067、如何部署Calico网络 (2019-04-10 周三)

时间:2022-07-13 07:55:39
 
Calico 是一个纯三层的虚拟网络方案,Calico为每个容器分配一个IP,每个host都是router,把不同host的容器连接起来。与vxlan不同的是,Calico不对数据包做额外封装,不需要NAT和端口映射,扩展性和性能都很好。
 
与其他容器网络方案相比,Calico还有一大优势:network policy。用户可以动态定义CAL规则,控制进出容器的数据包,实现业务需求。
 
实验环境描述
 
Calico依赖etcd在不同主机间共享和交换信息,存储Calico网络状态。我们将在10.12.31.213 上运行etcd。
 
Calico网络中的每个主机都需要运行Calico组件,提供容器interface管理、动态路由、动态CAL、报告状态等功能
 
    host1    10.12.31.211 
    host2    10.12.31.212
    etcd      10.12.31.213
 
 
#    1、启动etcd数据库
 
[root@etcd ~]# etcd -listen-client-urls http://10.12.31.213:2379 -advertise-client-urls http://10.12.31.213:2379 &
 
#    2、修改 host1 和 host2 Docker daemon 配置文件
 
root@host1:~# cat /etc/systemd/system/docker.service.d/10-machine.conf
[Service]
ExecStart=
ExecStart=/usr/bin/dockerd -H tcp://0.0.0.0:2376 -H unix:///var/run/docker.sock --storage-driver overlay2 --tlsverify --tlscacert /etc/docker/ca.pem --tlscert /etc/docker/server.pem --tlskey /etc/docker/server-key.pem --label provider=generic --cluster-store=etcd://10.12.31.213:2379
Environment=
root@host1:~# systemctl daemon-reload
root@host1:~# systemctl restart docker.service
 
root@host2:~# cat /etc/systemd/system/docker.service.d/10-machine.conf
[Service]
ExecStart=
ExecStart=/usr/bin/dockerd -H tcp://0.0.0.0:2376 -H unix:///var/run/docker.sock --storage-driver overlay2 --tlsverify --tlscacert /etc/docker/ca.pem --tlscert /etc/docker/server.pem --tlskey /etc/docker/server-key.pem --label provider=generic  --cluster-store=etcd://10.12.31.213:2379
Environment=
root@host2:~# systemctl daemon-reload
root@host2:~# systemctl restart docker.service
 
#    3、在 host1 和 host2 上安装 Calico
 
root@host1:~# wget -O /usr/local/bin/calicoctl https://github.com/projectcalico/calicoctl/releases/download/v1.0.2/calicoctl
root@host1:~# chmod +x /usr/local/bin/calicoctl
 
root@host2:~# wget -O /usr/local/bin/calicoctl https://github.com/projectcalico/calicoctl/releases/download/v1.0.2/calicoctl
root@host2:~# chmod +x /usr/local/bin/calicoctl
 
#    4、在 host1 和 host2 上启动 Calico
 
root@host1:~# cat /etc/calicoctl.cfg
apiVersion: v1
kind: calicoApiConfig
metadata:
spec:
  datastoreType: "etcdv2"
  etcdEndpoints: http://10.12.31.213:2379
 
root@host1:~# calicoctl node run --config=/etc/calicoctl.cfg
Running command to load modules: modprobe -a xt_set ip6_tables
Enabling IPv4 forwarding    #    开始host上的路由转发功能
Enabling IPv6 forwarding
Increasing conntrack limit
Removing old calico-node container (if running).
Running the following command to start calico-node:
    
    #   下载并启动calico-node容器,calico会以容器的形式运行(与weave类似) 
docker run --net=host --privileged --name=calico-node -d --restart=always -e NO_DEFAULT_POOLS= -e CALICO_LIBNETWORK_ENABLED=true -e CALICO_LIBNETWORK_IFPREFIX=cali -e ETCD_ENDPOINTS=http://10.12.31.213:2379 -e ETCD_AUTHORITY= -e ETCD_SCHEME= -e NODENAME=host1 -e CALICO_NETWORKING_BACKEND=bird -v /var/run/docker.sock:/var/run/docker.sock -v /var/run/calico:/var/run/calico -v /lib/modules:/lib/modules -v /var/log/calico:/var/log/calico -v /run/docker/plugins:/run/docker/plugins calico/node:v1.0.2
 
