Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.
Kubernetes Networking
Bryan Boreham, Director of Engineering
@bboreham
What does Weave do?
Weave lets devops
iterate faster with:
• observability &
monitoring
• continuous delivery
• container ...
What you should learn
1. How clients talk to services in Kubernetes
2. Connecting containers: overlay vs native
3. Connect...
• Docker
• Kubernetes
• Weave
Who is working with...
What is Kubernetes?
https://image.shutterstock.com/z/stock-photo-vintage-photo-of-a-man-working-on-complex-machine-1392745...
What is Kubernetes?
NodeNode Node
Master
NodeNode Node
Kubernetes runs Services
Let’s talk about Ports
A service listens on a Port at an IP address
– e.g. http on port 80, postgres on port 5432
– or you...
Suppose we want to run two?
•Only one thing can be listening on a port
•We could give the second one a new port
number
192...
How do we keep track?
• Fiddling with port numbers needs a bit of book-keeping
• Could have another service where we regis...
Give every service its own IP address
•Container Networking means never having to
say “what port is it on?”
•Every service...
Kubernetes Concepts
Pod
IP addr
Node
Container
Just one thing though
•Now, when we contact a service, we need to
know its IP address.
•There is a standard way to do that...
• Run multiple instances of a service
• Clients should call one of them, don’t care
which
foo
10.20.10.1
foo
10.20.29.13
N...
DNS can do this. Right?
•Some clients will re-query on every call
•Some clients will cache the result too long
•Most clien...
• DNS name resolves to a stable Virtual IP address
• Kube-proxy translates VIP to one Pod IP
Kubernetes Cluster IPs
kube-d...
We need network packets to go from one pod to another
pod, across whatever sits in the middle
Let’s talk about Pod Network...
Who controls your network?
http://philippel.deviantart.com/art/DUNE-Sandworm-Rising-
403336019
If you have the IP space, and you control the network, just
program the routers
Pod Network: Routes
10.20.30.42
192.1.6.41...
Packets are encapsulated before they leave the machine
Pod Network: Overlay
10.20.30.42
192.1.6.4192.1.6.3
10.20.9.1
192.1...
The Three Commandments
...of Kubernetes Networking:
• All containers can communicate with all other
containers
• All nodes...
CNI: the Container Network Interface
kubele
t
Po
d
Interface
Plugin
Pod Network
ADD
• One high-numbered port, on every Node in the cluster
• Can bounce from one machine to another
Exposing services: NodePor...
• Specific port is mapped locally on the host
• “Don’t use hostPort unless it is absolutely necessary”
Exposing services: ...
• Layer 4 - works for any TCP-based protocol
• Available for specific implementations, e.g. ELB
Exposing services: LoadBal...
• Layer 7 - defined for http only
• Available for specific implementations, e.g. nginx, ALB
Exposing services: Ingress
ing...
Example Ingress config
apiVersion: extensions/v1beta1
kind: Ingress
spec:
rules:
- host: foo.bar.com
http:
paths:
- path: ...
Recap: all you need to know
•Kubernetes runs Pods which implement
Services
•Pods need a Pod Network - routed or Overlay
•P...
Thanks! Questions?
We are hiring!
Engineers in SF & London
weave.works/hiring
What’s Next?
•Try Weave Cloud
– https://cloud.weave.works
•Join the Weave user group!
– meetup.com/pro/Weave
•Get in touch...
Upcoming SlideShare
Loading in …5
×

Kubernetes Networking 101

3,729 views

Published on

Kubernetes has two simple but powerful network concepts: every Pod is connected to the same network, and Services let you talk to a Pod by name. Bryan will take you through how these concepts are implemented - Pod Networks via the Container Network Interface (CNI), Service Discovery via kube-dns and Service virtual IPs, then on to how Services are exposed to the rest of the world.

Published in: Technology

Kubernetes Networking 101

  1. 1. Kubernetes Networking Bryan Boreham, Director of Engineering @bboreham
  2. 2. What does Weave do? Weave lets devops iterate faster with: • observability & monitoring • continuous delivery • container networks & firewalls Kubernetes is our #1 platform
  3. 3. What you should learn 1. How clients talk to services in Kubernetes 2. Connecting containers: overlay vs native 3. Connecting into your cluster: NodePort, HostPort, LoadBalancer, Ingress 4. Be better equipped to troubleshoot https://media.timeout.com/images/103755908/630/472/image.jpg
  4. 4. • Docker • Kubernetes • Weave Who is working with...
  5. 5. What is Kubernetes? https://image.shutterstock.com/z/stock-photo-vintage-photo-of-a-man-working-on-complex-machine-1392745.jpg
  6. 6. What is Kubernetes? NodeNode Node Master
  7. 7. NodeNode Node Kubernetes runs Services
  8. 8. Let’s talk about Ports A service listens on a Port at an IP address – e.g. http on port 80, postgres on port 5432 – or your own custom service on 9090 192.1.6.4 9090 foo
  9. 9. Suppose we want to run two? •Only one thing can be listening on a port •We could give the second one a new port number 192.1.6.4 9090 9091 foo1 foo2
  10. 10. How do we keep track? • Fiddling with port numbers needs a bit of book-keeping • Could have another service where we register all the port numbers we’ve chosen • Downside: this requires that every client uses the registry 192.1.6.4 9090 9091 Service Registry “Where is foo2?” foo1 foo2
  11. 11. Give every service its own IP address •Container Networking means never having to say “what port is it on?” •Every service uses its native port number 10.20.30.42 9090 foo1 9090 foo2 10.20.30.43
  12. 12. Kubernetes Concepts Pod IP addr Node Container
  13. 13. Just one thing though •Now, when we contact a service, we need to know its IP address. •There is a standard way to do that DNS “Where is foo2?” 10.20.30.42 foo1 foo2 10.20.30.43
  14. 14. • Run multiple instances of a service • Clients should call one of them, don’t care which foo 10.20.10.1 foo 10.20.29.13 Now add Scaling and Redundancy foo 10.20.30.42
  15. 15. DNS can do this. Right? •Some clients will re-query on every call •Some clients will cache the result too long •Most clients will not round-robin http://gunshowcomic.com/648
  16. 16. • DNS name resolves to a stable Virtual IP address • Kube-proxy translates VIP to one Pod IP Kubernetes Cluster IPs kube-dns 10.20.30.42 kube-proxy 100.96.0.30 ->10.20.30.42 foo “Where is foo?” - 100.96.0.30 192.1.6.4
  17. 17. We need network packets to go from one pod to another pod, across whatever sits in the middle Let’s talk about Pod Networking 10.20.30.42 192.1.6.4192.1.6.3 10.20.9.1
  18. 18. Who controls your network? http://philippel.deviantart.com/art/DUNE-Sandworm-Rising- 403336019
  19. 19. If you have the IP space, and you control the network, just program the routers Pod Network: Routes 10.20.30.42 192.1.6.4192.1.6.3 10.20.30.0/24: via 192.1.6.4 10.20.9.0/24: via 192.1.6.3 10.20.9.1
  20. 20. Packets are encapsulated before they leave the machine Pod Network: Overlay 10.20.30.42 192.1.6.4192.1.6.3 10.20.9.1 192.1.6.3->192.1.6.4 [10.20.9.1->10.20.30.42]
  21. 21. The Three Commandments ...of Kubernetes Networking: • All containers can communicate with all other containers • All nodes can communicate with all containers (and vice-versa) • The IP that a container sees itself as is the same IP that others see it as
  22. 22. CNI: the Container Network Interface kubele t Po d Interface Plugin Pod Network ADD
  23. 23. • One high-numbered port, on every Node in the cluster • Can bounce from one machine to another Exposing services: NodePort 10.20.30.42 kube-proxy :30021 ->10.20.30.42:80 foo 192.1.6.4 :30021
  24. 24. • Specific port is mapped locally on the host • “Don’t use hostPort unless it is absolutely necessary” Exposing services: HostPort 10.20.30.42 :8080 ->10.20.30.42:80 foo 192.1.6.4 :8080
  25. 25. • Layer 4 - works for any TCP-based protocol • Available for specific implementations, e.g. ELB Exposing services: LoadBalancer LB foo cloud-controller Programs endpoints kube-proxy / iptables foo
  26. 26. • Layer 7 - defined for http only • Available for specific implementations, e.g. nginx, ALB Exposing services: Ingress ingress controller foo foo Master
  27. 27. Example Ingress config apiVersion: extensions/v1beta1 kind: Ingress spec: rules: - host: foo.bar.com http: paths: - path: /foo backend: serviceName: s1 servicePort: 80 - path: /bar backend: serviceName: s2 servicePort: 80
  28. 28. Recap: all you need to know •Kubernetes runs Pods which implement Services •Pods need a Pod Network - routed or Overlay •Pod network is driven via CNI •Clients connect to Services via virtual Cluster IPs •Kubernetes has many ways to expose a Service outside the cluster - each has pros and
  29. 29. Thanks! Questions? We are hiring! Engineers in SF & London weave.works/hiring
  30. 30. What’s Next? •Try Weave Cloud – https://cloud.weave.works •Join the Weave user group! – meetup.com/pro/Weave •Get in touch! (Slack, Email, etc.) – weave.works/help

×