067、如何部署Calico网络（2019-04-10 周三）

佚名 6年前 (2019-04-11) 随笔 848人围观抢沙发百度已收录

参考 https://www.cnblogs.com/CloudMan6/p/7509975.html Calico 是一个纯三层的虚拟网络方案，Calico为每个容器分配一个IP，每个host都是router，把不同host的容器连接起来。与vxlan不同的是，Calico不对数据包做额外封装，不需要NAT和端口映射，扩展性和性能都很好。与其他容器网络方案相比，Calico还有一大优势：network policy。用户可以动态定义CAL规则，控制进出容器的数据包，实现业务需求。实验环境描述 Calico依赖etcd在不同主机间共享和交换信息，存储Calico网络状态。我们将在10.12.31.213 上运行etcd。 Calico网络中的每个主机都需要运行Calico组件，提供容器interface管理、动态路由、动态CAL、报告状态等功能 host1 10.12.31.211 host2 10.12.31.212 etcd 10.12.31.213 # 1、启动etcd数据库 [root@etcd ~]# etcd -listen-client-urls http://10.12.31.213:2379 -advertise-client-urls http://10.12.31.213:2379 & # 2、修改 host1 和 host2 Docker daemon 配置文件 root@host1:~# cat /etc/systemd/system/docker.service.d/10-machine.conf [Service] ExecStart= ExecStart=/usr/bin/dockerd -H tcp://0.0.0.0:2376 -H unix:///var/run/docker.sock --storage-driver overlay2 --tlsverify --tlscacert /etc/docker/ca.pem --tlscert /etc/docker/server.pem --tlskey /etc/docker/server-key.pem --label provider=generic --cluster-store=etcd://10.12.31.213:2379 Environment= root@host1:~# systemctl daemon-reload root@host1:~# systemctl restart docker.service root@host2:~# cat /etc/systemd/system/docker.service.d/10-machine.conf [Service] ExecStart= ExecStart=/usr/bin/dockerd -H tcp://0.0.0.0:2376 -H unix:///var/run/docker.sock --storage-driver overlay2 --tlsverify --tlscacert /etc/docker/ca.pem --tlscert /etc/docker/server.pem --tlskey /etc/docker/server-key.pem --label provider=generic --cluster-store=etcd://10.12.31.213:2379 Environment= root@host2:~# systemctl daemon-reload root@host2:~# systemctl restart docker.service # 3、在 host1 和 host2 上安装 Calico root@host1:~# wget -O /usr/local/bin/calicoctl https://github.com/projectcalico/calicoctl/releases/download/v1.0.2/calicoctl root@host1:~# chmod +x /usr/local/bin/calicoctl root@host2:~# wget -O /usr/local/bin/calicoctl https://github.com/projectcalico/calicoctl/releases/download/v1.0.2/calicoctl root@host2:~# chmod +x /usr/local/bin/calicoctl # 4、在 host1 和 host2 上启动 Calico root@host1:~# cat /etc/calicoctl.cfg apiVersion: v1 kind: calicoApiConfig metadata: spec: datastoreType: "etcdv2" etcdEndpoints: http://10.12.31.213:2379 root@host1:~# calicoctl node run --config=/etc/calicoctl.cfg Running command to load modules: modprobe -a xt_set ip6_tables Enabling IPv4 forwarding # 开始host上的路由转发功能 Enabling IPv6 forwarding Increasing conntrack limit Removing old calico-node container (if running). Running the following command to start calico-node: # 下载并启动calico-node容器，calico会以容器的形式运行（与weave类似）
docker run --net=host --privileged --name=calico-node -d --restart=always -e NO_DEFAULT_POOLS= -e CALICO_LIBNETWORK_ENABLED=true -e CALICO_LIBNETWORK_IFPREFIX=cali -e ETCD_ENDPOINTS=http://10.12.31.213:2379 -e ETCD_AUTHORITY= -e ETCD_SCHEME= -e NODENAME=host1 -e CALICO_NETWORKING_BACKEND=bird -v /var/run/docker.sock:/var/run/docker.sock -v /var/run/calico:/var/run/calico -v /lib/modules:/lib/modules -v /var/log/calico:/var/log/calico -v /run/docker/plugins:/run/docker/plugins calico/node:v1.0.2 Image may take a short time to download if it is not available locally. Container started, checking progress logs. Waiting for etcd connection... # 连接etcd数据库 Using auto-detected IPv4 address: 10.12.31.211 No IPv6 address configured Using global AS number Calico node name: host1 CALICO_LIBNETWORK_ENABLED is true - start libnetwork service Calico node started successfully # calico启动成功 root@host2:~# cat /etc/calicoctl.cfg apiVersion: v1 kind: calicoApiConfig metadata: spec: datastoreType: "etcdv2" etcdEndpoints: http://10.12.31.213:2379 root@host2:~# calicoctl node run --config=/etc/calicoctl.cfg Running command to load modules: modprobe -a xt_set ip6_tables Enabling IPv4 forwarding Enabling IPv6 forwarding Increasing conntrack limit Removing old calico-node container (if running). Running the following command to start calico-node: docker run --net=host --privileged --name=calico-node -d --restart=always -e NODENAME=host2 -e CALICO_NETWORKING_BACKEND=bird -e NO_DEFAULT_POOLS= -e CALICO_LIBNETWORK_ENABLED=true -e CALICO_LIBNETWORK_IFPREFIX=cali -e ETCD_ENDPOINTS=http://10.12.31.213:2379 -e ETCD_AUTHORITY= -e ETCD_SCHEME= -v /var/run/calico:/var/run/calico -v /lib/modules:/lib/modules -v /var/log/calico:/var/log/calico -v /run/docker/plugins:/run/docker/plugins -v /var/run/docker.sock:/var/run/docker.sock calico/node:v1.0.2 Image may take a short time to download if it is not available locally. Container started, checking progress logs. Waiting for etcd connection... Using auto-detected IPv4 address: 10.12.31.212 No IPv6 address configured Using global AS number Calico node name: host2 CALICO_LIBNETWORK_ENABLED is true - start libnetwork service Calico node started successfully # 5、创建calico网络 --driver calico # 指定使用calico的libnetwork CNM driver --ipam-driver calico-ipam # 指定使用calico的IPAM driver管理IP calico网络为global网络，会自动同步到所有主机 root@host1:~# docker network create --driver calico --ipam-driver calico-ipam cal_net1 22fd17cb2e0db50e8ad40b3f1687e40baf26b6f1a16d0486ba6afa4e4cd37291 root@host1:~# docker network ls NETWORK ID NAME DRIVER SCOPE 29c9c519a9cf bridge bridge local 22fd17cb2e0d cal_net1 calico global bb03f7574aa2 host host local d60df792c936 mac_net1 macvlan local 884e50ddfb92 mac_net10 macvlan local c402380a197d mac_net20 macvlan local 11e39328a6d1 none null local root@host1:~# docker ps -a CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES f80b34d63a07 calico/node:v1.0.2 "start_runit" 12 minutes ago Up 12 minutes calico-node root@host2:~# docker network ls NETWORK ID NAME DRIVER SCOPE 14ff2235fb9c bridge bridge local 22fd17cb2e0d cal_net1 calico global cf4c89650a1f host host local 39f1aab9f5b8 mac_net1 macvlan local a90d23d941a9 mac_net10 macvlan local d73128405403 mac_net20 macvlan local 2f7d79e0114d none null local root@host2:~# docker ps -a CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 428c6c975c73 calico/node:v1.0.2 "start_runit" 6 minutes ago Up 6 minutes calico-node