Docker Swarm a kan VPN: ayyuka suna gudana, kiran sabis ya kasa

Manajoji uku da ma'aikata biyar a cikin rukunin yanar gizo biyu, an haɗa su da rami, kuma docker service ls yana nuna ayyuka suna gudana a ɓangarorin biyu yayin da kiran da ke tsakanin sabis yana ƙarewa. Babu wani abu a cikin rajistan Swarm da ya yi kama da kuskure. Wannan haɗin shine alamar matsala a matakin bayanai: matakin sarrafawa ya sami kumburin, kuma firam ɗin da aka lulluɓe ba su taɓa yin tafiyar ba.

Dole mesh ya kasance kafin overlay ya kasance

overlay na Swarm yana tura firam ɗin da aka lulluɓe kai tsaye tsakanin adiresoshin kumburi, wanda ke nufin kowane kumburi yana buƙatar adireshin da kowane kumburi zai iya isa ba tare da fassara ba, a kan hanyar da ramin ke bayarwa. Rami da ke ɗaukar abokan ciniki kawai zuwa tashar da aka buga bai isa ba. Dole ƙasan ya yi hanya daga kumburi zuwa kumburi a duka kwatance biyu.

Gwada wannan kafin ka taɓa Swarm. Daga kowane kumburi, duba hanyar zuwa adireshin ramin abokin tarayya, yi masa ping, sannan ka gwada tashar sarrafawa. Idan ping yana aiki amma tashar ba ta aiki, ramin yana lafiya kuma wani tace yana kan hanya.

ip -brief address
ip route get 10.20.0.12
ping -c3 10.20.0.12
nc -vz 10.20.0.12 2377

Idan hanyar ta nuna ga hanyar jiki maimakon tun0 ko wg0, overlay zai lulluɓe zuwa adireshin da wurin nesa ba zai iya isa ba, kuma alamar za ta yi kama da asarar fakiti.

Duba wane adireshi kowane kumburi yake sanarwa

Daemon yana sanar da adireshi ɗaya, kuma abokan tarayya suna amfani da shi don matakin bayanai. A kan mai masaukin cibiyar sadarwa da yawa yana da sauƙi a sanar da adireshin LAN ko na jama'a yayin da ramin ke ɗaukar wani abu daban. Bincika shi maimakon ɗauka, kuma ka lissafta shi lokacin shiga da --advertise-addr idan tsoho ba daidai ba ne. Kumburin da ke sanar da adireshin da shi kaɗai zai iya isa har yanzu yana shiga cikin swarm, kuma gazawar tana bayyana daga baya a matsayin sabis ɗin da ba za su iya magana tsakanin rukunin yanar gizo ba.

Canza adireshin da aka sanar daga baya ba gyaran tsari ba ne, domin kumburin dole ya fita ya sake shiga.

Rubuta adireshin da aka sanar na kowane kumburi a cikin bayananka, domin yana bayyana yawancin gazawa marasa daidaituwa.

Masquerade shine wanda aka saba zargi

Lokacin da ƙofa ke tsakanin kumburin da ramin, kuskuren da aka saba shine yin masquerade ga duk abin da ke fita daga hanyar jiki. Wannan yana sake rubuta adiresoshin cikin overlay ma, don haka kowane abokin tarayya ya bayyana kamar ya fito daga ƙofar kuma abokan VXLAN sun daina gane juna. Sakamakon shine ɓataccen ko mai gefe ɗaya lulluɓɓen zirga-zirga yayin da ping na yau da kullum ke aiki.

Yi hanya da prefix na overlay ta ƙofar kuma bar shi ba a fassara ba. Idan fassara tana da gaske buƙata ga wani prefix, iyakance ta a can kuma ba za a taɓa zuwa kewayon da overlay ke amfani da shi ba.

ip route add 172.16.0.0/22 via 10.20.0.1
iptables -t nat -I POSTROUTING -o tun0 -s 172.16.0.0/22 -j ACCEPT

Duba tsarin dokoki da kuma rubutun su, domin faffadan MASQUERADE da ke gaba a sarkar yana cin nasara akan ƙunƙuntaccen keɓancewa daga baya.

VXLAN yana buƙatar wuri a cikin fakiti

VXLAN yana ƙara 50 bytes ga firam ɗin da yake ɗauka. Ƙasan mai 1500 bytes da ke ɗaukar firam na ciki na 1500 bytes yana haifar da lulluɓɓen fakiti wanda babu hanyar da za ta isar da shi, kuma gazawar tana kama da gano sabis na lokaci-lokaci maimakon matsalar girman. Ko ka rage MTU na ramin a ƙarshen biyu ko ka saita MTU na overlay domin direba ya sanar da kaya mai amfani wanda ya dace.

docker network create --driver overlay --attachable --opt com.docker.network.driver.mtu=1400 swarm-overlay

Ana ƙirƙirar cibiyar sadarwar ingress ta atomatik, don haka canza ta yana nufin cirewa da sake ƙirƙira maimakon gyara ta a wurin.

Idan ka gyara gefe ɗaya na ramin kawai, ƙaramin MTU har yanzu shine abin da ke da mahimmanci.

Kalli matakin bayanai, ba rajista ba

Ka kama tashar VXLAN a ƙarshen biyu. Firam ɗin da ke barin gefe ɗaya kuma suka isa ɗayan suna nufin ƙasan yana lafiya kuma matsalar tana cikin overlay. Firam ɗin da ke barin suka taɓa isowa suna nufin hanya ko tace. Firam ɗin da ba su fita kwata-kwata suna nufin adireshin tushe ba daidai ba ne.

Gazawar gano sabis da ke warkewa bayan ƴan daƙiƙa yawanci tana nuni ga kasafin fakiti ko hanya mai jujjuyawa, ba ga ƙuri'ar raft ba.

Ka ajiye kamun daga taga mai aiki, domin kwatanta shi da ɓataccen ya fi sauri fiye da sake karanta tsari.