I-OpenVPN pod ku-Kubernetes ayidlulisi lutho? Hlola i-ip_forward

Amaklayenti a-ping i-VPN pod futhi akukho okudlula kuyo. I-namespace inokudlulisa kuvaliwe, futhi ukulungisa kufanele kuhlale ku-admission, ukuqalisa kabusha kanye nendlela yokubuya.

I-laptop yakho ikhombisa umhubhe oluhlaza, ilogi yeklayenti ithi imizila ishukunyisiwe, futhi ikheli okuwukuphela kwalo eliphendulayo i-IP yomhubhe yesiphakeli se-VPN ngokwaso. Ama-ping ngale kwayo ayafa noma ngabe uhlose ini, kungaba i-ClusterIP, ikheli lelinye iphodu noma igama lomsingathi lomphakathi. Leyo nhlanganisela iwukuxilonga, akuwukufiphala: ukukhulula kusebenza, futhi ukugxuma kwesibili akusebenzi.

Ngihlangabezane nalokhu ku-node ye-Debian egcina isithombe se-OpenVPN esifakwe nge-chart, futhi umhubhe wawuyingxenye elula. Iklayenti lathola ukuqashwa kwe-10.8.0.x, u-10.8.0.1 waphendula, futhi u-10.96.0.10, insizakalo ye-DNS yeqoqo, yaphelelwa isikhathi. Akukho okwabonakala kugula kulogi yesiphakeli, futhi yikho kanye okwenza abantu baqale ukubhala kabusha imithetho ye-iptables ababengakaze badinge ukuyithinta.

I-VPN pod iyindawo yokuhambisa, futhi kufanele kushiwo ngokuqondile. Amaphakethe abethelwe ayafika, avulwa ku-namespace yenethiwekhi yephodu ngokwayo, bese kufanele aphume ngenye i-interface. I-Linux iyenqaba leso sinyathelo sesibili ngaphandle uma ukudlulisa kuvuliwe ngaphakathi kwale yo namespace.

Iklayenti lingafinyelela ini futhi lingakwazi ukufinyelela ini

Ikheli eliphendulayo lingelokuphela komhubhe, futhi inqubo ye-VPN iyayiphethe endaweni, ngakho ukudlulisa akuhlanganyeli nhlobo. Konke okunye, kuhlanganise enye iphodu, i-VIP yensizakalo noma i-inthanethi, kudinga ukuthi i-kernel ihambise iphakethe lisuka ku-tun0 liye ku-eth0. Uma lokho kuhamba kunqatshwa, uphawu ukuthula okulinganayo hhayi ukunqatshwa, ngoba akukho okukhiqiza iphutha le-ICMP libuyela phansi emhubheni. Uthola izikhathi zokuphela, hhayi imilayezo yokungafinyeleleki, futhi yilokho okuyisikhombi sokuthi akekho umuntu ohambisa imizila nhlobo.

Amaminithi amabili okuhlukanisa anciphisa isendlalelo. Uma amagama e-DNS ehluleka kuyilapho ama-ping aluhlaza kwi-IP yensizakalo ephumelela, inkinga isemapayipini e-DNS, hhayi ekudluliseni. Uma yonke indawo edlula ikheli le-peer iphelelwa isikhathi, kuhlanganise ne-IP engenalutho, qala ku-namespace.

Funda isilungiselelo ngaphakathi kwe-namespace

Iphodu ngayinye ithola i-namespace yayo yenethiwekhi, futhi i-net.ipv4.ip_forward iyi-sysctl nge-namespace ngayinye. Ukuyishintsha ku-node akukutsheli lutho mayelana nekhonteyina, futhi iyindlela ethembekile yokuchitha ntambama emshinini ongafanele.

kubectl exec -it deploy/openvpn -- sysctl net.ipv4.ip_forward
# net.ipv4.ip_forward = 0

Uziro uqinisekisa ukuxilonga. Inani alilitholi njengefa futhi isuka ekucushweni kwesikhathi sokusebenza se-node: liqala kusuka kokumisiwe kwesithombe njalo lapho kwenziwa ikhonteyina. Ngakho ukulungisa okusetshenziswe ngesandla nge-kubectl exec ... sysctl -w kuyanyamalala ekuqaliseni kabusha okulandelayo futhi kubuye njengephutha elibonakala lingena lingaphuma.

Kuyavula ukuze i-manifest ikugcine

Inketho ehlala isikhathi isitsha se-init esisebenza kuleyo sandbox yephodu futhi sibhale inani ngaphambi kokuthi isitsha se-VPN siqale. Izitsha kuphodu zabelana nge-namespace yenethiwekhi, ngakho isilungiselelo sidlulela esitsheni esikhulu.

initContainers:
- name: enable-forwarding
  image: busybox:1.36
  command: ["sysctl", "-w", "net.ipv4.ip_forward=1"]
  securityContext:
    privileged: true

Yilo privileged: true umugqa abahloli abaphikisana nawo, futhi baqinisile. Ukubhala i-sysctl kudinga ilungelo noma amandla abusiwe, futhi iqoqo elisebenzisa i-Pod Security Standard ekhawulelwe lingase lenqabe ngokuphelele isitsha se-init esinelungelo. Uma i-admission yenqaba iphodu, uthola lokho ngesikhathi sokwakha, okungenani kuyiqiniso futhi kulula ukukufunda.

Enye indlela ehlanzekile uhlu lwe-securityContext.sysctls ezingeni lephodu, oluvumela i-kubelet ukuthi lisebenzise ama-sysctl ane-namespace ngaphandle kokunikeza ilungelo kunoma isiphi isitsha. Luhlanganisa kuphela amagama akuhlu oluvunyelwe lweqoqo. Ukuthi i-net.ipv4.ip_forward isekhona yini kulolo hlu kuncike ekutheni i-kubelet yacushwa kanjani, futhi iphodu ecela i-sysctl ngaphandle kwalo iyenqatshwa ku-admission noma ibambeke ku-CreateContainerConfigError ngesikhathi i-sandbox izanywa futhi. Hlola uhlu oluvunyelwe ngaphambi kokucabanga ukuthi inkambu yephukile.

Ngaphambi kokwakha noma iyiphi yalezi zindlela ngesandla, bheka ukuthi i-chart isivele iveza iswishi, kaningi njengento efana ne-ipForwardInitContainer: true. Ukusebenzisa inani le-chart kugcina ifayela lakho le-override lincane futhi kuphila ukuthuthukiswa okulandelayo, okuyinto izinguquko ze-Deployment eziphathwe ngesandla ezingakwenzi.

Ingxenye yesibili: indlela yokubuya nenqubomgomo

Ukudlulisa okuvuliwe kuyadingeka, akwanele. Uma amaklayenti esebenzisa iphuli eliyimfihlo iqoqo lenethiwekhi elingenayo indlela yokuya kulo, izimpendulo azitholi indlela yokubuyela emhubheni, futhi iphodu kufanele ifihle lowo mthwalo ukuya endaweni yawo.

Inqubomgomo ihlezi phezu kwalokho. Izinto ze-NetworkPolicy kanye nemithetho yocingo lomlilo lwefu zihlolwa ngokumelene nekheli lomthombo elithwalwa iphakethe ngemva kokuhumusha, ngakho umthetho obhalelwe iphuli leklayenti ungase uyeke ukufanisa ngokuthule uma ukufihla kuvuliwe.

Uma amaklayenti edinga kuphela ukufinyelela izinsizakalo ngaphakathi kweqoqo, ukuqeda i-VPN ku-VIP yensizakalo kuwumklamo omncane kunokuhambisa imizila ungene kunethiwekhi yephodu. Kubuye kugcine iphuli leklayenti ngokuphelele ngaphandle kwethebula lemizila ye-CNI.

Ukuhlukanisa ukugxuma okwehlulekayo kusuka kuklayenti

Sebenza uya ngaphandle futhi ume esinyathelweni sokuqala esithule. Qala nge-peer ye-VPN, bese uzama ikheli lephodu elithile, bese i-VIP yensizakalo, futhi ngemva kwalokho kuphela indawo yomphakathi. Yonke impumelelo ihambisa umngcele ngokugxuma okukodwa, futhi ukwehluleka ngakunye kubiza isendlalelo okufanele sihlolwe. Ngemva kwanoma yikuphi ukusatshalaliswa, ngena nge-exec futhi ufunde i-sysctl futhi, ngoba iphodu eshintshiwe iqala kokumisiwe kwesithombe futhi ukulungisa okwangakaze kube ku-manifest sekuhambile.

Idokhumenti ye-Kubernetes mayelana nokusebenzisa i-sysctl eqoqweni ibala ukuthi yimaphi amagama angasetshwa ngesimo sokuphepha sephodu, futhi yindawo yokuqala okufanele ibhekwe lapho i-admission inqaba ushintsho.

Izihloko ezihlobene