The Journey to the Kubernetes networking.pdf

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

The Journey to the
Kubernetes Networking

TOC
• Network setting
• Pod IP routing (same node)
• Pod IP routing (different node)
• Service IP routing
• DNS lookup

Prerequisite
• Container and Kubernetes fundamental
• Basic network routing and TCP/IP

NOT include
• CNI detail
• Calico detail
• Ingress
• Network policy
• Source code tracing

Environment
• RHEL 7.8
• Kernel 3.10.0-1127
• Kubernetes v1.18.2
• Docker 19.3.13
• Containerd 1.3.7-3.1
• Etcd v3.3.12
• ...

Scenario
• 1 namespace, 3 pods
• 2 pods are nginx server,
the alpine pod is client

Network setting

Container basis
• In Linux, container = namespace + cgroup
• Namespace: environment isolation (E.g., network & pid namespa...

Container network
• In early years, container or pod IP is managed by container runtime
• Recently, pod IP is managed by C...

Kubernetes Network Model
• Pods can communicate with all other pods on any other node without
NAT
• Agents on a node (e.g....

CNI and CNI plugins
• The CNI protocol is based on execution of binaries invoked by the
container runtime. CNI defines the...

K8s pod & service IP range
CIDR Range for Pods in cluster
CIDR Range for Services in cluster
https://kubernetes.io/docs/re...

CNI
IPAM: IP Address Management

Log
Kubelet log
Calico log

IP address in pod & host
IP interface in pod
IP interface on host

Network namespace of container
container PID

Pod IP Routing (same node)

on w05t query host 10.233.112.167

Determine the routing in namespace

Determine the routing by enabling proxy_arp
https://wiki.debian.org/BridgeNetworkConnectionsProxyArp
https://tldp.org/HOWT...

Determine the routing on host

Pod IP Routing (different node)

on w05t query host 10.233.112.167

IP in IP tunnel

on w04t query host 10.240.205.39 and not port 53

on w04t query host 10.240.205.39 and not port 53

Service IP routing

Service IP allocation
• Kubernetes assigns this Service an IP address which is used by the
Service proxies (E.g., kube-pro...

Scenario
• Create 1 deployment with 3 replicas and expose it as a service

NAT and conntrack when query service IP
on w05t query host 10.233.112.167
DNAT
SNAT & conntrack

Iptables load-balance probability
• 1st endpoint:
1
3
• 2nd endpoint:
2
3
×
1
2
=
1
3
• 3rd endpoint:
2
3
×
1
2
× 1 =
1
3
...

DNS lookup

DNS resolution for service and pod
• DNS queries may be expanded using the Pod's /etc/resolv.conf.
Kubelet sets this file ...

on w05t query host 10.233.99.52 or host 10.233.88.44

DNS resolution for others
• Any queries that are not within the cluster domain of Kubernetes will
be forwarded to predefin...

DNS cache
• NodeLocal DNSCache improves Cluster DNS performance by running
a DNS caching agent on cluster nodes as a Daemo...

on w05t query host 169.254.25.10 and port 53

Proxy ARP Reference
• https://www.tkng.io/cni/calico/
• https://projectcalico.docs.tigera.io/reference/faq#why-does-my-
co...

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1052471 views
Storytelling For The Web: Integrate... by Chiara Aliotta 967761 views
Artificial Intelligence, Data and C... by OECD Directorate ... 900577 views
How to Leverage AI to Boost Employe... by SocialHRCamp 380598 views
2024 State of Marketing Report – by... by Marius Sescu 215763 views
Everything You Need To Know About C... by Expeed Software 233752 views

View on Slideshare

1 of 44 Ad

View on Slideshare

1 of 44 Ad