describe networkpolicy\/network-policy-demo2 -n project1<\/p>\n

    Name: network-policy-demo2<\/p>\n

    Namespace: project1<\/p>\n

    Created on: 2023-03-06 15:26:07 +0800 CST<\/p>\n

    Labels: <none><\/p>\n

    Annotations: <none><\/p>\n

    Spec:<\/p>\n

    PodSelector: app=tomcat,project=project1,tier=backend<\/p>\n

    Allowing ingress traffic:<\/p>\n

    To Port: 8080\/TCP<\/p>\n

    From:<\/p>\n

    IPBlock:<\/p>\n

    CIDR: 10.224.0.0\/16<\/p>\n

    Except: 10.224.58.192\/26<\/p>\n

    Not affecting egress traffic<\/p>\n

    Policy Types: Ingress <\/p>\n

    \n

    \u5728node-01\u548cnode-02\u4e0a\u5206\u522b\u8fd0\u884c\u4e00\u4e2apod<\/p>\n

    \"\"<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u7136\u540e\u53bb\u8bbf\u95eetomcat，node-01\u4e0a\u7684pod\u53ef\u4ee5\u8bbf\u95ee，node-02\u4e0a\u7684pod\u4e0d\u80fd\u8bbf\u95ee，\u56e0\u4e3a\u5b83\u5c5e\u4e8e10.224.58.192\/26\u7f51\u6bb5<\/p>\n

    \"\"<\/p>\n

    \u793a\u4f8b3：\u901a\u8fc7\u540d\u79f0\u7a7a\u95f4\u9650\u5b9a\u53ef\u4ee5\u8bbf\u95eetomcat Pod<\/h5>\n

    [root@k8s-master1 ~]# cat ingress_networkpolicy3.yaml<\/p>\n

    apiVersion: networking.k8s.io\/v1<\/p>\n

    kind: NetworkPolicy<\/p>\n

    metadata:<\/p>\n

    name: network-policy-demo3<\/p>\n

    namespace: project1<\/p>\n

    spec:<\/p>\n

    policyTypes: ["Ingress"]<\/p>\n

    podSelector:<\/p>\n

    matchLabels:<\/p>\n

    app: tomcat<\/p>\n

    project: project1<\/p>\n

    tier: backend<\/p>\n

    ingress:<\/p>\n

    – from: #\u9650\u5b9a\u53ea\u6709project2\u540d\u79f0\u7a7a\u95f4\u4e0b\u5177\u6709app=nginx\u7684Pod\u624d\u80fd\u8bbf\u95eetomcat<\/p>\n

    – podSelector: #podSlector\u7b5b\u9009app=nginx\u7684Pod<\/p>\n

    matchLabels:<\/p>\n

    app: nginx<\/p>\n

    namespaceSelector: #namespaceSelector\u548cpodSlector\u662f\u903b\u8f91\u4e0e\u5173\u7cfb，\u8868\u793a\u5728namespaceSelector\u7b5b\u9009\u51fa\u7684\u540d\u79f0\u7a7a\u95f4\u4e0b\u7528podSlector\u7b5b\u9009Pod<\/p>\n

    matchLabels:<\/p>\n

    name: project2<\/p>\n

    ports:<\/p>\n

    – port: 8080<\/p>\n

    protocol: TCP <\/p>\n

    [root@k8s-master1 ~]# kubectl apply -f ingress_networkpolicy3.yaml<\/p>\n

    networkpolicy.networking.k8s.io\/network-policy-demo3 created <\/p>\n

    [root@k8s-master1 ~]# kubectl describe networkpolicy\/network-policy-demo3 -n project1<\/p>\n

    Name: network-policy-demo3<\/p>\n

    Namespace: project1<\/p>\n

    Created on: 2023-03-06 16:27:41 +0800 CST<\/p>\n

    Labels: <none><\/p>\n

    Annotations: <none><\/p>\n

    Spec:<\/p>\n

    PodSelector: app=tomcat,project=project1,tier=backend<\/p>\n

    Allowing ingress traffic:<\/p>\n

    To Port: 8080\/TCP<\/p>\n

    From:<\/p>\n

    NamespaceSelector: name=project2<\/p>\n

    PodSelector: app=nginx<\/p>\n

    Not affecting egress traffic<\/p>\n

    Policy Types: Ingress <\/p>\n

    \u5728project1\u540d\u79f0\u7a7a\u95f4\u4e0b\u7528nginx-pod\u8bbf\u95eetomcat-pod，\u4e0d\u80fd\u8bbf\u95ee<\/p>\n

    [root@k8s-master1 ~]# kubectl delete -f ingress_networkpolicy1.yaml<\/p>\n

    networkpolicy.networking.k8s.io "network-policy-demo1" deleted <\/p>\n

    \"\"<\/p>\n

    [root@k8s-master1 ~]# kubectl -n project1 exec -it pod\/nginx-project1-7b9c9d6f59-rx7v8 — sh<\/p>\n

    # curl 10.224.85.200:8080<\/p>\n

    curl: (28) Failed to connect to 10.224.85.200 port 8080: Connection timed out<\/span><\/p>\n

    #<\/p>\n

    \u5728project2\u540d\u79f0\u7a7a\u95f4\u4e0b\u7528nginx-pod\u8bbf\u95eetomcat-pod，\u53ef\u4ee5\u8bbf\u95ee<\/span><\/span><\/p>\n

    \"\"<\/p>\n

    [root@k8s-master1 ~]# kubectl -n project2 exec -it pod\/nginx-project2-7f9c77bdb6-l9cfv — sh<\/p>\n

    # curl 10.224.85.200:8080<\/p>\n

    project1 tomcat web page<\/span><\/p>\n

    #<\/p>\n

    \u5728project2\u540d\u79f0\u7a7a\u95f4\u4e0b\u4f7f\u7528\u5176\u5b83pod\u8bbf\u95eetomcat，\u65e0\u6cd5\u8bbf\u95ee<\/p>\n

    \"\"<\/p>\n

    3\u3001Egress\u89c4\u5219<\/h4>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u5927\u591a\u6570\u60c5\u51b5\u4e0b，\u4e00\u4e2a\u540d\u79f0\u7a7a\u95f4\u4e0b\u7684Pod\u8d44\u6e90\u603b\u6709\u5bf9\u5916\u8bf7\u6c42\u7684\u9700\u6c42，\u4f8b\u5982\u5411CoreDns\u8bf7\u6c42\u540d\u79f0\u89e3\u6790\u7b49\u3002\u56e0\u6b64，\u901a\u5e38\u5e94\u8be5\u5c06\u51fa\u7ad9\u6d41\u91cf\u7684\u9ed8\u8ba4\u7b56\u7565\u8bbe\u7f6e\u4e3a\u5141\u8bb8\u901a\u8fc7\u3002\u4f46\u5982\u679c\u8981\u5b9e\u73b0\u66f4\u7cbe\u7ec6\u7684\u63a7\u5236，\u4ec5\u653e\u884c\u6709\u5bf9\u5916\u8bf7\u6c42\u5fc5\u8981\u7684Pod\u5bf9\u8c61\u7684\u51fa\u7ad9\u6d41\u91cf，\u53ef\u4ee5\u901a\u8fc7Egress\u5b9e\u73b0\u3002<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0spec.egress\u5b57\u6bb5\u7528\u4e8e\u5b9a\u4e49\u51fa\u7ad9\u6d41\u91cf\u89c4\u5219，\u5b83\u53ef\u4ee5\u5d4c\u5957\u4f7f\u7528to\u548cports\u5b57\u6bb5，to\u7528\u4e8e\u5b9a\u4e49\u9009\u5b9a\u7684Pod\u7ec4\u7684\u51fa\u7ad9\u6d41\u91cf\u53ef\u8bbf\u95ee\u7684\u76ee\u6807\u7aef\u70b9，\u5176\u683c\u5f0f\u548c\u903b\u8f91\u4e0eingress.from\u4e00\u81f4；ports\u7528\u4e8e\u5b9a\u4e49\u9009\u5b9a\u7684Pod\u7ec4\u7684\u51fa\u7ad9\u6d41\u91cf\u53ef\u8bbf\u95ee\u7684\u76ee\u6807\u7aef\u53e3\u3002<\/p>\n

    \n

    \u4e0b\u9762\u662f\u4e00\u4e2a\u793a\u4f8b：<\/p>\n

    [root@k8s-master1 ~]# cat egress_networkpolicy1.yaml<\/p>\n

    apiVersion: networking.k8s.io\/v1<\/p>\n

    kind: NetworkPolicy<\/p>\n

    metadata:<\/p>\n

    name: network-policy-egress-demo1<\/p>\n

    namespace: project1<\/p>\n

    spec:<\/p>\n

    policyTypes: ["Egress"] #\u7f51\u7edc\u7b56\u7565\u7c7b\u578b\u4e3aEgress<\/p>\n

    podSelector: #\u5bf9project1\u540d\u79f0\u7a7a\u95f4\u4e0b\u7684nginx-pod\u8fdb\u884c\u9650\u5236<\/p>\n

    matchLabels:<\/p>\n

    app: nginx<\/p>\n

    project: project1<\/p>\n

    tier: fronted<\/p>\n

    egress:<\/p>\n

    – to: #Egress\u6761\u4ef61，\u9650\u5236nginx\u53ea\u80fd\u8bbf\u95ee\u540c\u540d\u79f0\u7a7a\u95f4\u4e0b\u7684tomcat-pod\u76848080\u7aef\u53e3<\/p>\n

    – podSelector:<\/p>\n

    matchLabels:<\/p>\n

    app: tomcat<\/p>\n

    project: project1<\/p>\n

    tier: backend<\/p>\n

    ports:<\/p>\n

    – port: 8080<\/p>\n

    protocol: TCP<\/p>\n

    – to: #Egress\u6761\u4ef62，\u9650\u5236nginx\u53ea\u80fd\u8bbf\u95ee192.168.30.0\/24\u7f51\u6bb5\u7684\u4e3b\u673a\u7684\u4efb\u4f55\u7aef\u53e3（\u4e0d\u5b9a\u4e49ports\u5b57\u6bb5\u8868\u793a\u4e0d\u9650\u5236）<\/p>\n

    – ipBlock:<\/p>\n

    cidr: 192.168.30.0\/24<\/p>\n

    [root@k8s-master1 ~]# kubectl apply -f egress_networkpolicy1.yaml<\/p>\n

    networkpolicy.networking.k8s.io\/network-policy-egress-demo1 created<\/p>\n

    [root@k8s-master1 ~]# kubectl -n project1 describe networkpolicy\/network-policy-egress-demo1<\/p>\n

    Name: network-policy-egress-demo1<\/p>\n

    Namespace: project1<\/p>\n

    Created on: 2023-03-06 17:28:52 +0800 CST<\/p>\n

    Labels: <none><\/p>\n

    Annotations: <none><\/p>\n

    Spec:<\/p>\n

    PodSelector: app=nginx,project=project1,tier=fronted<\/p>\n

    Not affecting ingress traffic<\/p>\n

    Allowing egress traffic:<\/p>\n

    To Port: 8080\/TCP<\/p>\n

    To:<\/p>\n

    PodSelector: app=tomcat,project=project1,tier=backend<\/p>\n

    ———-<\/p>\n

    To Port: <any> (traffic allowed to all ports)<\/p>\n

    To:<\/p>\n

    IPBlock:<\/p>\n

    CIDR: 192.168.30.0\/24<\/p>\n

    Except:<\/p>\n

    Policy Types: Egress <\/p>\n

    \u6d4b\u8bd5\u5728project1\u540d\u79f0\u7a7a\u95f4\u4e0bnginx-pod\u8bbf\u95ee\u540c\u540d\u79f0\u7a7a\u95f4\u4e0b\u7684tomcat-pod，\u53ef\u4ee5\u6b63\u5e38\u8bbf\u95ee<\/p>\n

    \"\"<\/p>\n

    \u6d4b\u8bd5\u5728project1\u540d\u79f0\u7a7a\u95f4\u4e0bnginx-pod\u8bbf\u95ee192.168.30.20:80，\u53ef\u4ee5\u6b63\u5e38\u8bbf\u95ee<\/p>\n

    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u9996\u5148\u642d\u5efa\u6d4b\u8bd5\u73af\u5883，\u5728192.168.30.20\u4e3b\u673a\u4e0a\u901a\u8fc7epel\u6e90\u5b89\u88c5nginx\u8f6f\u4ef6\u5305，\u5e76\u542f\u52a8nginx\u670d\u52a1\u3002<\/p>\n

