2 Star 10 Fork 3

WeBank / Dockin-CNI

加入 Gitee
与超过 1200万 开发者一起发现、参与优秀开源项目,私有仓库也完全免费 :)
免费加入
克隆/下载
贡献代码
同步代码
取消
提示: 由于 Git 不支持空文件夾,创建文件夹后会生成空的 .keep 文件
Loading...
README
Apache-2.0

Dockin CNI - Dockin Container Network Interface

License

English | 中文

Dockin运维管理系统是安全的运维管理服务,优化exec执行性能、支持命令权限管理、支持场景运维编排。

更多Dockin组件请访问 https://github.com/WeBankFinTech/Dockin

Architecture

Dockin cni

dockin cni 与资源管理模块(RM)进行交互,共同来管理容器网络,当前支持:

  • 创建单网卡网络
  • 创建多网卡网络
  • 仅支持dockin ipam插件
  • 仅支持桥接模式

以下为运行dockin cni的需要组件

  • dockin-cni,主要的插件入口,通过调用网桥来进行网络管理,并且与RM模块进行交互
  • dockin-ipam,用于分配ip地址
  • bridge, 网桥用于网络管理

部署说明

1. cni的配置

cni配置文件需要放置到/etc/cni/net.d下(kubelet使用的默认配置路径。如果重定向了配置路径,请将配置文件放置到kubelet使用的路径。

配置文件的命名可以参考00-dockin-cni.json这样的命名方式

配置文件内容示例:

{
    "cniVersion": "0.2.0",
    "name": "dockin-cni",
    "type": "dockin-cni",
    "confDir": "/etc/cni/dockin/net.d",
    "binDir": "/opt/cni/bin",
    "logFile": "/data/kubernetes/dockin-cni.log",
    "logLevel": "debug",
    "backend": "http://localhost:10002/rmController/getPodMultiNetwork"
}

参数描述如下:

  • cniVersion, 支持的cni版本
  • name, 网络插件的名字
  • type, 类型,可执行二进制文件,这里必须使用'dockin-cni'
  • confDir, 网络配置文件所在的目录
  • binDir, 网桥(bridge)二进制文件所在目录
  • logFile, 日志文件路径
  • logLevel, 日志登记
  • backend, webhook的访问地址,这里使用dockin-RM的地址作为示例

2. 配置Network

这里同样需要创建配置network相关的配置文件。

Step1:使用webhook获取network类型

首先,您需要有一个web服务器提供webhook,用于获取pod的网络信息(包括单/双网卡),该web服务需要实现一个带有podNameurl参数的API。比如:

<IP>:<port>/<URL>?podName=

这里的话,可以使用Dockin-RM作为例子。可以使用curl命令来访问rm的以下API:

curl 127.0.0.1:10002/rmController/getPodMultiNetwork?podName=<your_pod_name>

如果没有出现错误的话,您将会得到如下格式的响应:

{
    "code": 0,
    "reqId": "1234",
    "message": "success",
    "data": [
        {
            "type": "test",
            "podIp": "192.168.1.2",
            "subnetMask": "255.255.255.0",
            "gateway": "192.168.1.1",
            "ifName": "eth0",
            "master": true
        },
        {
            "type": "dockin",
            "podIp": "192.168.2.2",
            "subnetMask": "255.255.255.0",
            "gateway": "192.168.1.1",
            "ifName": "net0",
            "master": false
        }
    ]
}

其中:

  • code, 返回码,0表示成功,其余表示失败
  • message, 返回的描述信息,包括成功信息和失败信息
  • data, 关于网络信息的数据内容
    • type, 网络类型
    • podIp, 为pod分配的ip地址
    • subnetMask, 子网掩码
    • gateway, 网管
    • ifName, 该网络所属的网卡名称,将能够通过ifconfig命令及ip a命令查看
    • master, 用于标记是否为主要网络,在使用kubectl展示信息时将会看到该网络信息,并且在一个pod中只能有一个master网卡

这里我们需要关注的是其中type字段. 在这个例子中,一共有两个类型: testdockin

Step2: 创建network配置文件

network 配置通过网桥进行管理,更多细节可参考以下链接:

https://github.com/containernetworking/plugins/tree/master/plugins/main/bridge

网络配置通过json文件进行存储,存放在confDir中(在cni配置中),并且将会传给kubelet创建网络。

{
  "cniVersion": "0.2.0",
  "name": "dockin",
  "type": "bridge",
  "bridge": "br1"
}
  • cniVersion, 该cni支持的版本
  • name, 网络名称,比如与rm中的名称保持一致
  • type, 类型,仅支持通过网桥进行网络管理
  • bridge, 网桥名称,多网卡环境下可以分配不同的网桥名称

上面对配置的内容做了简单介绍,现在来创建network配置文件.

