kubernetes service之node port
环境信息CLIENT HOSTA HOSTB
192.168.55.230 eth0: 192.168.16.73 eth0: 192.168.16.139
flannel.1: 10.100.40.0/32 flannel.1: 10.100.81.0/32
PODIP: 10.100.81.180
K8S资源信息
# kubectl get services httpserver -o wide
NAME CLUSTER-IP EXTERNAL-IP PORT(S) AGE SELECTOR
httpserver 10.254.112.35 <nodes> 3000:30000/TCP,8080:30080/TCP 304d caicloud-app=httpserver
# kubectl get endpoints httpserver -o wide
NAME ENDPOINTS AGE
httpserver 10.100.81.180:8080,10.100.81.180:3000 304d
# kubectl get pod httpserver-v2.0.0-rc.3-patch1-zvcbp -o wide
NAME READY STATUS RESTARTS AGE IP NODE
httpserver-v2.0.0-rc.3-patch1-zvcbp 1/1 Running 32 2d 10.100.81.180 kube-node-24
请求报文 192.168.55.230:randomport -> 192.168.16.73:30000
[*]HOSTA节点（转发节点）
# iptables -vnL PREROUTING -t nat
Chain PREROUTING (policy ACCEPT 71 packets, 5113 bytes) pkts bytes target prot opt in out source destination
795709 cali-PREROUTINGall--* * 0.0.0.0/0 0.0.0.0/0 /* cali:6gwbT8clXdHdC1b1 */
795709 KUBE-SERVICESall--* * 0.0.0.0/0 0.0.0.0/0 /* kubernetes service portals */
444053 DOCKER all--* * 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match dst-type LOCAL
KUBE-SERVICES链中优匹配目的ip为vip的报文，最后默认匹配KUBE-NODEPORTS
Chain KUBE-SERVICES (2 references) pkts bytes target prot opt in out source destination
0 0 KUBE-SVC-7LP2XUEI73XCWKBCtcp--* * 0.0.0.0/0 10.254.87.134 /* default/hbase-master:h
ttp cluster IP */ tcp dpt:16010
0 0 KUBE-SVC-DJQF6FU6GLEBPD2Ptcp--* * 0.0.0.0/0 10.254.233.102 /* default/cauth-redis-sl
ave: cluster IP */ tcp dpt:6379
……
375 30172 KUBE-NODEPORTSall--* * 0.0.0.0/0 0.0.0.0/0 /* kubernetes service nodeports; NOTE: this must be the last rule in this chain */ ADDRTYPE match dst-type LOCAL
在KUBE-NODEPORTS链中使用目的端口匹配规则后，首先给报文打MASQMARK，之后匹配NODEPORT SERVICE规则
# iptables -vnL KUBE-NODEPORTS -t nat |grep 30000
7 448 KUBE-MARK-MASQtcp--* * 0.0.0.0/0 0.0.0.0/0 /* default/httpserver:http */ tcp dpt:30000 7 448 KUBE-SVC-J5IAPMHBS2NR43EJtcp--* * 0.0.0.0/0 0.0.0.0/0 /* default/httpserver:http */ tcp dpt:30000
根据ENDPOINT个数，iptables会做平均分发，此例只有一个ENDPOINT，所以全部匹配该ENDPOINT规则
Chain KUBE-SVC-J5IAPMHBS2NR43EJ (2 references) pkts bytes target prot opt in out source destination
7 448 KUBE-SEP-XZ7F6CLIJGJWI66Pall--* * 0.0.0.0/0 0.0.0.0/0 /* default/httpserver:http */
ENDPONT规则做DNAT，将目的ip和port转换为对应容器pod和port
# iptables -vnL KUBE-SEP-XZ7F6CLIJGJWI66P -t nat
Chain KUBE-SEP-XZ7F6CLIJGJWI66P (1 references) pkts bytes target prot opt in out source destination
0 0 KUBE-MARK-MASQall--* * 10.100.81.180 0.0.0.0/0 /* default/httpserver:http */
7 448 DNAT tcp--* * 0.0.0.0/0 0.0.0.0/0 /* default/httpserver:http */ tcp to:10.100.81.180:3000
路由查询出接口
# ip route |grep 10.100.81
10.100.81.0/24 via 10.100.81.0 dev flannel.1 onlink
# ip -d link show flannel.1
12: flannel.1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UNKNOWN mode DEFAULT link/ether 1a:cc:4c:8b:d4:6c brd ff:ff:ff:ff:ff:ff promiscuity 0
vxlan>
从一节点DNAT到另一节点，肯定要返回节点做SNAT，所以对于DNAT的报文打上0x4000 PKT mark
# iptables -vnL KUBE-NODEPORTS -t nat |grep 30000
7 448 KUBE-MARK-MASQtcp--* * 0.0.0.0/0 0.0.0.0/0 /* default/httpserver:http */ tcp dpt:30000 7 448 KUBE-SVC-J5IAPMHBS2NR43EJtcp--* * 0.0.0.0/0 0.0.0.0/0 /* default/httpserver:http */ tcp dpt:30000