    \u200b<\/p>\n

    [root@k8s-node01 ~]# wget -O \/etc\/yum.repos.d\/epel.repo https:\/\/mirrors.aliyun.com\/repo\/epel-7.repo<\/p>\n

    [root@k8s-node01 ~]# yum -y install nginx<\/p>\n

    [root@k8s-node01 ~]# systemctl start nginx<\/p>\n

    [root@k8s-master1 ~]# kubectl -n project1 exec -it pod\/nginx-project1-7b9c9d6f59-rx7v8 — sh
    \n\u200b <\/p>\n

    \"\"<\/p>\n

    \u6d4b\u8bd5\u5728project1\u540d\u79f0\u7a7a\u95f4\u4e0bnginx-pod\u8bbf\u95eecoredns\u670d\u52a1，\u89e3\u6790\u57df\u540d\u5931\u8d25，\u65e0\u6cd5\u8bbf\u95ee<\/p>\n

    \"\"<\/p>\n

    4\u3001\u7efc\u5408\u793a\u4f8b<\/h4>\n

    \u4e0b\u9762\u662f\u4e00\u4e2a\u7efc\u5408\u793a\u4f8b，\u7528\u4e8e\u5b9e\u73b0\u540d\u79f0\u7a7a\u95f4\u9694\u79bb\u3002\u5b83\u5927\u81f4\u5b9e\u73b0\u4e86\u4ee5\u4e0b\u51e0\u70b9\u9700\u6c42：<\/p>\n

    1.\u672c\u540d\u79f0\u7a7a\u95f4\u5185\u7684Pod\u53ef\u4ee5\u4e92\u76f8\u8bbf\u95ee<\/p>\n

    2. \u96c6\u7fa4\u4e0a\u7ba1\u7406\u7c7b\u5e94\u7528\u6240\u5728\u540d\u79f0\u7a7a\u95f4\u4e2d\u7684Pod（\u4f8b\u5982\u65e5\u5fd7\u6536\u96c6\u3001\u76d1\u63a7\u3001dashboard\u7b49）\u53ef\u4ee5\u8bbf\u95ee\u672c\u540d\u79f0\u7a7a\u95f4\u4e2d\u7684Pod<\/p>\n

    3. \u672c\u540d\u79f0\u7a7a\u95f4\u4e2d\u7684Pod\u53ef\u4ee5\u8bbf\u95eeCoreDns\u3001Kubernetes API\u7b49\u5fc5\u8981\u7684\u670d\u52a1<\/p>\n

    [root@k8s-master1 ~]# cat ingress_egress_networkpolicy.yaml<\/p>\n

    apiVersion: networking.k8s.io\/v1<\/p>\n

    kind: NetworkPolicy<\/p>\n

    metadata:<\/p>\n

    name: default-networkpolicy<\/p>\n

    namespace: project1<\/p>\n

    spec:<\/p>\n

    policyTypes: ["Ingress", "Egress"]<\/p>\n

    podSelector: {} #project1\u540d\u79f0\u7a7a\u95f4\u4e0b\u6240\u6709Pod\u5bf9\u8c61<\/p>\n

    ingress:<\/p>\n

    – from: #\u5165\u7ad9\u89c4\u52191，\u5141\u8bb8\u6307\u5b9a\u540d\u79f0\u7a7a\u95f4\u4e2d\u7684Pod\u8bbf\u95ee\u4efb\u610f\u7aef\u53e3<\/p>\n

    – namespaceSelector:<\/p>\n

    matchExpressions:<\/p>\n

    – {key: "name", operator: In, values: ["kube-system", "kube-dashboard", "log", "monitor", "project1"]}<\/p>\n

    egress:<\/p>\n

    – to: #\u51fa\u6218\u89c4\u52191，\u5141\u8bb8\u8bbf\u95ee\u540c\u540d\u79f0\u7a7a\u95f4\u4e0bPod\u7684\u4efb\u610f\u7aef\u53e3<\/p>\n

