IP yeklayenti le-VPN ku-Kubernetes: siyigcine noma senze SNAT?

Endaweni ethile phakathi kwethubhu ne-backend, ikheli leklayenti liyaphila noma liyashintshwa, futhi imiphumela yomibili iyavikeleka. Ukukhetha kungokomnikazi wesevisi eyamukelayo, hhayi lowo ofake i-CNI. Lapho igunya leklayenti ngalinye, ama-quota noma amarekhodi okucwaninga abalulekile, ikheli kufanele liphile kuwo wonke ama-hop. Lapho ukwabiwa okuhlanganyelwe kwamukelekile, i-NAT yomthombo isusa inkinga yomzila obungeke uyigcine kuze kube phakade.

Lapho ikheli leklayenti lanyamalala khona ngempela

Iphakethe leklayenti elikude lifika ku-pod ye-VPN linomthombo wangaphakathi ngaphakathi kwebanga lethubhu, ake sithi 10.90.0.42. Lapho i-pod idlulisela lelo phakethe ibheke ku-ClusterIP noma i-IP ye-pod, izindlela ezintathu ezahlukene zingabhala kabusha umthombo. Umthetho we-masquerade we-CNI kunodi uhlanganisa ithrafikhi i-pod eyithumela ngaphandle kwe-CIDR yeklasta. Ukufakwa kwe-conntrack ye-kube-proxy kunodi yomgomo kuhlanganisa i-Service hop ngokwayo. I-proxy eqeda ukuxhumana ayilidluliseli nhlobo iphakethe, ngakho umthombo owubonayo ekugcineni ungoweproxy.

Ngamunye uhlala kusendlalelo esihlukile, yingakho inkambu eyodwa ye-Service cishe ayilokothi ilungise yonke indlela.

I-externalTrafficPolicy ku-Service yomphakathi ye-VPN inquma kuphela ukuthi kwenzekani ngoxhumano lwangaphandle: i-Local igcina ikheli elikude kunodi elilitholile, kuyilapho i-Cluster ivumela i-kube-proxy ukuthi inikeze iphakethe kunodi enye futhi yenze i-masquerade lapho. Leso silungiselelo silawula isilaleli amaklayenti akho axhumana naso. Asisho lutho mayelana nephakethe elisusiwe ukubethela eliqondiswa inqubo yakho ye-VPN kuklasta kamuva.

Imibandela emithathu eqeda ingxabano

Ngibuza imibuzo emithathu efanayo ngokulandelana okufanayo njalo lapho lokhu kuvela, ngoba eyokuqala ivame ukuqeda ingxoxo. Phendula ngomthwalo womsebenzi othile hhayi ngeklasta yonke. Amaklasta amabili phakathi kwenkampani eyodwa angafinyelela izimpendulo ezihlukene futhi womabili abe eqinile.

Uma i-backend iphendula yebo embuzweni wokuqala futhi cha kowesibili, unomsebenzi wenethiwekhi okufanele uwenza hhayi i-manifest okufanele uyihlele. Uma umugqa wesithathu uthi i-proxy, ikheli lalingeke liphile, futhi ukuzenzisa okuhlukile kudla iviki lokuthwebula amaphakethe.

Lokho okudingwa yimodi ye-preserve kunethiwekhi

Ukwgcina umthombo kusho ukuthi inodi yomgomo kufanele ibuyisele ithrafikhi ku-10.90.0.42 nge-gateway ye-VPN esebenzayo. Ichibi le-VPN akusona i-CIDR yeklasta, ngakho akukho i-CNI eyenza umzila wayo wena ngokuzenzakalela. Wengeza umzila wena, bese uqinisekisa ukuthi iphoyinti lokugcina le-gateway elikhomba kulo liphila ekuhlelweni kabusha.

ip route add 10.90.0.0/24 via 10.244.3.17 dev eth0
sysctl -w net.ipv4.conf.eth0.rp_filter=2

Lokho ku-hop okulandelayo ikheli le-pod, futhi amakheli e-pod ayahamba. Qondisa umzila ku-VIP ye-Service noma ikheli lenodi elihlala endaweni, noma amukele ukuthi uzoxoxa i-gateway ngemuva kokuxoshwa ngakunye. Ukuhlunga kwendlela ehlanekezelayo kungenye ingibe: imodi eqinile ilahla amaphakethe anendlela yokubuya engahambisani ne-interface eangene ngayo, futhi lokho kuyisimo esiqondile sokugeleza kwe-VPN okugciniwe.

Ukuqinisekisa okuxekethile kuvame ukuba umehluko phakathi kwendlela yokubuya esebenzayo kanye nezimpendulo ezinyamalalayo ngemuva kokushiya i-backend. Imithetho ye-masquerade kunodi ye-VPN nayo kufanele ikhiphe ibanga lethubhu, ngaphandle kwalokho iphakethe elidlulisiwe liphuma nekheli le-pod, kungakhathaliseki ukuthi wakha muphi umzila. Khetha ukuveza lokho kukhipha ekulungiselelweni kwe-CNI uqobo esikhundleni sokuhlela i-iptables ngesandla, ngoba i-ejenti ibhala kabusha amaketanga ayo lapho iqala kabusha futhi umthetho wakho obhalwe ngesandla uhlala ngqo kuze kube ukuthuthukiswa okulandelayo.

I-NetworkPolicy wukulawula ukufinyelela, hhayi umzila. Ukuqinisa inqubomgomo akuyikubuyisela ikheli elelisiwe yi-masquerade.

I-SNAT ibiza malini, futhi uyibhala kanjani phansi

I-NAT yomthombo ebheke eklasta iwumklamo oshibhile, futhi akulona iphutha. I-backend ibona ikheli le-pod noma lenodi ye-VPN, amalogi ayavumelana, futhi akudingeki kube khona umzila wokubuya. Okulahlekayo yikhono lokuhlukanisa amaklayenti amabili kusendlalelo senethiwekhi, ngakho ama-quota, ukuvinjelwa kanye nemikhondo yokucwaninga kufanele kuvele kwenye indawo.

Imvamisa leyo enye indawo wuhlelo lokusebenza: ithokheni yesikhathi, isihloko esisayiniwe, noma umugqa wephrothokholi ye-PROXY obhalwa yi-proxy oyilawulayo. Lezi zinika umamukeli ubunikazi angabuthemba kuphela lapho i-proxy isendleleni futhi isihloko singeke sibekwe ohlangothini lweklayenti. Yiba nomqondo ocacile ku-runbook ukuthi yikuphi okusebenzayo, ngoba unjiniyela olandelayo uzothatha ukuthi ikheli elikusigcini liyiklayenti. Akunjalo, futhi isigameko esisodwa sanele ukwenza leso sithombe sibe kubiza.

Ukushintshana kuhlala kuthembekile inqobo nje uma kubhalwe phansi.

Izihlolo ezihlukanisa indlela esebenzayo nendlela enenhlanhla

Hlola ngoxhumano olusha hhayi olugciniwe, futhi uhlole nhlangothi zombili. Izingxaki ezimbalwa zibonakala ziyaphazamisa ngoba nje ukugeleza okusha kuthatha indlela ebhalwe kabusha.

Bamba i-tuple ezindaweni ezintathu phakathi kwesicelo esisodwa esigunyaziwe: khona ngemuva kokususa ukubethela, ku-interface yokuphuma ye-pod ye-VPN, naku-backend. Uma umthombo ushintsha phakathi kokubambwa kwesibili nokwesithathu, imbangela ingaphansi kwe-pod. Uma ushintsha ngaphambi kwesibili, i-pod ngokwayo iyahumusha.

Bese ususa i-pod ye-VPN futhi uphinde ukuhlolo lapho ihlelwa kabusha. Indlela egciniwe ephukayo lapho kuxoshwa ayiphelele, futhi nomthetho we-NAT obhaqwe ekhelini elingasekho unjalo. Ekugcineni, thumela isicelo esisodwa kumthombo okulindele ukuthi unqatshwe futhi uqinisekise ukuthi ukunqatshwa kuvela kunqubomgomo hhayi emzileni ongekho.