CNI

CNI Basics

利用中の Network plugin の確認

$ ps -aux | grep kubelet
root      2094  2.9  5.0 904428 102920 ?       Ssl  21:29   1:20 /usr/bin/kubelet --bootstrap-kubeconfig=/etc/kubernetes/bootstrap-kubelet.conf --kubeconfig=/etc/kubernetes/kubelet.conf --config=/var/lib/kubelet/config.yaml --cgroup-driver=cgroupfs --cni-bin-dir=/opt/cni/bin --cni-conf-dir=/etc/cni/net.d --network-plugin=cni
root      2428  3.5 15.6 396996 320688 ?       Ssl  21:29   1:35 kube-apiserver --authorization-mode=Node,RBAC --advertise-address=172.17.0.27 --allow-privileged=true --client-ca-file=/etc/kubernetes/pki/ca.crt --disable-admission-plugins=PersistentVolumeLabel --enable-admission-plugins=NodeRestriction --enable-bootstrap-token-auth=true --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key --etcd-servers=https://127.0.0.1:2379 --insecure-port=0 --kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt --kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key --requestheader-allowed-names=front-proxy-client --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-key-file=/etc/kubernetes/pki/sa.pub --service-cluster-ip-range=10.96.0.0/12 --tls-cert-file=/etc/kubernetes/pki/apiserver.crt --tls-private-key-file=/etc/kubernetes/pki/apiserver.key

利用中の plugin は --network-plugin=cni から確認できる。
利用可能な CNI plugin のバイナリファイルが格納されるディレクトリは --cni-bin-dir=/opt/cni/bin から確認できる。

環境次第だが、こんな感じで見える。

$ ls /opt/cni/bin/
bridge  dhcp  flannel  host-local  ipvlan  loopback  macvlan  portmap  ptp  sample  tuning  vlan  weave-ipam  weave-net  weave-plugin-2.2.1

クラスタにて設定されている CNI plugin のディレクトリは --cni-conf-dir=/etc/cni/net.d から確認できる。
weave を使ってたらこんな感じになる。

$ ls /etc/cni/net.d/
10-weave.conf

$ cat /etc/cni/net.d/10-weave.conf
{
    "name": "weave",
    "type": "weave-net",
    "hairpinMode": true
}

weave 関連

weave のデプロイ

https://www.weave.works/docs/net/latest/kubernetes/kube-addon/

$ kubectl apply -f "https://cloud.weave.works/k8s/net?k8s-version=$(kubectl version | base64 | tr -d '\n')"

weave により作られる nw interface

$ ip link
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
    link/ether 02:42:ac:11:00:06 brd ff:ff:ff:ff:ff:ff
3: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN mode DEFAULT group default
    link/ether 02:42:64:71:51:5b brd ff:ff:ff:ff:ff:ff
4: datapath: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1376 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1
    link/ether b6:70:a6:6c:94:51 brd ff:ff:ff:ff:ff:ff
6: weave: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1376 qdisc noqueue state UP mode DEFAULT group default qlen 1000
    link/ether ce:13:79:1a:ed:6c brd ff:ff:ff:ff:ff:ff
...

weave という名前のインターフェースが作成される。

weave が利用する CIDR

$ ip a show weave
6: weave: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1376 qdisc noqueue state UP group default qlen 1000
    link/ether ce:13:79:1a:ed:6c brd ff:ff:ff:ff:ff:ff
    inet 10.44.0.0/12 brd 10.47.255.255 scope global weave
       valid_lft forever preferred_lft forever
    inet6 fe80::cc13:79ff:fe1a:ed6c/64 scope link
       valid_lft forever preferred_lft forever


master $ kubectl logs weave-net-4qvvk weave -n kube-system  | grep ip
INFO: 2019/09/28 09:05:51.209295 Command line options: map[datapath:datapath ipalloc-init:consensus=2 nickname:master port:6783 status-addr:0.0.0.0:6782 host-root:/host ipalloc-range:10.32.0.0/12 name:ce:13:79:1a:ed:6c conn-limit:30 db-prefix:/weavedb/weave-net docker-api: expect-npc:true http-addr:127.0.0.1:6784 no-dns:true]

ipalloc-range:10.32.0.0/12 という記述から

← RBACCoreDNS →