    – namespaceSelector:<\/p>\n

    matchLabels:<\/p>\n

    name: project1<\/p>\n

    – to: [] #\u51fa\u7ad9\u89c4\u52192，\u5141\u8bb8\u8bbf\u95ee\u4efb\u4f55\u7aef\u70b9\u7684UDP 53\u7aef\u53e3，DNS\u670d\u52a1<\/p>\n

    ports:<\/p>\n

    – port: 53<\/p>\n

    protocol: UDP<\/p>\n

    – to: #\u51fa\u7ad9\u89c4\u52193，\u5141\u8bb8\u8bbf\u95eekube-apierver<\/p>\n

    – podSelector:<\/p>\n

    matchLabels:<\/p>\n

    component: kube-apiserver<\/p>\n

    namespaceSelector:<\/p>\n

    matchLabels:<\/p>\n

    kubernetes.io\/metadata.name: kube-system<\/p>\n

    ports:<\/p>\n

    – port: 443<\/p>\n

    protocol: TCP <\/p>\n","protected":false},"excerpt":{"rendered":"

    \u4e00\u3001\u524d\u8a00：
    \n1\u3001\u4ec0\u4e48\u662fCNI？ CNI （Container Network Interface，\u5bb9\u5668\u7f51\u7edcAPI\u63a5\u53e3），\u662f\u7531 CoreOS \u63d0\u51fa\u7684\u5bb9\u5668\u7f51\u7edc\u89c4\u8303，\u5b83\u4f7f\u7528\u4e86\u63d2\u4ef6（Plugin）\u6a21\u578b\u521b\u5efa\u5bb9\u5668\u7684\u7f51\u7edc\u6808\u3002 CNI\u7528\u4e8e\u8fde\u63a5\u5bb9\u5668\u7ba1\u7406\u7cfb\u7edf\u548c\u7f51\u7edc\u63d2\u4ef6，\u8fd9\u4e3aK8s\u63d0\u4f9b\u7684\u4e00\u79cd\u901a\u7528\u7f51\u7edc\u6807\u51c6\u89c4\u8303，\u56e0\u4e3ak8s\u672c\u8eab\u4e0d\u63d0\u4f9b\u7f51\u7edc\u89e3\u51b3\u65b9\u6848\u3002\u76ee<\/p>\n","protected":false},"author":2,"featured_media":72288,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[1493,120,58,763,97,121],"topic":[],"class_list":["post-72308","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-server","tag-k8s","tag-kubernetes","tag-linux","tag-763","tag-97","tag-121"],"yoast_head":"\nk8s\uff1aCNI\u7f51\u7edc\u63d2\u4ef6flannel\u4e0ecalico - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.wsisp.com\/helps\/72308.html\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"k8s\uff1aCNI\u7f51\u7edc\u63d2\u4ef6flannel\u4e0ecalico - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"og:description\" content=\"\u4e00\u3001\u524d\u8a00： 1\u3001\u4ec0\u4e48\u662fCNI？ CNI （Container Network Interface，\u5bb9\u5668\u7f51\u7edcAPI\u63a5\u53e3），\u662f\u7531 CoreOS \u63d0\u51fa\u7684\u5bb9\u5668\u7f51\u7edc\u89c4\u8303，\u5b83\u4f7f\u7528\u4e86\u63d2\u4ef6（Plugin）\u6a21\u578b\u521b\u5efa\u5bb9\u5668\u7684\u7f51\u7edc\u6808\u3002 CNI\u7528\u4e8e\u8fde\u63a5\u5bb9\u5668\u7ba1\u7406\u7cfb\u7edf\u548c\u7f51\u7edc\u63d2\u4ef6，\u8fd9\u4e3aK8s\u63d0\u4f9b\u7684\u4e00\u79cd\u901a\u7528\u7f51\u7edc\u6807\u51c6\u89c4\u8303，\u56e0\u4e3ak8s\u672c\u8eab\u4e0d\u63d0\u4f9b\u7f51\u7edc\u89e3\u51b3\u65b9\u6848\u3002\u76ee\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.wsisp.com\/helps\/72308.html\" \/>\n<meta property=\"og:site_name\" content=\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"article:published_time\" content=\"2026-02-05T04:06:06+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/02\/20260205040558-698417263eb83.png\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"20 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/72308.html\",\"url\":\"https:\/\/www.wsisp.com\/helps\/72308.html\",\"name\":\"k8s\uff1aCNI\u7f51\u7edc\u63d2\u4ef6flannel\u4e0ecalico - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"isPartOf\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\"},\"datePublished\":\"2026-02-05T04:06:06+00:00\",\"dateModified\":\"2026-02-05T04:06:06+00:00\",\"author\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/72308.html#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.wsisp.com\/helps\/72308.html\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/72308.