Kubernetes 与网络系统集成最佳实践一、前言哥们别整那些花里胡哨的。网络系统是 Kubernetes 集群的重要组成部分今天直接上硬货教你如何在 Kubernetes 中集成各种网络系统。二、网络系统类型类型适用场景优势劣势CNI 插件集群网络标准化配置复杂服务网格服务通信流量管理资源消耗大负载均衡外部访问高可用成本高网络策略网络安全细粒度控制学习成本高三、实战配置1. CNI 插件配置apiVersion: v1 kind: ConfigMap metadata: name: calico-config namespace: kube-system data: cni_network_config: |- { name: k8s-pod-network, cniVersion: 0.3.1, plugins: [ { type: calico, log_level: info, datastore_type: kubernetes, nodename: {{NODE_NAME}}, ipam: { type: calico-ipam }, policy: { type: k8s }, kubernetes: { kubeconfig: /etc/cni/net.d/calico-kubeconfig } }, { type: portmap, capabilities: { portMappings: true } } ] }2. 服务网格配置apiVersion: install.istio.io/v1alpha1 kind: IstioOperator metadata: name: istio-controlplane namespace: istio-system spec: profile: default components: pilot: k8s: resources: requests: cpu: 100m memory: 128Mi limits: cpu: 500m memory: 512Mi ingressGateways: - name: istio-ingressgateway k8s: resources: requests: cpu: 100m memory: 128Mi limits: cpu: 500m memory: 512Mi values: global: proxy: resources: requests: cpu: 10m memory: 40Mi limits: cpu: 100m memory: 128Mi3. 负载均衡配置apiVersion: v1 kind: Service metadata: name: app-service namespace: default annotations: service.beta.kubernetes.io/aws-load-balancer-type: nlb service.beta.kubernetes.io/aws-load-balancer-internal: true spec: selector: app: app ports: - port: 80 targetPort: 8080 type: LoadBalancer --- apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: app-ingress namespace: default annotations: kubernetes.io/ingress.class: nginx cert-manager.io/cluster-issuer: letsencrypt-prod spec: tls: - hosts: - app.example.com secretName: app-tls rules: - host: app.example.com http: paths: - path: / pathType: Prefix backend: service: name: app-service port: number: 804. 网络策略配置apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: default-deny namespace: default spec: podSelector: {} policyTypes: - Ingress - Egress --- apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: app-network-policy namespace: default spec: podSelector: matchLabels: app: app policyTypes: - Ingress - Egress ingress: - from: - podSelector: matchLabels: app: frontend ports: - protocol: TCP port: 80 egress: - to: - podSelector: matchLabels: app: backend ports: - protocol: TCP port: 9000四、网络系统优化1. 性能优化apiVersion: apps/v1 kind: DaemonSet metadata: name: calico-node namespace: kube-system spec: template: spec: containers: - name: calico-node env: - name: CALICO_LIBNETWORK_ENABLED value: true - name: FELIX_DEFAULTENDPOINTTOHOSTACTION value: ACCEPT - name: FELIX_IPINIPMTU value: 1440 - name: FELIX_TUNNELMTU value: 1440 - name: FELIX_HEALTHENABLED value: true2. 高可用配置apiVersion: v1 kind: Service metadata: name: app-service namespace: default spec: selector: app: app ports: - port: 80 targetPort: 8080 type: ClusterIP sessionAffinity: ClientIP sessionAffinityConfig: clientIP: timeoutSeconds: 10800 --- apiVersion: apps/v1 kind: Deployment metadata: name: app namespace: default spec: replicas: 3 strategy: type: RollingUpdate rollingUpdate: maxSurge: 1 maxUnavailable: 0 selector: matchLabels: app: app template: metadata: labels: app: app spec: affinity: podAntiAffinity: requiredDuringSchedulingIgnoredDuringExecution: - labelSelector: matchExpressions: - key: app operator: In values: - app topologyKey: kubernetes.io/hostname containers: - name: app image: nginx:latest resources: requests: cpu: 200m memory: 256Mi limits: cpu: 500m memory: 512Mi ports: - containerPort: 80803. 监控与告警apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: name: calico-metrics namespace: monitoring spec: selector: matchLabels: k8s-app: calico-node endpoints: - port: metrics interval: 15s --- apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: name: network-alerts namespace: monitoring spec: groups: - name: network rules: - alert: NetworkPolicyViolation expr: calico_policy_violations_total 0 for: 5m labels: severity: warning annotations: summary: Network policy violation description: Network policy violation detected - alert: PodNetworkUnavailable expr: kube_pod_status_phase{phasePending} 1 for: 10m labels: severity: critical annotations: summary: Pod network unavailable description: Pod {{ $labels.pod }} network is unavailable五、常见问题1. 网络互通问题解决方案检查 CNI 插件配置验证网络策略检查防火墙规则2. 网络性能问题解决方案优化 CNI 插件配置选择高性能 CNI 插件减少网络传输开销3. 负载均衡问题解决方案配置合适的负载均衡策略检查后端 Pod 健康状态优化负载均衡器配置六、最佳实践总结网络选择根据集群规模和需求选择合适的 CNI 插件服务网格使用服务网格实现精细化流量控制负载均衡配置高可用的负载均衡方案网络策略实施零信任网络配置细粒度的网络策略性能优化优化网络配置提高网络性能监控告警配置网络监控和告警七、总结Kubernetes 与网络系统集成是集群稳定运行的重要保障。按照本文的最佳实践你可以构建一个高效、可靠的网络系统炸了
