Kubernetes网络管理：从CNI到Ingress的全面解析

Kubernetes网络管理：从CNI到Ingress的全面解析

🔥 硬核开场

各位技术大佬们，今天咱们来聊聊Kubernetes网络管理。别以为Kubernetes的网络就是简单的IP分配，实际上它涉及CNI插件、Service、Ingress、NetworkPolicy等多个组件，复杂得很！今天susu就带你们深入解析Kubernetes网络管理的最佳实践，从CNI插件选择到网络策略配置，从Service类型到Ingress部署，全给你整明白！

📋 核心内容

1. Kubernetes网络模型

• Pod网络：每个Pod都有一个唯一的IP地址
• Service网络：集群内部的服务发现和负载均衡
• 集群网络：节点间的通信
• 外部网络：集群与外部世界的通信

2. CNI插件选择

2.1 常见CNI插件

2.2 安装Calico

# 安装Calico kubectl apply -f https://docs.projectcalico.org/manifests/calico.yaml # 验证安装 kubectl get pods -n kube-system # 查看节点状态 kubectl get nodes

2.3 配置Calico网络策略

apiVersion: projectcalico.org/v3 kind: CalicoNetworkPolicy metadata: name: allow-nginx namespace: default spec: selector: app == "nginx" ingress: - action: Allow protocol: TCP source: selector: app == "frontend" destination: ports: - 80 egress: - action: Allow protocol: TCP destination: selector: app == "database" ports: - 3306

3. Service类型

3.1 ClusterIP

apiVersion: v1 kind: Service metadata: name: nginx-clusterip spec: selector: app: nginx ports: - port: 80 targetPort: 80 type: ClusterIP

3.2 NodePort

apiVersion: v1 kind: Service metadata: name: nginx-nodeport spec: selector: app: nginx ports: - port: 80 targetPort: 80 nodePort: 30080 type: NodePort

3.3 LoadBalancer

apiVersion: v1 kind: Service metadata: name: nginx-loadbalancer spec: selector: app: nginx ports: - port: 80 targetPort: 80 type: LoadBalancer

3.4 ExternalName

apiVersion: v1 kind: Service metadata: name: external-service spec: type: ExternalName externalName: example.com

4. Ingress配置

4.1 安装Ingress控制器

# 安装Nginx Ingress控制器 helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx helm repo update helm install nginx-ingress ingress-nginx/ingress-nginx --namespace ingress-nginx --create-namespace # 验证安装 kubectl get pods -n ingress-nginx # 查看Ingress服务 kubectl get svc -n ingress-nginx

4.2 配置Ingress规则

apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: nginx-ingress annotations: kubernetes.io/ingress.class: "nginx" nginx.ingress.kubernetes.io/rewrite-target: / spec: rules: - host: example.com http: paths: - path: / pathType: Prefix backend: service: name: nginx-service port: number: 80 - host: api.example.com http: paths: - path: /api pathType: Prefix backend: service: name: api-service port: number: 8080

4.3 TLS配置

apiVersion: v1 kind: Secret metadata: name: tls-secret type: kubernetes.io/tls data: tls.crt: <base64-encoded-cert> tls.key: <base64-encoded-key> --- apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: tls-ingress annotations: kubernetes.io/ingress.class: "nginx" spec: tls: - hosts: - example.com secretName: tls-secret rules: - host: example.com http: paths: - path: / pathType: Prefix backend: service: name: nginx-service port: number: 80

5. NetworkPolicy配置

5.1 默认拒绝策略

apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: default-deny namespace: default spec: podSelector: {} policyTypes: - Ingress - Egress

5.2 允许特定Pod通信

apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: allow-frontend-to-backend namespace: default spec: podSelector: matchLabels: app: backend policyTypes: - Ingress ingress: - from: - podSelector: matchLabels: app: frontend ports: - protocol: TCP port: 8080

5.3 允许外部访问

apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: allow-external-access namespace: default spec: podSelector: matchLabels: app: web policyTypes: - Ingress ingress: - from: - ipBlock: cidr: 0.0.0.0/0 ports: - protocol: TCP port: 80

6. 网络故障排查

6.1 检查Pod网络

# 检查Pod IP kubectl get pods -o wide # 检查Pod网络连通性 kubectl exec -it <pod-name> -- ping <other-pod-ip> # 检查Pod DNS解析 kubectl exec -it <pod-name> -- nslookup <service-name>

6.2 检查Service网络

# 检查Service状态 kubectl get services # 检查Service endpoints kubectl get endpoints <service-name> # 检查Service连通性 kubectl run -it --rm --image=busybox:1.28 test-pod -- ping <service-ip>

6.3 检查节点网络

# 检查节点网络状态 kubectl get nodes -o wide # 检查节点间连通性 ssh <node1> ping <node2-ip> # 检查CNI插件状态 kubectl logs -n kube-system <cni-pod-name>

7. 网络性能优化

7.1 调整MTU

apiVersion: projectcalico.org/v3 kind: FelixConfiguration metadata: name: default spec: mtu: 1450

7.2 配置网络QoS

apiVersion: scheduling.k8s.io/v1 kind: PriorityClass metadata: name: high-priority hostPriority: 1000000 value: 1000000 --- apiVersion: v1 kind: Pod metadata: name: high-priority-pod labels: app: high-priority spec: priorityClassName: high-priority containers: - name: app image: nginx resources: requests: memory: "1Gi" cpu: "1" limits: memory: "2Gi" cpu: "2"

7.3 使用多网络接口

apiVersion: k8s.cni.cncf.io/v1 kind: NetworkAttachmentDefinition metadata: name: macvlan-network spec: config: '{"cniVersion": "0.3.1", "type": "macvlan", "master": "eth1", "mode": "bridge", "ipam": {"type": "host-local", "subnet": "192.168.1.0/24", "rangeStart": "192.168.1.100", "rangeEnd": "192.168.1.200", "gateway": "192.168.1.1"}}' --- apiVersion: v1 kind: Pod metadata: name: multi-interface-pod annotations: k8s.v1.cni.cncf.io/networks: macvlan-network spec: containers: - name: app image: nginx

8. 网络安全最佳实践

8.1 限制Pod间通信

apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: restrict-pod-communication namespace: default spec: podSelector: matchLabels: app: sensitive policyTypes: - Ingress - Egress ingress: - from: - podSelector: matchLabels: app: trusted egress: - to: - podSelector: matchLabels: app: database ports: - protocol: TCP port: 3306

8.2 限制外部访问

apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: restrict-external-access namespace: default spec: podSelector: matchLabels: app: internal policyTypes: - Ingress ingress: - from: - ipBlock: cidr: 10.0.0.0/8 - ipBlock: cidr: 172.16.0.0/12 - ipBlock: cidr: 192.168.0.0/16

8.3 使用加密通信

# 安装Istio istioctl install --set profile=default -y # 启用自动注入 kubectl label namespace default istio-injection=enabled # 部署应用 kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.14/samples/bookinfo/platform/kube/bookinfo.yaml # 验证mTLS istioctl verify-install

9. 高级网络配置

9.1 服务网格

# 安装Linkerd curl -sL https://run.linkerd.io/install | sh linkerd install | kubectl apply -f - # 验证安装 linkerd check # 注入应用 kubectl get deploy -o yaml | linkerd inject - | kubectl apply -f -

9.2 网络插件自定义

apiVersion: kubeadm.k8s.io/v1beta2 kind: ClusterConfiguration networking: podSubnet: 10.244.0.0/16 serviceSubnet: 10.96.0.0/12 dnsDomain: cluster.local --- apiVersion: kubeadm.k8s.io/v1beta2 kind: InitConfiguration nodeRegistration: kubeletExtraArgs: cgroup-driver: systemd