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.wsisp.com\/helps\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"k8s\uff1aCNI\u7f51\u7edc\u63d2\u4ef6flannel\u4e0ecalico\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\",\"url\":\"https:\/\/www.wsisp.com\/helps\/\",\"name\":\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"description\":\"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"contentUrl\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"caption\":\"admin\"},\"sameAs\":[\"http:\/\/wp.wsisp.com\"],\"url\":\"https:\/\/www.wsisp.com\/helps\/author\/admin\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"k8s\uff1aCNI\u7f51\u7edc\u63d2\u4ef6flannel\u4e0ecalico - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.wsisp.com\/helps\/72308.html","og_locale":"zh_CN","og_type":"article","og_title":"k8s\uff1aCNI\u7f51\u7edc\u63d2\u4ef6flannel\u4e0ecalico - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","og_description":"\u4e00\u3001\u524d\u8a00： 1\u3001\u4ec0\u4e48\u662fCNI？ CNI （Container Network Interface，\u5bb9\u5668\u7f51\u7edcAPI\u63a5\u53e3），\u662f\u7531 CoreOS \u63d0\u51fa\u7684\u5bb9\u5668\u7f51\u7edc\u89c4\u8303，\u5b83\u4f7f\u7528\u4e86\u63d2\u4ef6（Plugin）\u6a21\u578b\u521b\u5efa\u5bb9\u5668\u7684\u7f51\u7edc\u6808\u3002 CNI\u7528\u4e8e\u8fde\u63a5\u5bb9\u5668\u7ba1\u7406\u7cfb\u7edf\u548c\u7f51\u7edc\u63d2\u4ef6，\u8fd9\u4e3aK8s\u63d0\u4f9b\u7684\u4e00\u79cd\u901a\u7528\u7f51\u7edc\u6807\u51c6\u89c4\u8303，\u56e0\u4e3ak8s\u672c\u8eab\u4e0d\u63d0\u4f9b\u7f51\u7edc\u89e3\u51b3\u65b9\u6848\u3002\u76ee","og_url":"https:\/\/www.wsisp.com\/helps\/72308.html","og_site_name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","article_published_time":"2026-02-05T04:06:06+00:00","og_image":[{"url":"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/02\/20260205040558-698417263eb83.png"}],"author":"admin","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"admin","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"20 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.wsisp.com\/helps\/72308.html","url":"https:\/\/www.wsisp.com\/helps\/72308.html","name":"k8s\uff1aCNI\u7f51\u7edc\u63d2\u4ef6flannel\u4e0ecalico - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","isPartOf":{"@id":"https:\/\/www.wsisp.com\/helps\/#website"},"datePublished":"2026-02-05T04:06:06+00:00","dateModified":"2026-02-05T04:06:06+00:00","author":{"@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41"},"breadcrumb":{"@id":"https:\/\/www.wsisp.com\/helps\/72308.html#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.wsisp.com\/helps\/72308.html"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.wsisp.com\/helps\/72308.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.wsisp.com\/helps"},{"@type":"ListItem","position":2,"name":"k8s\uff1aCNI\u7f51\u7edc\u63d2\u4ef6flannel\u4e0ecalico"}]},{"@type":"WebSite","@id":"https:\/\/www.wsisp.com\/helps\/#website","url":"https:\/\/www.wsisp.com\/helps\/","name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","description":"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41","name":"admin","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/","url":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","contentUrl":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","caption":"admin"},"sameAs":["http:\/\/wp.wsisp.com"],"url":"https:\/\/www.wsisp.com\/helps\/author\/admin"}]}},"_links":{"self":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/72308","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/comments?post=72308"}],"version-history":[{"count":0,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/72308\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media\/72288"}],"wp:attachment":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media?parent=72308"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/categories?post=72308"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/tags?post=72308"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/topic?post=72308"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}