1.1
使用到的組件
network namespace
bridge
veth pair注意事項:所有命令都是在集羣master節點操作測試.
1.2
network namespace執行命令ip netns會顯示創建的network namespace
如果顯示空白,請做link,命令見下:
[root@k8s-master2 ~]# ln -s /var/run/docker/netns/ /var/run/netns[root@k8s-master1 ~]# ip netns
default
[root@k8s-master1 ~]#[root@k8s-master2 ~]# ip netns
netns
290d0c6ad2ab (id: 3)
49bfcc08baa8 (id: 2)
aeb6eaef384f (id: 1)
8d103e06202b (id: 0)
default
[root@k8s-master2 ~]#[root@k8s-master3 ~]# ip netns
789ea14c2216 (id: 4)
a4dbfec964e5 (id: 3)
4bdb1409b6e3 (id: 2)
daea28f1e8b2 (id: 1)
0566deb27814 (id: 0)
default
[root@k8s-master3 ~]#可以看到每個節點顯示的內容不同,默認只有一個default.
1.3
爲什麼每個節點顯示的不同？
以master3做示例,見下
[root@k8s-master3 ~]# ip a |grep veth
8: veth2a37cd9@if7: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue master docker0 state UP
10: veth27e9e7e@if9: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue master docker0 state UP
12: veth3ed5bcb@if11: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue master docker0 state UP
14: vethc4d2905@if13: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue master docker0 state UP
16: vethd67ea28@if15: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue master docker0 state UP
[root@k8s-master3 ~]#[root@k8s-master3 ~]# ip netns
789ea14c2216 (id: 4)
a4dbfec964e5 (id: 3)
4bdb1409b6e3 (id: 2)
daea28f1e8b2 (id: 1)
0566deb27814 (id: 0)
default
[root@k8s-master3 ~]#注意,一個netns對應了一個虛擬的網卡.怎麼對應的呢？
示例,見下:
[root@k8s-master3 ~]# ip netns exec 0566deb27814 ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
7: eth0@if8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UP
link/ether 02:42:ac:1e:5b:02 brd ff:ff:ff:ff:ff:ff link-netnsid 0
inet 172.30.91.2/24 scope global eth0
valid_lft forever preferred_lft forever
inet6 fe80::42:acff:fe1e:5b02/64 scope link
valid_lft forever preferred_lft forever請看這條:
eth0@if8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UP對應的是:
8: veth2a37cd9@if7: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue master docker0 state UP這是一個veth pair對.
可用命令
[root@k8s-master3 ~]# ethtool -i veth2a37cd9
driver: veth
version: 1.0
firmware-version:
expansion-rom-version:
bus-info:
supports-statistics: yes
supports-test: no
supports-eeprom-access: no
supports-register-dump: no
supports-priv-flags: no
[root@k8s-master3 ~]# ethtool -S veth2a37cd9
NIC statistics:
peer_ifindex: 7
[root@k8s-master3 ~]#回到開始的問題,爲什麼每個節點顯示的不同呢？
network namespace是怎麼來的呢？
先敲命令做顯示對比.
pod
[root@k8s-master3 ~]# kubectl get pod -n kube-system -o wide
NAME READY STATUS RESTARTS AGE IP NODE
coredns-779ffd89bd-5znxf 1/1 Running 2 18h 172.30.91.3 k8s-master3
kubernetes-dashboard-65c76f6c97-4kg2r 1/1 Running 3 18h 172.30.91.5 k8s-master3
tiller-deploy-58d57fd669-w8wsz 1/1 Running 3 18h 172.30.91.2 k8s-master3
traefik-ingress-controller-77b549b5d9-4xd58 1/1 Running 4 4d 192.168.32.130 k8s-master3
traefik-ingress-controller-77b549b5d9-dj65f 1/1 Running 10 34d 192.168.32.129 k8s-master2
traefik-ingress-controller-77b549b5d9-hpt4z 1/1 Running 11 34d 192.168.32.128 k8s-master1
[root@k8s-master3 ~]#pod的ip
[root@k8s-master3 ~]# kubectl exec -it tiller-deploy-58d57fd669-w8wsz /bin/sh -n kube-system
~ $ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
7: eth0@if8: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1450 qdisc noqueue state UP
link/ether 02:42:ac:1e:5b:02 brd ff:ff:ff:ff:ff:ff
inet 172.30.91.2/24 scope global eth0
valid_lft forever preferred_lft forever
inet6 fe80::42:acff:fe1e:5b02/64 scope link
valid_lft forever preferred_lft forevereth0@if8,看看這個network namespace的ip情況
[root@k8s-master3 ~]# ip netns exec 0566deb27814 ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
7: eth0@if8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UP
link/ether 02:42:ac:1e:5b:02 brd ff:ff:ff:ff:ff:ff link-netnsid 0
inet 172.30.91.2/24 scope global eth0
valid_lft forever preferred_lft forever
inet6 fe80::42:acff:fe1e:5b02/64 scope link
valid_lft forever preferred_lft forever一個pod對應了一個network namespace,pod使用的網絡連接口就是network namespace的網絡口.
1.4
bridge
執行命令,見下:
[root@k8s-master3 ~]# brctl show
bridge name bridge id STP enabled interfaces
docker0 8000.0242c5980278 no veth27e9e7e
veth2a37cd9
veth3ed5bcb
vethc4d2905
vethd67ea28
[root@k8s-master3 ~]# ip a |grep veth
8: veth2a37cd9@if7: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue master docker0 state UP
10: veth27e9e7e@if9: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue master docker0 state UP
12: veth3ed5bcb@if11: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue master docker0 state UP
14: vethc4d2905@if13: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue master docker0 state UP
16: vethd67ea28@if15: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue master docker0 state UP結論:
這些虛擬網卡每個對應的eth pair一端(另一端在namaspace裏其實也就是在pod裏,參考上面的分析),同時這些虛擬網卡橋接到了網橋docker上.
1.5
網橋docker和pod的邏輯拓撲關係圖
拓撲見下: