Docker Swarm nge-VPN: imisebenzi iyasebenza, izingcingo zesevisi ziyehluleka

Abaphathi abathathu nabasebenzi abahlanu kuzo zombili izingosi, abaxhunywe ngomhubhe, futhi i-docker service ls ibonisa imisebenzi esebenzayo nhlangothi zombili ngenkathi izingcingo phakathi kwesevisi ziphelelwa isikhathi. Akukho lutho emibhalweni ye-Swarm olubonakala lungalungile. Leyo nhlanganisela iwuphawu lwenkinga endaweni yedatha: indawo yokulawula ithole amanodi, futhi amafreyimu asongelwe awakaze awenze uhambo.

I-mesh kufanele ibe khona ngaphambi kwe-overlay

I-overlay ye-Swarm iphusha amafreyimu asongelwe ngqo phakathi kwamakheli amanodi, okusho ukuthi inodi ngayinye idinga ikheli wonke amanye amanodi angafinyelela kulo ngaphandle kokuhumusha, kusixhumi esibonakalayo esinikezwa umhubhe. Umhubhe ohambisa amaklayenti kuphela aya ephothini elishicilelwe awanele. Ingqimba engaphansi kufanele ihambise imizila isuka kunodi iya kunodi kuzo zombili izinhlangothi.

Hlola lokho ngaphambi kokuthinta i-Swarm. Kunodi ngayinye, hlola umzila oya ekhelini lomhubhe lozakwabo, yenza i-ping, bese uhlola iphothi lokulawula. Uma i-ping isebenza kanti iphothi alisebenzi, umhubhe ulungile futhi kunesihlungi endleleni.

ip -brief address
ip route get 10.20.0.12
ping -c3 10.20.0.12
nc -vz 10.20.0.12 2377

Uma umzila ukhomba kusixhumi somzimba esikhundleni se-tun0 noma i-wg0, i-overlay izosonga iye ekhelini isayithi elikude elingakwazi ukufinyelela kulo, futhi uphawu luzobonakala njengokulahleka kwamaphakethe.

Hlola ukuthi inodi ngayinye imemezela likuphi ikheli

I-daemon imemezela ikheli elilodwa, futhi ozakwabo bayisebenzisa endaweni yedatha. Kusiphathi esinamarede amaningi kulula ukumemezela ikheli le-LAN noma elomphakathi ngenkathi umhubhe uthwala okunye. Yihlole esikhundleni sokucabanga, futhi ulibophe lapho ujoyina usebenzisa i---advertise-addr uma okuzenzakalelayo kungalungile. Inodi ememezela ikheli eyona kuphela engalifinyelela iyajoyina i-swarm, futhi ukwehluleka kubonakala kamuva njengesevisi ezingakwazi ukukhuluma phakathi kwezayithi.

Ukushintsha ikheli elimemezelwe kamuva akukona ukuhlela ukucushwa, ngoba inodi kufanele iphume futhi ijoyine futhi.

Bhala ikheli elimemezelwe lenodi ngayinye kumanothi akho, ngoba lichaza iningi lokwehluleka okungalingani.

I-Masquerade iyisigebengu esivamile

Uma ingqamuzana yokungena ihlezi phakathi kwamanodi nomhubhe, iphutha elivamile ukusebenzisa i-masquerade kukho konke okuphuma kusixhumi somzimba. Lokho kubhala kabusha namakheli angaphakathi e-overlay, ngakho wonke ozakwabo ubonakala evela engqamuzaneni yokungena futhi ozakwabo be-VXLAN bayeka ukubonana. Umphumela uwuthrafikhi osongelwe olahlekile noma ohlangothini olulodwa ngenkathi ama-ping ajwayelekile esasebenza.

Hambisa isiqalo se-overlay ngesango futhi usishiye singahumushiwe. Uma ukuhumusha kudingeka ngempela kwesinye isiqalo, kukhawulele lapho futhi ungalokothi kusikhawulo esisetshenziswa i-overlay.

ip route add 172.16.0.0/22 via 10.20.0.1
iptables -t nat -I POSTROUTING -o tun0 -s 172.16.0.0/22 -j ACCEPT

Hlola ukulandelana kwemithetho kanye nombhalo wayo, ngoba i-MASQUERADE ebanzi ngaphambili ochungechungeni inqoba okuhlukile okuncane kamuva.

I-VXLAN idinga indawo kuphakethe

I-VXLAN yengeza amabhayithi angu-50 kumafreyimu eyawathwalayo. Ingqimba engaphansi yamabhayithi angu-1500 ethwala ifreyimu yangaphakathi yamabhayithi angu-1500 ikhiqiza iphakethe elisongelwe okungekho mzila ozoliletha, futhi ukwehluleka kubonakala njengokutholakala kwesevisi okuphazamisekile hhayi njengenkinga yosayizi. Sehlisa i-MTU yomhubhe kuzo zombili iziphetho noma setha i-MTU ye-overlay ukuze umshayeli amemezele umthwalo okhona.

docker network create --driver overlay --attachable --opt com.docker.network.driver.mtu=1400 swarm-overlay

Inethiwekhi ye-ingress yakhiwa ngokuzenzakalela, ngakho ukuyishintsha kusho ukuyisusa nokuyakha kabusha hhayi ukuyihlela endaweni.

Uma ulungisa uhlangothi olulodwa lomhubhe, i-MTU encane iseyiyo ebalulekile.

Buka indawo yedatha, hhayi amarekhodi

Bamba iphothi le-VXLAN kuzo zombili iziphetho. Amafreyimu aphuma ohlangothini olulodwa futhi afika kolunye asho ukuthi ingqimba engaphansi ilungile futhi inkinga ingaphakathi kwe-overlay. Amafreyimu aphumayo angafiki neze asho umzila noma isihlungi. Amafreyimu angaphumi nakanye asho ukuthi ikheli lomthombo alilungile.

Ukwehluleka kokutholakala kwesevisi okunyamalala ngemuva kwemizuzwana embalwa ngokuvamile kukhombisa isabelomali samaphakethe noma umzila odlikizayo, hhayi ikhoramu ye-raft.

Gcina ukubanjwa okuvela ewindini elisebenzayo, ngoba ukukuqhathanisa nokonakele kushesha kunokufunda kabusha ukucushwa.