Kubernetes网络管理：从CNI到Ingress的全面解析

Kubernetes网络管理从CNI到Ingress的全面解析 硬核开场各位技术大佬们今天咱们来聊聊Kubernetes网络管理。别以为Kubernetes的网络就是简单的IP分配实际上它涉及CNI插件、Service、Ingress、NetworkPolicy等多个组件复杂得很今天susu就带你们深入解析Kubernetes网络管理的最佳实践从CNI插件选择到网络策略配置从Service类型到Ingress部署全给你整明白 核心内容1. Kubernetes网络模型Pod网络每个Pod都有一个唯一的IP地址Service网络集群内部的服务发现和负载均衡集群网络节点间的通信外部网络集群与外部世界的通信2. CNI插件选择2.1 常见CNI插件插件名称类型特点适用场景Calico网络策略基于BGP支持网络策略生产环境需要网络策略Flannel简单网络基于VXLAN配置简单测试环境简单部署Cilium网络安全基于eBPF高性能高性能场景需要细粒度安全Weave Net简单网络自动发现配置简单快速部署小规模集群Canal组合方案Calico Flannel需要网络策略和简单部署2.2 安装Calico# 安装Calico kubectl apply -f https://docs.projectcalico.org/manifests/calico.yaml # 验证安装 kubectl get pods -n kube-system # 查看节点状态 kubectl get nodes2.3 配置Calico网络策略apiVersion: projectcalico.org/v3 kind: CalicoNetworkPolicy metadata: name: allow-nginx namespace: default spec: selector: app nginx ingress: - action: Allow protocol: TCP source: selector: app frontend destination: ports: - 80 egress: - action: Allow protocol: TCP destination: selector: app database ports: - 33063. Service类型3.1 ClusterIPapiVersion: v1 kind: Service metadata: name: nginx-clusterip spec: selector: app: nginx ports: - port: 80 targetPort: 80 type: ClusterIP3.2 NodePortapiVersion: v1 kind: Service metadata: name: nginx-nodeport spec: selector: app: nginx ports: - port: 80 targetPort: 80 nodePort: 30080 type: NodePort3.3 LoadBalancerapiVersion: v1 kind: Service metadata: name: nginx-loadbalancer spec: selector: app: nginx ports: - port: 80 targetPort: 80 type: LoadBalancer3.4 ExternalNameapiVersion: v1 kind: Service metadata: name: external-service spec: type: ExternalName externalName: example.com4. Ingress配置4.1 安装Ingress控制器# 安装Nginx Ingress控制器 helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx helm repo update helm install nginx-ingress ingress-nginx/ingress-nginx --namespace ingress-nginx --create-namespace # 验证安装 kubectl get pods -n ingress-nginx # 查看Ingress服务 kubectl get svc -n ingress-nginx4.2 配置Ingress规则apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: nginx-ingress annotations: kubernetes.io/ingress.class: nginx nginx.ingress.kubernetes.io/rewrite-target: / spec: rules: - host: example.com http: paths: - path: / pathType: Prefix backend: service: name: nginx-service port: number: 80 - host: api.example.com http: paths: - path: /api pathType: Prefix backend: service: name: api-service port: number: 80804.3 TLS配置apiVersion: v1 kind: Secret metadata: name: tls-secret type: kubernetes.io/tls data: tls.crt: base64-encoded-cert tls.key: base64-encoded-key --- apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: tls-ingress annotations: kubernetes.io/ingress.class: nginx spec: tls: - hosts: - example.com secretName: tls-secret rules: - host: example.com http: paths: - path: / pathType: Prefix backend: service: name: nginx-service port: number: 805. NetworkPolicy配置5.1 默认拒绝策略apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: default-deny namespace: default spec: podSelector: {} policyTypes: - Ingress - Egress5.2 