Pods na GKE sun rasa damar VPN bayan 1.14: hanyoyi biyu na gyara tushen

Wani sabuntawa ya zo, kuma tsarin da ke wancan gefen ramin sun fara ƙin zirga-zirgar pods da suka yi aiki a makon da ya gabata. Ramin yana buɗe, dokokin wutar bango ba a taɓa su ba, kuma babu wanda ya gyara manufofin peer. Abin da ya canza ba a ganuwa a cikin rajistan cluster: adireshin tushen da waɗannan tsarin suke gani yanzu. Wannan gibin yana bayyana gazawar da take kama da katsewar cibiyar sadarwa kuma tana aiki kamar matsalar izini.

Akwai amsoshi biyu masu inganci, kuma suna kai ka wurare daban-daban. Zaɓi yarjejeniyar tushe kafin ka gyara ConfigMap.

Dokar tsoho wadda aka daina girka

Tsofaffin bugu na GKE sun girka dokar masquerade wadda ta maye gurbin tushen pods da adireshin node duk lokacin da manufa ta kasance wajen 10.0.0.0/8. Ƙofar VPN da ke cikin wannan yanki tana ganin adireshin pod, yayin da duk abin da ya fi nisa ya yi kama da ya fito daga node. Peers sun gina jerin izini da hanyoyin dawowa kewayen adiresoshin node saboda abin da suka gani ke nan.

Ƙarin sabbin bugu sun daina girka wannan dokar ta tsoho. Zirga-zirgar pods yanzu tana isa ƙofar da adiresoshin pods, ko menene manufar. Peer da ke bin hanyoyin adiresoshin node kawai yana watsar da amsoshi, kuma babu ɓangare da ke rubuta wani bayanin log mai amfani. Buƙatar na iya yin nasara har a ƙarshen nesa, kuma wannan ne ke sa gazawar ta zama mai ruɗani a bi.

Babu abin da ya lalace a ma'anar ɓangaren da ya mutu. Ƙungiyoyin biyu kawai ba su yarda da wace tushe ce ta halal ba.

Zaɓi tushen da peer ya kamata ya gani

Riƙe adiresoshin pods shine yarjejeniya mafi daidaito. Ƙarshen nesa yana ganin aikin da ya haifar da zirga-zirgar, rajista ta kasance gaskiya, kuma manufar kowane pod ta zama mai yiwuwa. Farashin shine peer dole ne ya ɗauki prefix ɗin pods.

Riƙe adiresoshin node shine yarjejeniya mafi arha. Kunna masquerade don wannan manufa kuma peer zai ci gaba da ganin adireshin da ya riga ya amince da shi.

Tambaya ɗaya ce ke yanke hukunci tsakaninsu: me peer yake yi da tushen? Idan yana yin rajista, yana amfani da manufa ta kowace tushe ko yana tilasta hanyar dawowa mai ƙunci, adiresoshin pods suna tabbatar da ƙarin saitin. Idan yana buƙatar aika amsoshi kawai, masquerade yana da ƙarancin kuɗi kuma baya neman komai daga ɓangaren. Kowace zaɓi tana da hujja muddin ƙungiyoyin biyu sun rubuta ta.

Zaɓi na uku yawanci kuskure ne: masquerade komai da rasa ikon danganta zirga-zirgar. Ka guje shi sai dai idan peer da gaske ba zai iya bin komai ba face adiresoshin node.

Nuna nonMasqueradeCIDRs ga ainihin yankuna

GKE yana gudanar da ip-masq-agent a cikin kube-system, kuma ConfigMap ɗinsa yana lissafin manufofin da suka tsallake masquerade. Don adana tushen pods zuwa ramin, yankin pods, subnet ɗin node da prefix ɗin gida duk suna cikin wannan jerin.

Maye gurbin ƙimar misali da yankuna daga cluster ɗinka. Kada ka faɗaɗa jerin fiye da yadda buƙata ta faɗa, saboda kowace ƙarin shigarwa tana canza abin da wata manufa ke gani. Shigarwar uku da ke ƙasa suna wakiltar cibiyar sadarwar pods, subnet ɗin node da prefix ɗin bayan ramin:

nonMasqueradeCIDRs:
  - 10.12.0.0/14
  - 10.100.0.0/16
  - 172.16.0.0/12
masqLinkLocal: false
resyncInterval: 60s

Shigarwar 0.0.0.0/0 tana kashe masquerade ga duk manufofi, wanda ke canza yadda ayyukan da ba su da alaƙa suke bayyana ga ayyukan waje kuma ba safai ake nufi ba. Agent yana sake karanta saitin sa a resyncInterval, don haka sake farawa ba lallai ba ne. Duba cewa pod ɗin agent yana aiki, sannan buɗe fayil ɗin da aka ɗora a ciki. Karanta wannan fayil shine ke tabbatar da cewa canjin ya iso.

Hanyar amsa ita ce ɗayan rabin

Masquerade yana canza tushen buƙatar kuma ba komai ba. Ko wace tushe peer ya karɓa, har yanzu yana buƙatar hanya ta komawa gareta, kuma cluster ɗin har yanzu yana buƙatar hanya zuwa ga peer.

Kamawa a ƙofar VPN yana raba gazawar biyu da sauri. Fakiti da suka iso da adiresoshin pods kuma ba su taɓa samun amsa suna nufin peer ɗin ba shi da hanya ga prefix ɗin pods. Amsa da ta bayyana a ƙofar amma ba ta taɓa isa cluster ɗin ba tana nufin hanyar gida ta ɓace. Rubuta yarjejeniyar a cikin tikit ɗin ko ta yaya: wace tushe peer yake gani, da wace prefix yake mayar da amsa.

Sake dubawa bayan kowace sabuntawa

Halin masquerade na tsoho ya riga ya canza sau ɗaya, kuma maye gurbin rukunin node na iya sake saita cibiyar sadarwar cluster. Ka ɗauki yarjejeniyar tushe a matsayin abin dubawa ba abin zato ba.

Bayan sabuntawa, aika buƙata ɗaya daga pod zuwa sabis ɗin gida sannan ka karanta tushen da peer yake rubutawa. Wannan kallo ɗaya yana kama koma baya wanda shafin matsayin rami zai bayar da rahoton lafiya da farin ciki. Maimaita shi yana ɗaukar minti ɗaya kuma yana ceton mutum na gaba maraice.