Kubernetes 与网络系统集成最佳实践
Kubernetes 与网络系统集成最佳实践一、前言哥们别整那些花里胡哨的。网络系统是 Kubernetes 集群的重要组成部分今天直接上硬货教你如何在 Kubernetes 中集成各种网络系统。二、网络系统类型类型适用场景优势劣势CNI 插件集群网络标准化配置复杂服务网格服务通信流量管理资源消耗大负载均衡外部访问高可用成本高网络策略网络安全细粒度控制学习成本高三、实战配置1. CNI 插件配置apiVersion: v1 kind: ConfigMap metadata: name: calico-config namespace: kube-system data: cni_network_config: |- { name: k8s-pod-network, cniVersion: 0.3.1, plugins: [ { type: calico, log_level: info, datastore_type: kubernetes, nodename: {{NODE_NAME}}, ipam: { type: calico-ipam }, policy: { type: k8s }, kubernetes: { kubeconfig: /etc/cni/net.d/calico-kubeconfig } }, { type: portmap, capabilities: { portMappings: true } } ] }2. 服务网格配置apiVersion: install.istio.io/v1alpha1 kind: IstioOperator metadata: name: istio-controlplane namespace: istio-system spec: profile: default components: pilot: k8s: resources: requests: cpu: 100m memory: 128Mi limits: cpu: 500m memory: 512Mi ingressGateways: - name: istio-ingressgateway k8s: resources: requests: cpu: 100m memory: 128Mi limits: cpu: 500m memory: 512Mi values: global: proxy: resources: requests: cpu: 10m memory: 40Mi limits: cpu: 100m memory: 128Mi3. 负载均衡配置apiVersion: v1 kind: Service metadata: name: app-service namespace: default annotations: service.beta.kubernetes.io/aws-load-balancer-type: nlb service.beta.kubernetes.io/aws-load-balancer-internal: true spec: selector: app: app ports: - port: 80 targetPort: 8080 type: LoadBalancer --- apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: app-ingress namespace: default annotations: kubernetes.io/ingress.class: nginx cert-manager.io/cluster-issuer: letsencrypt-prod spec: tls: - hosts: - app.example.com secretName: app-tls rules: - host: app.example.com http: paths: - path: / pathType: Prefix backend: service: name: app-service port: number: 804. 网络策略配置apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: default-deny namespace: default spec: podSelector: {} policyTypes: - Ingress - Egress --- apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: app-network-policy namespace: default spec: podSelector: matchLabels: app: app policyTypes: - Ingress - Egress ingress: - from: - podSelector: matchLabels: app: frontend ports: - protocol: TCP port: 80 egress: - to: - podSelector: matchLabels: app: backend ports: - protocol: TCP port: 9000四、网络系统优化1. 性能优化apiVersion: apps/v1 kind: DaemonSet metadata: name: calico-node namespace: kube-system spec: template: spec: containers: - name: calico-node env: - name: CALICO_LIBNETWORK_ENABLED value: true - name: FELIX_DEFAULTENDPOINTTOHOSTACTION value: ACCEPT - name: FELIX_IPINIPMTU value: 1440 - name: FELIX_TUNNELMTU value: 1440 - name: FELIX_HEALTHENABLED value: true2. 高可用配置apiVersion: v1 kind: Service metadata: name: app-service namespace: default spec: selector: app: app ports: - port: 80 targetPort: 8080 type: ClusterIP sessionAffinity: ClientIP sessionAffinityConfig: clientIP: timeoutSeconds: 10800 --- apiVersion: apps/v1 kind: Deployment metadata: name: app namespace: default spec: replicas: 3 strategy: type: RollingUpdate rollingUpdate: maxSurge: 1 maxUnavailable: 0 selector: matchLabels: app: app template: metadata: labels: app: app spec: affinity: podAntiAffinity: requiredDuringSchedulingIgnoredDuringExecution: - labelSelector: matchExpressions: - key: app operator: In values: - app topologyKey: kubernetes.io/hostname containers: - name: app image: nginx:latest resources: requests: cpu: 200m memory: 256Mi limits: cpu: 500m memory: 512Mi ports: - containerPort: 80803. 监控与告警apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: name: calico-metrics namespace: monitoring spec: selector: matchLabels: k8s-app: calico-node endpoints: - port: metrics interval: 15s --- apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: name: network-alerts namespace: monitoring spec: groups: - name: network rules: - alert: NetworkPolicyViolation expr: calico_policy_violations_total 0 for: 5m labels: severity: warning annotations: summary: Network policy violation description: Network policy violation detected - alert: PodNetworkUnavailable expr: kube_pod_status_phase{phasePending} 1 for: 10m labels: severity: critical annotations: summary: Pod network unavailable description: Pod {{ $labels.pod }} network is unavailable五、常见问题1. 网络互通问题解决方案检查 CNI 插件配置验证网络策略检查防火墙规则2. 网络性能问题解决方案优化 CNI 插件配置选择高性能 CNI 插件减少网络传输开销3. 负载均衡问题解决方案配置合适的负载均衡策略检查后端 Pod 健康状态优化负载均衡器配置六、最佳实践总结网络选择根据集群规模和需求选择合适的 CNI 插件服务网格使用服务网格实现精细化流量控制负载均衡配置高可用的负载均衡方案网络策略实施零信任网络配置细粒度的网络策略性能优化优化网络配置提高网络性能监控告警配置网络监控和告警七、总结Kubernetes 与网络系统集成是集群稳定运行的重要保障。按照本文的最佳实践你可以构建一个高效、可靠的网络系统炸了