允许特定Pod通信apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: allow-frontend-to-backend namespace: default spec: podSelector: matchLabels: app: backend policyTypes: - Ingress ingress: - from: - podSelector: matchLabels: app: frontend ports: - protocol: TCP port: 80805.3 允许外部访问apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: allow-external-access namespace: default spec: podSelector: matchLabels: app: web policyTypes: - Ingress ingress: - from: - ipBlock: cidr: 0.0.0.0/0 ports: - protocol: TCP port: 806. 网络故障排查6.1 检查Pod网络# 检查Pod IP kubectl get pods -o wide # 检查Pod网络连通性 kubectl exec -it pod-name -- ping other-pod-ip # 检查Pod DNS解析 kubectl exec -it pod-name -- nslookup service-name6.2 检查Service网络# 检查Service状态 kubectl get services # 检查Service endpoints kubectl get endpoints service-name # 检查Service连通性 kubectl run -it --rm --imagebusybox:1.28 test-pod -- ping service-ip6.3 检查节点网络# 检查节点网络状态 kubectl get nodes -o wide # 检查节点间连通性 ssh node1 ping node2-ip # 检查CNI插件状态 kubectl logs -n kube-system cni-pod-name7. 网络性能优化7.1 调整MTUapiVersion: projectcalico.org/v3 kind: FelixConfiguration metadata: name: default spec: mtu: 14507.2 配置网络QoSapiVersion: scheduling.k8s.io/v1 kind: PriorityClass metadata: name: high-priority hostPriority: 1000000 value: 1000000 --- apiVersion: v1 kind: Pod metadata: name: high-priority-pod labels: app: high-priority spec: priorityClassName: high-priority containers: - name: app image: nginx resources: requests: memory: 1Gi cpu: 1 limits: memory: 2Gi cpu: 27.3 使用多网络接口apiVersion: k8s.cni.cncf.io/v1 kind: NetworkAttachmentDefinition metadata: name: macvlan-network spec: config: {cniVersion: 0.3.1, type: macvlan, master: eth1, mode: bridge, ipam: {type: host-local, subnet: 192.168.1.0/24, rangeStart: 192.168.1.100, rangeEnd: 192.168.1.200, gateway: 192.168.1.1}} --- apiVersion: v1 kind: Pod metadata: name: multi-interface-pod annotations: k8s.v1.cni.cncf.io/networks: macvlan-network spec: containers: - name: app image: nginx8. 网络安全最佳实践8.1 限制Pod间通信apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: restrict-pod-communication namespace: default spec: podSelector: matchLabels: app: sensitive policyTypes: - Ingress - Egress ingress: - from: - podSelector: matchLabels: app: trusted egress: - to: - podSelector: matchLabels: app: database ports: - protocol: TCP port: 33068.2 限制外部访问apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: restrict-external-access namespace: default spec: podSelector: matchLabels: app: internal policyTypes: - Ingress ingress: - from: - ipBlock: cidr: 10.0.0.0/8 - ipBlock: cidr: 172.16.0.0/12 - ipBlock: cidr: 192.168.0.0/168.3 使用加密通信# 安装Istio istioctl install --set profiledefault -y # 启用自动注入 kubectl label namespace default istio-injectionenabled # 部署应用 kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.14/samples/bookinfo/platform/kube/bookinfo.yaml # 验证mTLS istioctl verify-install9. 高级网络配置9.1 服务网格# 安装Linkerd curl -sL https://run.linkerd.io/install | sh linkerd install | kubectl apply -f - # 验证安装 linkerd check # 注入应用 kubectl get deploy -o yaml | linkerd inject - | kubectl apply -f -9.2 网络插件自定义apiVersion: kubeadm.k8s.io/v1beta2 kind: ClusterConfiguration networking: podSubnet: 10.244.0.0/16 serviceSubnet: 10.96.0.0/12 dnsDomain: cluster.local --- apiVersion: kubeadm.k8s.io/v1beta2 kind: InitConfiguration nodeRegistration: kubeletExtraArgs: cgroup-driver: systemd9.3 网络策略自动化# 安装OPA helm repo add openpolicyagent https://open-policy-agent.github.io/gatekeeper/charts helm repo update helm install gatekeeper openpolicyagent/gatekeeper --namespace gatekeeper-system --create-namespace # 配置网络策略模板 kubectl apply -f - EOF apiVersion: templates.gatekeeper.sh/v1beta1 kind: ConstraintTemplate metadata: name: k8srequirednetworkpolicies namespace: gatekeeper-system spec: crd: spec: names: kind: K8sRequiredNetworkPolicies validation: openAPIV3Schema: properties: allowedIngress: type: array items: type: object properties: from: type: array items: type: object properties: podSelector: type: object properties: matchLabels: type: object targets: - target: admission.k8s.gatekeeper.sh rego: package k8srequirednetworkpolicies violation[msg] { input.review.kind.kind Pod not input.review.object.metadata.annotations[network-policy-exempt] not has_network_policy(input.review.object.metadata.namespace) msg : sprintf(Pod %v/%v must have a NetworkPolicy, [input.review.object.metadata.namespace, input.review.object.metadata.name]) } has_network_policy(namespace) { policies : data.inventory.namespace[namespace][networking.k8s.io/v1/NetworkPolicy] count(policies) 0 } EOF10. 网络管理工具CalicoctlCalico网络插件的命令行工具curl -O -L https://github.com/projectcalico/calicoctl/releases/download/v3.22.1/calicoctl chmod x calicoctl sudo mv calicoctl /usr/local/bin/ # 查看网络策略 calicoctl get networkpolicyCNI CLICNI插件的命令行工具go get github.com/containernetworking/cni/cmd/cni # 验证CNI配置 cni --versionKubernetes Network Debugger网络调试工具kubectl run -it --rm --imagenicolaka/netshoot netshoot -- /bin/bash # 查看网络配置 ip addr # 测试网络连通性 ping ip # 查看路由表 route -nIstioctlIstio服务网格的命令行工具curl -L https://istio.io/downloadIstio | sh -n istioctl install --set profiledefault -y # 查看服务网格状态 istioctl status # 查看服务拓扑 istioctl dashboard kiali️ 最佳实践选择合适的CNI插件根据集群规模和需求选择合适的CNI插件生产环境推荐使用Calico或Cilium测试环境可以使用Flannel网络策略配置实施默认拒绝策略仅允许必要的Pod间通信限制外部访问定期审计网络策略Service配置根据需求选择合适的Service类型合理设置Service端口考虑使用Headless Service进行服务发现Ingress配置选择合适的Ingress控制器配置TLS加密合理设置路由规则实施访问控制网络性能优化调整MTU大小配置网络QoS使用多网络接口优化Pod分布网络安全启用网络策略使用加密通信限制Pod权限定期安全审计故障排查熟悉网络故障排查工具建立网络监控制定网络故障处理流程定期进行网络演练自动化管理使用Helm管理网络组件实施网络配置自动化建立网络配置版本控制自动化网络策略生成文档和培训建立网络架构文档培训团队网络知识记录网络配置变更分享网络最佳实践持续改进定期评估网络性能优化网络配置学习和应用新的网络技术适应业务需求变化 总结Kubernetes网络管理是集群运行的重要组成部分涉及多个组件和配置。通过本文的实践你应该已经掌握了CNI插件的选择和配置Service类型的使用场景Ingress的部署和配置NetworkPolicy的实施网络故障排查方法网络性能优化策略网络安全最佳实践高级网络配置网络管理工具的使用记住网络配置是一个持续优化的过程需要根据业务需求和集群规模不断调整。在实际生产环境中要结合具体情况选择合适的网络方案确保集群的稳定运行和安全。susu碎碎念网络策略是生产环境的必备配置不要忽视选择CNI插件时要考虑集群规模和性能需求定期检查网络连通性及时发现问题网络安全要从设计阶段开始考虑文档很重要要记录网络架构和配置网络监控不能少及时发现性能瓶颈持续学习网络新技术保持技术先进性觉得有用点个赞再走咱们下期见