Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
From network namespace to fabric overlay
Search
Eugene Yakubovich
August 19, 2015
Technology
0
33
From network namespace to fabric overlay
My talk from ContainerCon 2015
Eugene Yakubovich
August 19, 2015
Tweet
Share
More Decks by Eugene Yakubovich
See All by Eugene Yakubovich
Container Network Interface: Network plugins for Kubernetes and beyond
eyakubovich
0
250
CoreOS NYC Meetup
eyakubovich
2
180
Other Decks in Technology
See All in Technology
PHPカンファレンス小田原2024
ysknsid25
2
660
AWS を使う上で知っておきたいオンプレミス知識/aws-on-premise-essentials
emiki
1
4.2k
ここが嬉しいABAC ここが辛いよABAC #再解説+補足編
masahirokawahara
0
200
テストプロセスで大事にしていること #jasstnano
makky_tyuyan
0
110
Next'24 事例セッションの紹介とクラウド資格を活用したキャリア形成について語りMuscle
yasumuusan
0
300
Algyan イベント振り返り
linyixian
0
180
エンタープライズ環境下での Active Directory の運用 TIPS
tamaiyutaro
1
1.5k
LLM とプロンプトエンジニアリング/チューターをビルドする / LLM and Prompt Engineering and Building Tutors
ks91
PRO
0
220
Garoon 開発チーム / Garoon development team
cybozuinsideout
PRO
1
2.9k
DevOpsメトリクスとアウトカムの接続にトライ!開発プロセスを通して計測できるメトリクスの活用方法
ham0215
0
180
最近たまに見かけるTiDBってなんだ? - Findy
pingcap0315
2
530
株式会社EventHub・エンジニア採用資料
eventhub
0
1.9k
Featured
See All Featured
The World Runs on Bad Software
bkeepers
PRO
61
6.7k
CSS Pre-Processors: Stylus, Less & Sass
bermonpainter
352
28k
Build your cross-platform service in a week with App Engine
jlugia
224
17k
Debugging Ruby Performance
tmm1
69
11k
Rebuilding a faster, lazier Slack
samanthasiow
72
8.2k
Done Done
chrislema
178
15k
Become a Pro
speakerdeck
PRO
9
4.5k
A better future with KSS
kneath
230
16k
Teambox: Starting and Learning
jrom
128
8.4k
The Brand Is Dead. Long Live the Brand.
mthomps
48
28k
KATA
mclloyd
14
12k
Designing for humans not robots
tammielis
247
25k
Transcript
From network namespace to fabric overlays Eugene Yakubovich @eyakubovich
Containers are awesome - Containers provide isolation - For networking
- its own port space - its own IP
Network Namespace - Can every container have a "real" IP?
- How should network be virtualized? - Is network virtualization part of "container runtime"?
$ sudo unshare -n /bin/bash $ ip addr 1: lo:
<LOOPBACK> mtu 65536 ... link/loopback 00:00:00:00:00:00 brd ... New net ns
$ ip link set lo up $ ip addr 1:
lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 ... link/loopback 00:00:00:00:00:00 brd ... inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever New net ns
$ ping 8.8.8.8 connect: Network is unreachable $ ip route
show $ New net ns
veth 10.0.1.5/31 10.0.1.4 10.0.1.7/31 10.0.1.6
veth 10.0.1.5/24 10.0.1.7/24 10.0.1.1/24
Virtualizing the NIC and Network - veth pair (plus linux-bridge)
- macvlan - ipvlan - OVS - vlan - vxlan
IP Address Management - Host - Cluster - Global
Which one? No right answer!
Need pluggable network strategy
Container Runtime (e.g. rkt) veth macvlan ipvlan OVS
Container Runtime (e.g. rkt) veth macvlan ipvlan OVS
Container Runtime (e.g. rkt) veth macvlan ipvlan OVS Container Networking
Interface (CNI)
CNI - Container can join multiple networks - Network described
by JSON config - Plugin supports two commands - Add container to the network - Remove container from the network
User configures a network $ cat /etc/rkt/net.d/10-mynet.conf { "name": "mynet",
"type": "bridge", "ipam": { "type": "host-local", "subnet": "10.10.0.0/16" } }
CNI: Step 1 Container runtime creates network namespace and gives
it a named handle $ cd /run $ touch myns $ unshare -n mount --bind /proc/self/ns/net myns
CNI: Step 2 Container runtime invokes the CNI plugin $
export CNI_COMMAND=ADD $ export CNI_NETNS=/run/myns $ export CNI_CONTAINERID=5248e9f8-3c91-11e5-... $ export CNI_IFNAME=eth0 $ $CNI_PATH/bridge </etc/rkt/net.d/10-mynet.conf
CNI: Step 3 Inside the bridge plugin (1): $ brctl
addbr mynet $ ip link add veth123 type veth peer name $CNI_IFNAME $ brctl addif mynet veth123 $ ip link set $CNI_IFNAME netns $CNI_IFNAME $ ip link set veth123 up
CNI: Step 3 Inside the bridge plugin (2): $ IPAM_PLUGIN=host-local
# from network conf $ echo $IPAM_PLUGIN { "ip4": { "ip": "10.10.5.9/16", "gateway": "10.10.0.1" } }
CNI: Step 3 Inside the bridge plugin (3): # switch
to container namespace $ ip addr add 10.0.5.9/16 dev $CNI_IFNAME # Finally, print IPAM result JSON to stdout
Current plugins Top level ptp bridge macvlan ipvlan IPAM host-local
dhcp
Q: How do we give each container a routable IP
in "restricted" env? A: Overlay network: flannel, weave
None
None
{ "network": "10.1.0.0/16" }
10.1.16.0/24 10.1.24.0/24 10.1.71.0/24
10.1.16.0/24 # /run/flannel/subnet.env FLANNEL_NETWORK=10.1.0.0/16 FLANNEL_SUBNET=10.1.16.0/24 FLANNEL_MTU=1472
10.0.16.0/24 10.1.24.0/24 10.1.71.0/24 10.1.16.2 10.1.24.3
Putting it all together CNI
flannel CNI plugin - "meta" plugin - reads in /run/flannel/subnet.env
- writes out "bridge" + "host-local" conf - calls out to "bridge"
{ "name": "mynet", "type": "flannel" } # /run/flannel/subnet.env FLANNEL_NETWORK=10.1.0.0/16 FLANNEL_SUBNET=10.1.16.0/24
FLANNEL_MTU=1472 { "name": "mynet", "type": "bridge", "mtu": 1472, "ipam": { "type": "host-local", "subnet": "10.1.16.0/24" } }
$ sudo rkt run --private-net=mynet --interactive debian.aci (debian) $ ip
addr … 10.1.16.2 … (debian) $ ping 10.1.71.3 PING 10.1.71.3 (10.1.71.3) 56(84) bytes of data. 64 bytes from 10.1.71.3: icmp_seq=1 ttl=55 time=1.6 ms
Questions github.com/appc/cni github.com/coreos/rkt github.com/coreos/flannel