Image may take a short time to download if it is not available locally.
Container started, checking progress logs.
Waiting for etcd connection...    #    连接etcd数据库
Using auto-detected IPv4 address: 10.12.31.211
No IPv6 address configured
Using global AS number
Calico node name:  host1
CALICO_LIBNETWORK_ENABLED is true - start libnetwork service
Calico node started successfully    #    calico启动成功
 
root@host2:~# cat /etc/calicoctl.cfg
apiVersion: v1
kind: calicoApiConfig
metadata:
spec:
  datastoreType: "etcdv2"
  etcdEndpoints: http://10.12.31.213:2379
root@host2:~# calicoctl node run --config=/etc/calicoctl.cfg
Running command to load modules: modprobe -a xt_set ip6_tables
Enabling IPv4 forwarding
Enabling IPv6 forwarding
Increasing conntrack limit
Removing old calico-node container (if running).
Running the following command to start calico-node:
 
docker run --net=host --privileged --name=calico-node -d --restart=always -e NODENAME=host2 -e CALICO_NETWORKING_BACKEND=bird -e NO_DEFAULT_POOLS= -e CALICO_LIBNETWORK_ENABLED=true -e CALICO_LIBNETWORK_IFPREFIX=cali -e ETCD_ENDPOINTS=http://10.12.31.213:2379 -e ETCD_AUTHORITY= -e ETCD_SCHEME= -v /var/run/calico:/var/run/calico -v /lib/modules:/lib/modules -v /var/log/calico:/var/log/calico -v /run/docker/plugins:/run/docker/plugins -v /var/run/docker.sock:/var/run/docker.sock calico/node:v1.0.2
 
Image may take a short time to download if it is not available locally.
Container started, checking progress logs.
Waiting for etcd connection...
Using auto-detected IPv4 address: 10.12.31.212
No IPv6 address configured
Using global AS number
Calico node name:  host2
CALICO_LIBNETWORK_ENABLED is true - start libnetwork service
Calico node started successfully
 
#    5、创建calico网络
 
--driver calico    #    指定使用calico的libnetwork CNM driver
--ipam-driver calico-ipam    #    指定使用calico的IPAM driver管理IP
calico网络为global网络,会自动同步到所有主机
 
root@host1:~# docker network create --driver calico --ipam-driver calico-ipam cal_net1
22fd17cb2e0db50e8ad40b3f1687e40baf26b6f1a16d0486ba6afa4e4cd37291
root@host1:~# docker network ls
NETWORK ID          NAME                DRIVER              SCOPE
29c9c519a9cf        bridge              bridge              local
22fd17cb2e0d        cal_net1            calico              global
bb03f7574aa2        host                host                local
d60df792c936        mac_net1            macvlan             local
884e50ddfb92        mac_net10           macvlan             local
c402380a197d        mac_net20           macvlan             local
11e39328a6d1        none                null                local
root@host1:~# docker ps -a
CONTAINER ID        IMAGE                COMMAND             CREATED             STATUS              PORTS               NAMES
f80b34d63a07        calico/node:v1.0.2   "start_runit"       12 minutes ago      Up 12 minutes                           calico-node
 
root@host2:~# docker network ls
NETWORK ID          NAME                DRIVER              SCOPE
14ff2235fb9c        bridge              bridge              local
22fd17cb2e0d        cal_net1            calico              global
cf4c89650a1f        host                host                local
39f1aab9f5b8        mac_net1            macvlan             local
a90d23d941a9        mac_net10           macvlan             local
d73128405403        mac_net20           macvlan             local
2f7d79e0114d        none                null                local
root@host2:~# docker ps -a
CONTAINER ID        IMAGE                COMMAND             CREATED             STATUS              PORTS               NAMES
428c6c975c73        calico/node:v1.0.2   "start_runit"       6 minutes ago       Up 6 minutes                            calico-node