网络

路由:

[root@master2 ~]# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.0.2.2        0.0.0.0         UG    100    0        0 enp0s3  # 默认路由 
10.0.2.0        0.0.0.0         255.255.255.0   U     100    0        0 enp0s3  # 10.0.2.0/24 网段转发到 enp0s3 网卡
172.17.0.0      0.0.0.0         255.255.0.0     U     0      0        0 docker0 # 172.17.0.0/16 网段转发到 docker0网卡
172.20.90.64    0.0.0.0         255.255.255.192 U     0      0        0 *  #172.20.90.64~172.20.90.255段路由不处理# (黑洞路由)
172.20.90.115   0.0.0.0         255.255.255.255 UH    0      0        0 cali77fecf994f2  # 直连路由本地ip 转发到 网卡 cali77fecf994f2
172.20.90.116   0.0.0.0         255.255.255.255 UH    0      0        0 calidd3b68904c7
172.20.90.117   0.0.0.0         255.255.255.255 UH    0      0        0 cali80cf099a3f0
172.20.90.118   0.0.0.0         255.255.255.255 UH    0      0        0 cali298bc4793e2
172.20.90.119   0.0.0.0         255.255.255.255 UH    0      0        0 cali1ad9c3b4a49
172.20.90.120   0.0.0.0         255.255.255.255 UH    0      0        0 cali5c888d10e94
172.20.90.121   0.0.0.0         255.255.255.255 UH    0      0        0 calib38fc4b1048
172.20.90.122   0.0.0.0         255.255.255.255 UH    0      0        0 cali964dd0955c6
172.20.200.64   192.168.56.107  255.255.255.192 UG    0      0        0 tunl0  # 网络路由，172.20.200.64~172.20.200.255网段路由发到网卡tunl0
172.20.213.64   192.168.56.101  255.255.255.192 UG    0      0        0 tunl0
172.20.250.128  192.168.56.104  255.255.255.192 UG    0      0        0 tunl0
192.168.56.0    0.0.0.0         255.255.255.0   U     101    0        0 enp0s8  # 内网网段发到网卡 enp0s8


# 集群外节点访问pod IP
# 100 节点 (集群外)
route add -net 172.20.0.0 netmask 255.255.0.0 gw 192.168.56.101

# 101节点(集群内)
iptables -t nat -A POSTROUTING -s 192.168.56.100/22 -d 172.20.0.0/16 -j MASQUERADE

# 验证联通性
[root@localhost ~]# ping 172.20.250.134
PING 172.20.250.134 (172.20.250.134) 56(84) bytes of data.
64 bytes from 172.20.250.134: icmp_seq=1 ttl=62 time=0.911 ms
64 bytes from 172.20.250.134: icmp_seq=2 ttl=62 time=0.895 ms

[root@localhost ~]# ping 172.20.213.105
PING 172.20.213.105 (172.20.213.105) 56(84) bytes of data.
64 bytes from 172.20.213.105: icmp_seq=1 ttl=63 time=0.463 ms
64 bytes from 172.20.213.105: icmp_seq=2 ttl=63 time=0.965 ms

veth-pair:

# 创建网络命名空间ns1
 ip netns a ns1
# 查看网络命名空间
 ip netns list
# 创建一对 veth-pair  veth0  和 veth1
 ip l a veth0 type veth peer name veth1
# 将veth0加到命名空间ns1
 ip l s veth0 netns ns1
# 将veth1加到主机命名空间
 ip l s veth1
# 查看主机网卡状态
 ip a|grep veth
#分配IP并启用
 ip netns exec ns1 ip a a 10.1.1.2/24 dev veth0
 ip netns exec ns1 ip l s veth0 up
 ip a a 10.1.1.3/24 dev veth1
 ip l s veth1 up
# 查看主机网卡状态
 ip a|grep veth
# 测试联通性
 ping 10.1.1.2
 ip netns exec ns1 ping 10.1.1.3

ip隧道:

# //主机 192.168.56.101
#创建 tun 设备 tun1 指定隧道外层IP
ip tunnel add tun1 mode ipip remote 192.168.56.103 local 192.168.56.101
# 启用 设备 tun1 
ip l s tun1 up
# 配置 隧道 指定隧道内层IP
ip a a 10.10.100.10 peer 10.10.200.10 dev tun1

# 主机 192.168.56.103
#创建 tun 设备 tun2 指定隧道外层IP
ip tunnel add tun2 mode ipip remote 192.168.56.101 local 192.168.56.103
# 启用 设备 tun2 
ip l s tun2 up
# 配置 隧道 指定隧道内层IP
ip a a 10.10.200.10 peer 10.10.100.10 dev tun2

# 测试连通性
ping 10.10.200.10
ping 10.10.100.10

网络命名空间

docker inspect -f '{{.State.Pid}}' "2d89f1b089cf"
mkdir -p /var/run/netns
ln -sf /proc/2189/ns/net "/var/run/netns/2d89f1b089cf"
ip netns
ip netns exec 2d89f1b089cf ip a

iptables

hep: host endpoint
wl: workload endpoint
fw: from workload endpoint
tw: to wordkoad endpoint
fip: floating IP (为某容器绑定的一个非容器段的IP地址：如node段的局域网IP)
cali-: 前缀，calico的规则链
from-xxx: xxx发出的报文
to-xxx: 发送到xxx的报文
po: policy outbound
pi: policy inbound
pro: profile outbound
pri: profile inbound

ARP

confd

root@master2:/etc/calico/confd/conf.d# cat bird.toml 
[template]
src = "bird.cfg.template"
dest = "/etc/calico/confd/config/bird.cfg"
prefix = "/calico/bgp/v1"
keys = [
    "/host",
    "/global",
]
check_cmd = "bird -p -c {{.src}}"
reload_cmd = "pkill -HUP bird || true"

lvs:

五层协议:

bridge:

ovs: