k8s网络之calico学习

一、知识准备

1.calico主要通过ipip协议与bgp协议来实现通信。前者通过ipip隧道作为通信基础，后者则是纯三层的路由交换
2.bgp协议主要由两种方式：BGP Speaker 全互联模式(node-to-node mesh)与BGP Speaker RR模式
3.本文主要探索一下calico bgp的两种模式

二、环境准备

三、安装

k8s安装

参考官网安装以及社区诸多大神的安装帖子，这里就不班门弄斧了

本文的k8s的环境打开了rbac，etcd加入了证书

calico安装

主要参考官方文档 https://docs.projectcalico.org/v3.1/getting-started/kubernetes/installation/calico

1.calico rbac

kubectl apply -f \
https://docs.projectcalico.org/v3.1/getting-started/kubernetes/installation/rbac.yaml

2.下载calico.yaml

curl \
https://docs.projectcalico.org/v3.1/getting-started/kubernetes/installation/hosted/calico.yaml \
-O

3.填入etcd地址

ETCD_ENDPOINTS="https://192.168.56.101:2379"sed -i "s#.*etcd_endpoints:.*#  etcd_endpoints: \"${ETCD_ENDPOINTS}\"#g" calico.yaml

sed -i "s#__ETCD_ENDPOINTS__#${ETCD_ENDPOINTS}#g" calico.yaml

4.将etcd证书信息填入。我的etcd证书在/etc/etcd/ssl下

ETCD_CERT=`cat /etc/etcd/ssl/etcd.pem | base64 | tr -d '\n'`
ETCD_KEY=`cat /etc/etcd/ssl/etcd-key.pem | base64 | tr -d '\n'`
ETCD_CA=`cat /etc/etcd/ssl/etcd-root-ca.pem | base64 | tr -d '\n'`

sed -i "s#.*etcd-cert:.*#  etcd-cert: ${ETCD_CERT}#g" calico.yaml
sed -i "s#.*etcd-key:.*#  etcd-key: ${ETCD_KEY}#g" calico.yaml
sed -i "s#.*etcd-ca:.*#  etcd-ca: ${ETCD_CA}#g" calico.yaml

sed -i 's#.*etcd_ca:.*#  etcd_ca: "/calico-secrets/etcd-ca"#g' calico.yaml
sed -i 's#.*etcd_cert:.*#  etcd_cert: "/calico-secrets/etcd-cert"#g' calico.yaml
sed -i 's#.*etcd_key:.*#  etcd_key: "/calico-secrets/etcd-key"#g' calico.yaml

sed -i "s#__ETCD_KEY_FILE__#/etc/etcd/ssl/etcd-key.pem#g" calico.yaml
sed -i "s#__ETCD_CERT_FILE__#/etc/etcd/ssl/etcd.pem#g" calico.yaml
sed -i "s#__ETCD_CA_CERT_FILE__#/etc/etcd/ssl/etcd-root-ca.pem#g" calico.yaml
sed -i "s#__KUBECONFIG_FILEPATH__#/etc/cni/net.d/calico-kubeconfig#g" calico.yaml

5.配置calico bgp 并且修改ip cidr:10.10.0.0/16

sed -i '/CALICO_IPV4POOL_IPIP/{n;s/Always/off/g}' calico.yaml
sed -i '/CALICO_IPV4POOL_CIDR/{n;s/192.168.0.0/10.10.0.0/g}' calico.yaml

6.kubectl安装calico

kubectl apply -f calico.yaml

注意:因为calico-node需要获取操作系统的权限运行，所以要在apiserver、kubelet中加入--allow-privileged=true

查看一下状态:

root@k8s-master:/tmp# kubectl get pods -n kube-system -owide
NAME                                        READY     STATUS    RESTARTS   AGE       IP               NODE
calico-kube-controllers-98989846-b4n72      1/1       Running   0          18d       192.168.56.102   k8s-node1
calico-node-58pck                           2/2       Running   0          18d       192.168.56.103   k8s-node2
calico-node-s2txw                           2/2       Running   0          18d       192.168.56.101   k8s-master
calico-node-svmbp                           2/2       Running   0          18d       192.168.56.102   k8s-node1
...

