Last updated on

Overview

📄 Container Networking From Scratch - Kristen Jacobs, Oracle - slides.pdf (29991 KB)（暂未托管，后续换成 Google Drive 分享链接）

GitHub - kristenjacobs/container-networking: Container networking from scratch, from a single namespace to an overlay network.

Container networking from scratch, from a single namespace to an overlay network. - GitHub - kristenjacobs/container-networking: Container networking from scratch, from a single namespace to an ove…

The Network Model

The network needs to satisfy the following (Kubernetes) requirements:

  • All containers can communicate with all other containers without NAT 所有容器都可以与所有其他容器通信，而无需NAT

  • All nodes can communicate with all containers (and vice-versa) without NAT 所有节点都可以在没有NAT的情况下与所有容器通信 (反之亦然)

  • The IP that a container sees itself as is the same IP that others see it as 容器认为自己的IP与其他人认为的IP相同

The Plan

To work our way from nothing, to a (flflannel style) overlay network in 4 ‘easy’ steps:

  • Step 1: Single network namespace.

image

  • Step 2: Single node, 2 network namespaces.

image

  • Step 3: Multiple nodes, same L2 network.

image

  • Step 4: Multiple nodes, overlay network.

image

Recap

  • Step 1: Single network namespace => Veth pair connecting namespace to the node.

  • Step 2: Single node, 2 network namespaces => Veth pairs + Linux bridge.

  • Step 3: Multiple nodes, same L2 network => Routing rules on each node.

  • Step 4: Multiple nodes, different L2 networks => Overlay network.

Key Takeaways (concepts)

  • Routing rules => The key to understanding networks

  • Tun/Tap devices => The key to understanding overlay networks

Key Takeaways (tools)

  • ip => One-stop-shop for all networking operations

  • socat => Can connect anything to anything!

  • tcpdump/tshark => For all your network debugging needs