9.3 网络策略自动化

# 安装OPA helm repo add openpolicyagent https://open-policy-agent.github.io/gatekeeper/charts helm repo update helm install gatekeeper openpolicyagent/gatekeeper --namespace gatekeeper-system --create-namespace # 配置网络策略模板 kubectl apply -f - <<EOF apiVersion: templates.gatekeeper.sh/v1beta1 kind: ConstraintTemplate metadata: name: k8srequirednetworkpolicies namespace: gatekeeper-system spec: crd: spec: names: kind: K8sRequiredNetworkPolicies validation: openAPIV3Schema: properties: allowedIngress: type: array items: type: object properties: from: type: array items: type: object properties: podSelector: type: object properties: matchLabels: type: object targets: - target: admission.k8s.gatekeeper.sh rego: package k8srequirednetworkpolicies violation[msg] { input.review.kind.kind == "Pod" not input.review.object.metadata.annotations["network-policy-exempt"] not has_network_policy(input.review.object.metadata.namespace) msg := sprintf("Pod %v/%v must have a NetworkPolicy", [input.review.object.metadata.namespace, input.review.object.metadata.name]) } has_network_policy(namespace) { policies := data.inventory.namespace[namespace]["networking.k8s.io/v1/NetworkPolicy"] count(policies) > 0 } EOF

10. 网络管理工具

1. Calicoctl：Calico网络插件的命令行工具

   curl -O -L https://github.com/projectcalico/calicoctl/releases/download/v3.22.1/calicoctl chmod +x calicoctl sudo mv calicoctl /usr/local/bin/ # 查看网络策略 calicoctl get networkpolicy

2. CNI CLI：CNI插件的命令行工具

   go get github.com/containernetworking/cni/cmd/cni # 验证CNI配置 cni --version

3. Kubernetes Network Debugger：网络调试工具

   kubectl run -it --rm --image=nicolaka/netshoot netshoot -- /bin/bash # 查看网络配置 ip addr # 测试网络连通性 ping <ip> # 查看路由表 route -n

4. Istioctl：Istio服务网格的命令行工具

   curl -L https://istio.io/downloadIstio | sh -n istioctl install --set profile=default -y # 查看服务网格状态 istioctl status # 查看服务拓扑 istioctl dashboard kiali

🛠️ 最佳实践

1. 选择合适的CNI插件：

   • 根据集群规模和需求选择合适的CNI插件
   • 生产环境推荐使用Calico或Cilium
   • 测试环境可以使用Flannel

2. 网络策略配置：

   • 实施默认拒绝策略
   • 仅允许必要的Pod间通信
   • 限制外部访问
   • 定期审计网络策略

3. Service配置：

   • 根据需求选择合适的Service类型
   • 合理设置Service端口
   • 考虑使用Headless Service进行服务发现

4. Ingress配置：

   • 选择合适的Ingress控制器
   • 配置TLS加密
   • 合理设置路由规则
   • 实施访问控制

5. 网络性能优化：

   • 调整MTU大小
   • 配置网络QoS
   • 使用多网络接口
   • 优化Pod分布

6. 网络安全：

   • 启用网络策略
   • 使用加密通信
   • 限制Pod权限
   • 定期安全审计

7. 故障排查：

   • 熟悉网络故障排查工具
   • 建立网络监控
   • 制定网络故障处理流程
   • 定期进行网络演练

8. 自动化管理：

   • 使用Helm管理网络组件
   • 实施网络配置自动化
   • 建立网络配置版本控制
   • 自动化网络策略生成

9. 文档和培训：

   • 建立网络架构文档
   • 培训团队网络知识
   • 记录网络配置变更
   • 分享网络最佳实践

10. 持续改进：

    • 定期评估网络性能
    • 优化网络配置
    • 学习和应用新的网络技术
    • 适应业务需求变化

📊 总结

Kubernetes网络管理是集群运行的重要组成部分，涉及多个组件和配置。通过本文的实践，你应该已经掌握了：

• CNI插件的选择和配置
• Service类型的使用场景
• Ingress的部署和配置
• NetworkPolicy的实施
• 网络故障排查方法
• 网络性能优化策略
• 网络安全最佳实践
• 高级网络配置
• 网络管理工具的使用

记住，网络配置是一个持续优化的过程，需要根据业务需求和集群规模不断调整。在实际生产环境中，要结合具体情况，选择合适的网络方案，确保集群的稳定运行和安全。

susu碎碎念：

• 网络策略是生产环境的必备配置，不要忽视
• 选择CNI插件时要考虑集群规模和性能需求
• 定期检查网络连通性，及时发现问题
• 网络安全要从设计阶段开始考虑
• 文档很重要，要记录网络架构和配置
• 网络监控不能少，及时发现性能瓶颈
• 持续学习网络新技术，保持技术先进性

觉得有用？点个赞再走！咱们下期见～ 🔥