根据路由查询结果，出接口为flannel.1，所以MASQUERADE通过inet_select_addr从flannel.1上先把IP作SNAT，此时报文请求变为10.100.40.0:randomport->10.100.81.180:3000
# iptables -vnL KUBE-POSTROUTING -t nat
Chain KUBE-POSTROUTING (1 references) pkts bytes target prot opt in out source destination
7 798 MASQUERADEall--* * 0.0.0.0/0 0.0.0.0/0 /* kubernetes service traffic requiring SNAT */ mark match 0x4000/0x4000
从vxlan端口(flannel.1)发送报文，驱动调用vxlan_xmit，通过目的mac查询vxlan_fdb先把remote ip（外层目的ip），即192.168.16.139，从vxlan_dev中获取源local ip 192.168.16.73（&vxlan->cfg.saddr），然后调iptunnel_xmit->ip_local_out从对应网口将报文送出去
# ip nei |grep 10.100.81.0
10.100.81.0 dev flannel.1 lladdr aa:a1:54:36:e0:a9 PERMANENT
# bridge fdb |grep aa:a1:54:36:e0:a9
aa:a1:54:36:e0:a9 dev flannel.1 dst 192.168.16.139 self permanent
[*]HOSTB（接收端）
Vxlan udp报文处理报经过vxlan_rcv (ens3) -> netif_rx(vxlandev skb)
其中vxlan_rcv中会使用vxlan_vs_find_vni(vs, vxlan_vni(vxlan_hdr(skb)->vx_vni))通过vxlan报文vni来查找对应的vxlan_dev，所以vxlan网口vni要一致。
https://images2017.cnblogs.com/blog/357933/201711/357933-20171123004400493-14323096.png
# ip -d link show flannel.1
8: flannel.1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UNKNOWN mode DEFAULT link/ether aa:a1:54:36:e0:a9 brd ff:ff:ff:ff:ff:ff promiscuity 0
vxlan>
报文从flannel.1转发查询路由转到veth接口calid9cdc8e8d37
# ip route |grep 10.100.81.180
10.100.81.180 dev calid9cdc8e8d37scope link
veth接口调用驱动函数发送报文时，调用veth_xmit->dev_forward_skb(peer, skb)->enqueue_to_backlog
dev_forward_skb会在本地将报文转发至另一个网口，即veth peer
调用软中断从接收队列获取数据包
https://images2017.cnblogs.com/blog/357933/201711/357933-20171123004413461-2056710189.png
[*]返程报文
POD内返程报文为10.100.81.180:3000->10.100.40.0:randomport，路由查询出接口
root@httpserver-v2:/app# ip route
default via 169.254.1.1 dev eth0
169.254.1.1 dev eth0scope link
此处calico配置了169.254.1.1作为下一跳，并将主机上的veth peer打开arp proxy的功能，所以下面查看到169.254.1.1的mac为veth peer的mac
root@httpserver-v2:/app# ip nei
192.168.16.139 dev eth0 lladdr 8a:85:67:77:67:83 STALE
169.254.1.1 dev eth0 lladdr 8a:85:67:77:67:83 REACHABLE
# ip addr show calid9cdc8e8d37
137: calid9cdc8e8d37@if3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP link/ether 8a:85:67:77:67:83 brd ff:ff:ff:ff:ff:ff link-netnsid 4
inet6 fe80::8885:67ff:fe77:6783/64 scope link
valid_lft forever preferred_lft forever
# sysctl -a |grep calid9cdc8e8d37 |grep proxy_arp
net.ipv4.conf.calid9cdc8e8d37.proxy_arp = 1
calid9cdc8e8d37 对arp请求169.254.1.1做了代理（如果网口开启了proxy_arp，且此ip查询路由后的出接口不是此网口则会对此ip做proxy; openstack中dvr模式中fip命名空间fg口就是如此设置）
查询路由从flannel.1送出去
# ip route |grep 10.100.40.0
10.100.40.0/24 via 10.100.40.0 dev flannel.1 onlink
后面流程为从vxlan dev发送报文作vxlan封装至HOSTA，流程与上面HOSTA至HOSTB一致，所以不再重复描述。
到达HOSTB后，根据内核连接跟踪功能POSTROUTING做SNAT，PREROUTING会做DNAT，源ip和目的ip 分别转换为192.168.16.73:和192.168.55.230
引用
veth在内核的实现 http://ju.outofmemory.cn/entry/187069
数据包接收系列 — 上半部实现（内核接口）http://blog.csdn.net/zhangskd/article/details/22211295
网络子系统18_arp对代理的处理 http://blog.csdn.net/nerdx/article/details/12192961
calic FAQ https://docs.projectcalico.org/v2.0/usage/troubleshooting/faq#why-cant-i-see-the-16925411-address-mentioned-above-on-my-host
linux内核网络源代码调用关系 http://www.cnblogs.com/haoqingchuan/p/7882236.html
页:
[1]