Ama-pod e-GKE alahlekelwe ukufinyelela kwe-VPN ngemuva kuka-1.14: izindlela ezimbili zokulungisa umthombo

Ngemuva kuka-1.14 ama-pod afinyelela i-VPN ngamakheli awo, ngakho abalingani balahla izimpendulo. Khetha isivumelwano somthombo, bese usetha i-nonMasqueradeCIDRs ukuze ihambisane nakho.

Kufika ukuthuthukiswa, futhi izinhlelo ezingalé kwe-tunnel ziqala ukwenqaba ithrafikhi yama-pod eyayisebenza ngesonto eledlule. I-tunnel iphezulu, imithetho ye-firewall ayithintekile, futhi akekho ohlele inqubomgomo yomlingani. Okwashintshayo akubonakali kumalogi we-cluster: ikheli lomthombo izinhlelo lezo ezilibona manje. Leyo gebe ichaza ukwehluleka okubonakala njengokuphazamiseka kwenethiwekhi futhi okuziphatha njengenkinga yemvume.

Kunezimpendulo ezimbili ezivumelekile, futhi zikuholela ezindaweni ezahlukene. Khetha isivumelwano somthombo ngaphambi kokuhlela i-ConfigMap.

Umthetho ozenzakalelayo owagcina ukufakwa

Izinguqulo zangaphambili ze-GKE zazifaka umthetho we-masquerade owawushintsha imithombo yama-pod ngikheli le-node noma nini lapho indawo eya kuyo ingaphandle kuka-10.0.0.0/8. Isango le-VPN ngaphakathi kwalelo banga lalibona ikheli le-pod, kanti noma yini ekude kakhulu yayibonakala sengathi ivela ku-node. Abalingani bakha izinhlu zemvume nemizila yokubuya ezungeze amakheli e-node ngoba yilokho ababekubona.

Izinguqulo zakamuva zayeka ukufaka lowo mthetho ozenzakalelayo. Ithrafikhi yama-pod manje ifika esangweni namakheli ama-pod, kungakhathaliseki ukuthi iyaphi. Umlingani ohambisa amakheli e-node kuphela ulahla izimpendulo, futhi alukho uhlangothi olubhala umugqa welogi owusizo. Isicelo singase siphumelele ngisho ngasohlangothini olukude, futhi yikho okwenza lokhu kwehluleka kube nzima ukukulandela.

Akukho okugqekile ngomqondo wengxenye efile. Izinhlangothi ezimbili azivumelani nje ngokuthi imuphi umthombo osemthethweni.

Khetha umthombo umlingani okufanele awubone

Ukugcina amakheli ama-pod yisivumelwano esinemba kakhulu. Uhlangothi olukude lubona umsebenzi owakha ithrafikhi, amalogi ahlala ethembekile, futhi inqubomgomo ye-pod ngayinye iyenzeka. Intengo ukuthi umlingani kufanele athwale isiqalo se-pod.

Ukugcina amakheli e-node yisivumelwano esishibhile. Vula i-masquerade futhi kuleyo ndawo, futhi umlingani uzoqhubeka ebona ikheli aselithembile.

Umbuzo owodwa unquma phakathi kwazo: umlingani wenzani ngomthombo? Uma ubhala ilogi, usebenzisa inqubomgomo ngomthombo ngamunye noma uphoqa umzila wokubuya omncane, amakheli ama-pod afanelekela ukulungiselelwa okwengeziwe. Uma kudingeka kuphela ukuthumela izimpendulo, i-masquerade ibiza kancane futhi ayiceli lutho kolunye uhlangothi. Noma yikuphi ukukhetha kuyavikeleka inqobo nje uma womabili amaqembu ekubhala phansi.

Indlela yesithathu ngokuvamile iyiphutha: i-masquerade yakho konke bese ulahlekelwa amandla okwabela ithrafikhi. Kugweme ngaphandle uma umlingani engakwazi ngempela ukuhambisa okunye ngaphandle kwamakheli e-node.

Khombisa i-nonMasqueradeCIDRs emabangeni angempela

I-GKE isebenzisa i-ip-masq-agent ku-kube-system, futhi i-ConfigMap yayo ibala izindawo ezigxuma i-masquerade. Ukuze kugcinwe imithombo yama-pod ibheke e-tunnel, ibanga lama-pod, i-subnet ye-node kanye nesiqalo sasendaweni konke kungena kulolo hlu.

Shintsha amanani ayisibonelo ngamabanga avela ku-cluster yakho. Ungayenzi uhlu lube banzi kunalokho okudingwa yisidingo, ngoba yonke ingeno eyengeziwe ishintsha lokho okubonwa enye indawo. Izingeno ezintathu ngezansi zimelela inethiwekhi yama-pod, i-subnet ye-node kanye nesiqalo esingemuva kwe-tunnel:

nonMasqueradeCIDRs:
  - 10.12.0.0/14
  - 10.100.0.0/16
  - 172.16.0.0/12
masqLinkLocal: false
resyncInterval: 60s

Ingeno ka-0.0.0.0/0 icisha i-masquerade kuzo zonke izindawo, okushintsha indlela imisebenzi engahlobene ebonakala ngayo ezinsizeni zangaphandle futhi akuvamile ukuthi kuhlosiwe. I-ejenti ifunda kabusha ukulungiselelwa kwayo ku-resyncInterval, ngakho ukuqala kabusha ngokuvamile akudingeki. Hlola ukuthi i-pod ye-ejenti iyasebenza, bese uvula ifayela elifakiwe ngaphakathi kwayo. Ukufunda lelo fayela yikho okuqinisekisa ukuthi ushintsho lufikile.

Indlela yempendulo ingenye ingxenye

I-masquerade ishintsha umthombo wesicelo futhi ayishintshi enye into. Noma yimuphi umthombo umlingani awutholayo, usadinga umzila wokubuyela kuwo, futhi i-cluster isadinga umzila obheke kumlingani.

Ukubamba esangweni le-VPN kuhlukanisa ukwehluleka okubili ngokushesha. Amaphakethe afika namakheli ama-pod futhi angalutholi impendulo asho ukuthi umlingani akanazo izindlela zesiqalo se-pod. Impendulo ebonakala esangweni kodwa engafiki ku-cluster isho ukuthi umzila wasendaweni awukho. Kunoma yikuphi, bhala isivumelwano kuthikithi: imuphi umthombo obonwa umlingani, futhi isiphi isiqalo asibuyisela kuso impendulo.

Hlola futhi ngemuva kwakho konke ukuthuthukiswa

Ukuziphatha okuzenzakalelayo kwe-masquerade sekushintshile kanye, futhi ukushintsha iqoqo lama-node kungaphinda kusethe kabusha inethiwekhi ye-cluster. Thatha isivumelwano somthombo njengento okufanele iqinisekiswe, hhayi okufanele icatshangwe.

Ngemuva kokuthuthukiswa, thumela isicelo esisodwa kusuka ku-pod kuye ensizeni yasendaweni bese ufunda umthombo okubhalwa yilog umlingani. Lokho kubona okukodwa kubamba ukwehla okungabikwa ngokujabulayo yikhasi lesimo se-tunnel njengokunempilo. Ukuphinda kwakho kuthatha umzuzu futhi kusindisa umuntu olandelayo ubusuku.

Izihloko ezihlobene