Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update kubernetes.md #747

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Update kubernetes.md #747

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 17 additions & 17 deletions specs/kubernetes.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ There is a need to provide pod addressing, network isolation, policy based secur
# 3. Proposed solution
Currently K8s provides a flat networking model wherein all pods can talk to each other. Network policy is the new feature added to provide security between the pods. Opencontrail will add additional networking functionality to the solution - multi-tenancy, network isolation, micro-segmentation with network policies, load-balancing etc. Opencontrail can be configured in the following mode in a K8s cluster:

3.1 Cluster isolation
# 3.1 Cluster isolation

Kubernetes imposes the following fundamental requirement on any networking implementation:

Expand All @@ -28,26 +28,26 @@ from a pod subnet that the Contrail Kubernetes manager is configured with.
NOTE:
System pods spawned in Kube-system namespace are NOT run in the Kubernetes Cluster. Rather they run in the underlay. Networking for these pods is not handled by Contrail.

3.1.1 Implementation
# 3.1.1 Implementation

Contrail achieves this inter-pod network connectivity by configuring all the pods in a single Virtual-network. When the cluster is initialized, Contrail creates a virtual-network called "cluster-network".

In the absence of any network segmentation/isolation configured, ALL pods in ALL namespaces get assigned to "cluster-network" virtual-network.

3.1.2 Pods
# 3.1.2 Pods

In Contrail, each POD is represented as a Virtual-Machine-Interface/Port.

When a pod is created, a vmi/port is allocated for that POD. This port is made a member of the default virtual-network of that Kubernetes cluster.

3.1.3 Pod subnet:
# 3.1.3 Pod subnet:

The CIDR to be used for IP address allocation for pods is provisioned as a configuration to
contrail-kube-manger. To view this subnet info:

Login to contrail-kube-manager docker running on the Master node and see the "pod_subnets" in configuration file: /etc/contrail/contrail-kubernetes.conf

3.2 Namespace isolation mode
# 3.2 Namespace isolation mode

In addition to default networking model mandated by Kubernetes, Contrail support additional, custom networking models that makes available the many rich features of Contrail to the users of the Kubernetes cluster. One such feature is network isolation for Kubernetes namespaces.

Expand All @@ -70,15 +70,15 @@ c. Pods created in isolated namespace can reach pods in other namespaces.
d. Pods in isolated namespace will be able to reach ALL Services created in any namespace in the kubernetes cluster.
e. Pods in isolated namespace can be reached from pods in other namespaces through Kubernetes Service-ip.

3.2.1 Implementation:
# 3.2.1 Implementation

For each namespace that is annotated as isolated, Contrail will create a Virtual-network with name: “<Namespace-name>-vn”
For each namespace that is annotated as isolated, Contrail will create a Virtual-network with name: “<Namespace-name>-vn”.

3.2.2 Pods:
# 3.2.2 Pods

A Kubernetes pod is represented as vmi/port in Contrail. These ports are mapped to the virtual-network created for the corresponding isolated-namespace.

3.2.3 Kubernetes Service Reachability:
# 3.2.3 Kubernetes Service Reachability:

Pods from an isolated namespace should be able to reach all Kubernetes in the cluster.

Expand Down Expand Up @@ -128,9 +128,9 @@ Kubernetes(K8S) implements DNS using SkyDNS, a small DNS application that respon
* Native loadbalancer implementation is needed to support service loadbalancing. https://blueprints.launchpad.net/juniperopenstack/+spec/native-ecmp-loadbalancer
* Health check implementation

9. Debugging
# 9. Debugging

9.1 Pod IP Address Info:
# 9.1 Pod IP Address Info:

The following command can be used to determine the ip address assigned to a pod:

Expand All @@ -144,7 +144,7 @@ Kubernetes(K8S) implements DNS using SkyDNS, a small DNS application that respon
default client-2 1/1 Running 0 19d 10.47.255.246 k8s-minion-1-1
default client-x 1/1 Running 0 19d 10.84.31.72 k8s-minion-1-1

9.2 Check Pods reachability:
# 9.2 Check Pods reachability:

To verify that pods are reachable to each other, we can run ping among pods:

Expand All @@ -162,16 +162,16 @@ Kubernetes(K8S) implements DNS using SkyDNS, a small DNS application that respon
64 bytes from 10.47.255.250: icmp_seq=0 ttl=63 time=1.510 ms
64 bytes from 10.47.255.250: icmp_seq=1 ttl=63 time=0.094 ms

9.3 Verify that default virtual-network for a cluster is created:
# 9.3 Verify that default virtual-network for a cluster is created:

In the Contrail GUI, verify that a virtual-network named “cluster-network” is created in your project.

9.4 Verify a virtual-network is created for an isolated namespace:
# 9.4 Verify a virtual-network is created for an isolated namespace:

In the Contrail-GUI, verify that a virtual-network with the name format: “<namespace-name>-
vn” is created.

9.5 Verify that Pods from non-isolated namespace CANNOT reach Pods in isolated namespace.
# 9.5 Verify that Pods from non-isolated namespace CANNOT reach Pods in isolated namespace.

1. Get the ip of the pod in isolated namespace.
[root@a7s16 ~]# kubectl get pod -n test-isolated-ns -o wide
Expand All @@ -188,7 +188,7 @@ Kubernetes(K8S) implements DNS using SkyDNS, a small DNS application that respon
--- 10.47.255.249 ping statistics ---
2 packets transmitted, 0 packets received, 100% packet loss

9.6 Verify that Pods in isolated namespace can reach Pods in in non-isolated namespaces.
# 9.6 Verify that Pods in isolated namespace can reach Pods in in non-isolated namespaces.

1. Get the ip of the pod in non-isolated namespace.

Expand All @@ -211,7 +211,7 @@ Kubernetes(K8S) implements DNS using SkyDNS, a small DNS application that respon
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max/stddev = 0.137/0.802/1.467/0.665 ms

9.7 How to check if a Kubernetes namespace is isolated.
# 9.7 How to check if a Kubernetes namespace is isolated.

Use the following command to look at annotations on the namespace:

Expand Down