7.kubelet配置calico

找到kubelet的配置文件（我的环境在/etc/kubernetes/kubelet），加入--network-plugin=cni重启kubelet

8.测试一个pod

cat << EOF | kubectl create -f -apiVersion: v1kind: Podmetadata:  name: network-test  namespace: testspec:  containers:  - image: busybox:latest    command:      - sleep      - "3600"    name: network-testEOF

root@k8s-master:~# kubectl -n test get pods -owideNAME           READY     STATUS    RESTARTS   AGE       IP              NODE
network-test   1/1       Running   0          41s       10.10.169.139   k8s-node2

至此：calico安装已经完成

四、calicoctl使用

1.下载calicoctl

https://github.com/projectcalico/calicoctl/releases/download/v3.1.3/calicoctl-linux-amd64

2.查看当前的calico-node

root@k8s-master:/tmp# calicoctl get node
NAME
k8s-master
k8s-node1
k8s-node2

calicoctl get node -o yaml 查看详细信息

3.查看当前的ippool

root@k8s-master:/tmp# calicoctl get ippoolNAME                  CIDRdefault-ipv4-ippool   10.10.0.0/16default-ipv6-ippool   fdc6:1a69:2b39::/48

4.查看当前模式

root@k8s-master:/tmp# calicoctl node statusCalico process is running.

IPv4 BGP status
+----------------+-------------------+-------+----------+-------------+|  PEER ADDRESS  |     PEER TYPE     | STATE |  SINCE   |    INFO     |+----------------+-------------------+-------+----------+-------------+| 192.168.56.102 | node-to-node mesh | up    | 07:39:02 | Established || 192.168.56.103 | node-to-node mesh | up    | 07:39:02 | Established |+----------------+-------------------+-------+----------+-------------+

IPv6 BGP status
No IPv6 peers found.

root@k8s-master:/tmp# netstat -anp | grep ESTABLISH | grep birdtcp        0      0 192.168.56.101:33029    192.168.56.102:179      ESTABLISHED 26558/bird
tcp        0      0 192.168.56.101:58055    192.168.56.103:179      ESTABLISHED 26558/bird

当前运行在BGP Speaker 全互联模式(node-to-node mesh)模式，calico集群中的节点之间都会相互建立连接，用于路由交换。适合规模不大的集群中运行，一旦集群节点增大，mesh模式将形成一个巨大服务网格，连接数暴增

5.修改BGP Speaker RR模式

禁止mesh模式，配置bgpPeer

cat << EOF | calicoctl create -f -apiVersion: projectcalico.org/v3kind: BGPConfigurationmetadata:  name: defaultspec:  logSeverityScreen: Info  nodeToNodeMeshEnabled: false  asNumber: 61234EOFcat << EOF | calicoctl create -f -apiVersion: projectcalico.org/v3kind: BGPPeermetadata:  name: bgppeer-globalspec:  peerIP: 192.168.56.103  asNumber: 61234EOF

查看RR模式配置：

root@k8s-master:~# calicoctl get bgpconfigNAME      LOGSEVERITY   MESHENABLED   ASNUMBERdefault   Info          false         61234root@k8s-master:~# calicoctl get bgppeerNAME             PEERIP           NODE       ASN
bgppeer-global   192.168.56.103   (global)   61234

安装routereflector

docker run --privileged --net=host -d                             \
           --name=calico-rr                                       \
           -e IP=192.168.56.104                                   \
           -e ETCD_ENDPOINTS=https://192.168.56.101:2379          \
           -v /etc/etcd/ssl:/etc/calico/ssl                     \
           -e ETCD_CA_CERT_FILE=/etc/calico/ssl/etcd-root-ca.pem  \
           -e ETCD_CERT_FILE=/etc/calico/ssl/etcd.pem             \
           -e ETCD_KEY_FILE=/etc/calico/ssl/etcd-key.pem          \
           calico/routereflector:v0.6.1

查看效果：

root@k8s-master:~# calicoctl node statusCalico process is running.

IPv4 BGP status
+----------------+-----------+-------+----------+-------------+|  PEER ADDRESS  | PEER TYPE | STATE |  SINCE   |    INFO     |+----------------+-----------+-------+----------+-------------+| 192.168.56.103 | global    | up    | 09:13:23 | Established |+----------------+-----------+-------+----------+-------------+

IPv6 BGP status
No IPv6 peers found.

root@k8s-master:~# netstat -anp | grep ESTABLISH | grep birdtcp        0      0 192.168.56.101:179      192.168.56.103:54903    ESTABLISHED 26558/bird

每台机器都只会与rr建立一条连接，并且与rr通信即可拿到所有路由，大大减少了连接数量

原文出处：https://www.cnblogs.com/MrVolleyball/p/9920964.html