  • 首先,先创建配置文件目录:

目录的路径可以从前面的cni配置文件中的confDir找到

mkdir -p /etc/cni/dockin/net.d
  • 然后,创建配置文件

在上面的例子中,我们需要创建两个network配置文件 1.为类型test创建配置文件

touch /etc/cni/dockin/net.d/test.json

配置文件内容:

{
  "cniVersion": "0.2.0",
  "name": "test", // type
  "type": "bridge",
  "bridge": "br0"
}

2.为类型dockin创建配置文件

touch /etc/cni/dockin/net.d/dockin.json

配置文件内容:

{
  "cniVersion": "0.2.0",
  "name": "dockin", // type
  "type": "bridge",
  "bridge": "br0"
}

3. 将可执行文件放到binDir

你可以使用make命令完成dockin-cnidockin-ipam的编译,然后将两个可执行文件放到cni配置文件中binDir指向的路径。通常情况下,cni的bin目录为/opt/cni/bin


Dockin-ipam: 静态IP地址管理插件

简介

静态IPAM插件用来为容器分配静态IP地址(IPv4/IPv6),使用与需要为容器分配静态IP的场景(即重启或kill之后ip地址保持不变)

static IPAM is very simple IPAM plugin that assigns IPv4 and IPv6 addresses statically to container. This will be useful in debugging purpose and in case of assign same IP address in different vlan/vxlan to containers.

配置示例

{
	"ipam": {
		"type": "static",
		"addresses": [
			{
				"address": "192.168.0.1/24",
				"gateway": "192.168.0.254"
			},
			{
				"address": "3ffe:ffff:0:01ff::1/64",
				"gateway": "3ffe:ffff:0::1"
			}
		],
		"routes": [
			{ "dst": "0.0.0.0/0" },
			{ "dst": "192.168.0.0/16", "gw": "192.168.1.1" },
			{ "dst": "3ffe:ffff:0:01ff::1/64" }
		],
		"dns": {
			"nameservers" : ["8.8.8.8"],
			"domain": "example.com",
			"search": [ "example.com" ]
		}
	}
}

网络配置描述

  • type (string, 必须): "static"
  • addresses (array, 可选): ip地址对象数组:
    • address (string, 必须): 以CIDR表示的ip地址.
    • gateway (string, 可选): 执行子网内的ip作为网管.
  • routes (string, 可选): 需要加载到容器命名空间的路由列表。每条路由信息都是有dst及gw(可选)字段构成的字典,如果设置了gw字段,“gateway”标签对应的值将会被使用.
  • dns (string, 可选): 由"nameservers", "domain" 及 "search"构成的映射表.

支持的参数

支持以下CNI参数 CNI_ARGS:

  • IP: 需要指定一个以CIDR表示法表示的ip地址,用逗号进行分割

  • GATEWAY: 需要指定一个网关地址

    (示例: CNI_ARGS="IP=192.168.1.1/24;GATEWAY=192.168.1.254")

同时插件支持能力参数 capability argument.

  • ips: 为CNI接口传入多个ip地址

支持以下既定参数 args conventions :

  • ips (字符串数组): 用于尝试分配ip的自定义ip列表 (e.g. '192.168.1.1/24')

注意: 如果以上某些参数同时使用,将会通过以下的优先级选择其中一个进行生效

  1. 能力参数capability argument
  2. 既定参数args conventions
  3. CNI参数CNI_ARGS
Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives. Copyright [yyyy] [name of copyright owner] Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

简介

dockin cni 与资源管理模块(RM)进行交互,共同来管理容器网络 展开 收起
Go 等 2 种语言
Apache-2.0
取消

发行版

暂无发行版

贡献者

全部

近期动态

加载更多
不能加载更多了
Go
1
https://gitee.com/WeBank/Dockin-CNI.git
git@gitee.com:WeBank/Dockin-CNI.git
WeBank
Dockin-CNI
Dockin-CNI
develop

搜索帮助