Cloud Native Lou presentation October - k8s SIG Network update - Ingres-nginx CVE discussion - k8s and networking book review - AWS Container and Networking

1. Cloud Native Lou -
10/21/2021
James Strong
AWS APN AMBASSADOR

2. Agenda
● k8s Sig-Network updates
● Ingress-nginx CVE
● 1.22 k8s updates
● Kubernetes and Networking Book
● AWS Containers and Networking
Review

3. SIG Network Update
● Dual-Stack (now GA in 1.23
● Gateway API (v1alpha2 for L4/L7
● Topology keys deprecated in 1.21, 1.23 Topology hints
● KPNG (kube-proxy NG
● ClusterNetworkPolicy
● Cilium CNCF Project

4. SIG Network Update
https://kubernetes.io/blog/2021/04/22/evolving-kubernetes-networking-with-the-gateway-api/
2019 Kubecon discussion

5. v1 ingress-nginx
1.22 Release updates
+
• v1 upgrade
• Update manifests
• Ingress Class Definitions
• https://kubernetes.io/blog/20
21/07/26/update-with-ingres
s-nginx/
• networking.k8s.io/v1 went
GA in 1.22
• Ingress and IngressClass
• CustomResourceDefinition
Among many others
• https://kubernetes.io/docs/re
ference/using-api/deprecatio
n-guide/#v1-22

6. Notable Changes in Ingress Manifest
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: simple-fanout-example
spec:
rules:
- host: foo.bar.com
http:
paths:
- path: /foo
pathType: Prefix
backend:
service:
name: service1
port:
number: 4200
- path: /bar
pathType: Prefix
backend:
service:
name: service2
port:
number: 8080

7. Ingress-nginx CVE202125742
● Disable config snippets
● Multitenant environments where non-admin users have permissions to
create Ingress objects are most affected by this issue.
● Secrets can be accessed by malicious config snippet
Set allow-snippet-annotations to false in your ingress-nginx
https://github.com/kubernetes/ingress-nginx/issues/7837

8. Kubernetes and
Networking
James Strong
AWS APN AMBASSADOR

9. Networking and Kubernetes
package main
import (
"fmt"
"net/http"
)
func hello(w http.ResponseWriter, r *http.Request) {
fmt.Fprintf(w, "Hello")
}
func main() {
http.HandleFunc("/", hello)
http.ListenAndServe("0.0.0.08080", nil)
}

10. James Strong
AWS APN AMBASSADOR
1. Networking
2. Linux Networking
3. Container Networking
4. Kubernetes Networking
5. Kubernetes Networking Abstractions
6. Kubernetes and Cloud networking
https://learning.oreilly.com/library/view/networ
king-and-kubernetes/9781492081647/

11. AWS Network and
Container Review
James Strong
AWS APN AMBASSADOR

12. EKS Anywhere
● Run on-prem, laptop, vSphere
● EKS Connector
● Demo -
https://aws.amazon.com/blogs/containers/introducing-general-ava
ilability-of-amazon-eks-anywhere/
● More Info - https://aws.amazon.com/eks/eks-anywhere/
https://aws.amazon.com/eks/eks-anywhere/

13. Network Review – Customer-Managed VPC
VPC 192.168.0.0/16
Availability Zone
Availability Zone Availability Zone
Public subnet
Public subnet Public subnet
Private subnet
Private subnet Private subnet
NAT gateway
Security group
Internet gateway
EKS Control Plane

14. Network Review – Customer-Managed VPC
AWS NETWORK REVIEW
VPC 192.168.0.0/16
Availability Zone
Availability Zone Availability Zone
Public subnet
Public subnet Public subnet
Private subnet
Private subnet Private subnet
Node group
NAT gateway Internet gateway
Security group
EKS Control Plane
Node group
EKS Control Plane

15. Amazon VPC CNI
James Strong
AWS APN AMBASSADOR

16. Availability Low Latency Minimal
Network Jitter
KUBERNETES NETWORK
AWS VPC CNI
Apply VPC Best
Practices

17. KUBERNETES NETWORK
AWS VPC CNI
Security
Groups
Apply VPC Best
Practices
VPC Routing
Policies
VPC Flow
Logs
AWS Native Integrations

18. CNI IPAMD
Amazon VPC CNI Components
AMAZON VPC CNI
+
• Configures the ENI
IPAM daemon responsible for:
• Responsible for pod’s
networking stack
• Pool of IP Addresses
• Assigning out IP Address

19. Amazon VPC CNI
AMAZON VPC CNI
Customer VPC
Pod 3
eth0
10.200.1.7
10.200.1.
7
Node
1
VPC Subnet –
10.200.1.0/24
Pod 4
eth0
10.200.1.
9
Pod
1
eth0
10.200.1.
6
Secondary IPs:
10.200.1.6
Pod 2
eth0
10.200.1.
8
Secondary IPs:
10.200.1.8
10.200.1.
9
Node
2

20. AWS VPC CNI Configuration Variables
AMAZON VPC CNI
AWS VPC CNI NODE PORT SUPPORT
Node port support on worker nodes
1
AWS VPC K8S CNI CUSTOM NETWORK CFG
Security group creation per pod
2
AWS VPC ENI MTU
MTU setting
3
AWS VPC K8S CNI EXTERNAL SNAT
Specifies whether an external NAT gateway
should be used to provide SNAT of
secondary ENI IP addresses
4
WARM ENI TARGET
Number of ENI IP address to keep ready
5
AWS VPC K8S CNI EXCLUDE SNAT CIDRS
Exclude CIDIRs from SNAT
6

21. AWS EKS Cluster
James Strong
AWS APN AMBASSADOR

22. EKS Communication
AWS EKS CLUSTER
EKS Managed VPC
Customer VPC
Node group
ENI
EKS Control Plane
Kubectl
Application
User
EKS Control
Application
Admin

23. EKS Networking Mode - Public Endpoint Only
AWS EKS CLUSTER
EKS Managed VPC
Kubectl
Availability Zone 1
Customer VPC
AZ 1
Kubelet
Kube-proxy
Kubelet
Kube-proxy
EKS Control Plane
EKS Owned
ENI

24. EKS Networking Mode – Public and Private Endpoint Only
AWS EKS CLUSTER
Customer VPC
AZ 1
Kubelet
Kube-proxy
Kubelet
Kube-proxy
Private Hosted Zone
56d02fd4cb4ef6f7.eks.
amazonaws.com
Kubectl
EKS Managed VPC
Availability Zone 1
EKS Control Plane
EKS Owned
ENI

25. EKS Networking Mode – Private Endpoint Only
AWS EKS CLUSTER
EKS Managed VPC
Customer VPC
AZ 1
Kubelet
Kube-proxy
Kubelet
Kube-proxy
56d02fd4cb4ef6f7.eks.
amazonaws.com
kubectl
Availability Zone 1
EKS Control Plane
EKS Owned
ENI

26. VPC Subnet Considerations
AWS EKS CLUSTER
Public Only
Using only public subnets.
Nodes and ingress
resources, load balancers,
are deployed in the same
public subnets.
1
Private Only
Using only private subnets.
Nodes are instantiated in
private subnets.
2
Public and Private
Using public and private
subnets. Nodes are deployed
in the private subnets and
ingress resources (like load
balancers) are instantiated in
the public subnets.
3

27. AWS ALB Ingress Controller
AWS ALB AND ALB INGRESS CONTROLLER LAB
AWS Resources
K8 Cluster
Ping Data Admin
Node Node Node
Ping Pod 1
Admin Pod 2
Data Pod 3
NP NP
NP NP
Data Pod 3
ALB
Controller
NP
Ping Pod 1
Admin Pod 3
Data Pod 3
NP
API Server
NP
1
2
3
4
5
30040
192.168.1.7

28. AWS App Mesh
James Strong
AWS APN AMBASSADOR

29. AWS App Mesh Functionality
1 Point-to-Point Communication
2 Network Traffic Control
3 Observability
Fault Isolation
4

30. AWS App Mesh Components
AWS APP MESH
Application
User
App Mesh
Ping
Virtual
Router
Data
Virtual
Router
Admin
Virtual
Router
Ping Virtual Node
Data Virtual Node
Admin Virtual Node
Data
Virtual
Service
Ping
Virtual
Service
Admin
Virtual
Service

31. AWS App Mesh Envoy Communication
AWS APP MESH
Applicatio
n
User
Application Pods
Application
XRay Agent
AWS XRay
Amazon
CloudWatch
Metrics
Amazon
CloudWatch Logs
Metrics
Ingress
Egress