Kungani ama-pod e-GKE engakwazi ukufinyelela amahost endawo nge-VPN

I-ping isebenza isuka ku-node futhi yehluleka isuka ku-pod, futhi akukho okufika endaweni. I-tunnel nomzila kulungile; ikheli lomthombo ocingweni alilungile. Okuhlukanisa lezi zimo ezimbili yilokho iphakethe elizisho ngakho lapho lishiya iqoqo, futhi i-GKE inombono ngalokho. Indlela iwuhlu lwemikhutho ye-masquerade, futhi ukulufunda kuthatha umyalo owodwa.

Funda uhlu olusebenzayo ngaphambi kokushintsha noma yini

I-GKE ihlinzeka nge-ejenti enquma, ngokwebanga lendawo ngayinye, ukuthi ithrafikhi ye-pod ibhalwe kabusha yini ikheli le-node lapho iphuma. Ukulungiselelwa kwayo okuhlinzekiwe kubiza amabhulokhi amathathu e-RFC1918, 10.0.0.0/8, 172.16.0.0/12 ne-192.168.0.0/16, njengezindawo ezingafakiwe. Ngakho-ke konke okuthumelayo kusuka ku-pod kuye kuhost yendawo ye-10.x kushiya i-node ikheli le-pod ngokwalo lisanamathele. Ithrafikhi ye-node ngokwayo ayibhalwa kabusha, futhi yikho kanye okwenza i-ping yayo isebenze.

Funda ukulungiselelwa okuhlosiwe nemithetho efakiwe, ngoba kungase kungavumelani. kubectl -n kube-system get configmap ip-masq-agent -o yaml kukhombisa okwatshelwa i-ejenti, futhi kubectl -n kube-system get pods -l k8s-app=ip-masq-agent kukhombisa ukuthi kukhona yini okusebenzayo ukuze kusetshenziswe. Ku-node, iptables-save | grep -i masq kukhombisa imithetho ekhona ngempela ku-kernel. Lapho i-ConfigMap isho okukodwa futhi imithetho isho okunye, umsoliswa yi-ejenti hhayi inethiwekhi.

Qinisekisa ikheli lomthombo ngokubamba

Yenza ukubamba ngaphambi kokushintsha uhlu. Isihlungi endaweni eyodwa sigcina okukhishiwe kufundeka: tcpdump -ni any host 10.20.30.40.

Qhathanisa lokho nalokho okubikwa uhlangothi olude. Ukubamba endaweni ekhombisa ikheli le-pod futhi kungabikho impendulo kuvala indingilizi: uhlu lwemikhutho luchaza ukungalingani ngaphandle kwanoma yiluphi ukwehluleka kwe-tunnel. Ukubona kabili ikheli lomthombo elilodwa kwanele ukuyeka ukuqagela nge-CNI.

Nciphisa umkhutho uye ku-CIDR ye-pod

Ukulungiswa okusekelwayo kunciphisa umkhutho esikhundleni sokuwususa: gcina i-CIDR ye-pod ingafakiwe futhi ushiye ingxenye esele yesikhala se-10.x. Lolo hlu lukhona ku-ConfigMap ye-ejenti ngaphansi kwe-nonMasqueradeCIDRs, futhi ukulushintsha ukuhlela okulandelwa ukusatshalaliswa. Shintsha okufakiwe okubanzi ngobubanzi bangempela be-pod beqoqo, gcina amanye amabhulokhi ayimfihlo uma ithrafikhi engaphakathi kweqoqo isawadinga, futhi ushiye resyncInterval njengoba kunjalo ngaphandle uma unesizathu. Kusebenzise, qinisekisa ukuthi ama-pod e-ejenti aqale kabusha, futhi uqinisekise ukuthi imithetho ye-kernel ishintshile.

Lokhu ukushintsha kweqoqo lonke elinomthelela wangempela. Uma sekusebenza, ithrafikhi eyayigcina umthombo wayo we-pod manje ifika ibhalwe kabusha ku-node, ngakho konke okwakuncike kulawo makheli e-pod kubona umthumeli ohlukile. Izisulu imibhalo, izinhlu zemvume nemithetho ye-firewall yendawo ebiza amakheli e-pod, futhi yehluleka ngokuthula. Memezela ushintsho njengoshintsho lokuziphatha, hhayi njengokulungisa.

Kwiqoqo elinamachibi amaningi e-node, hlola ukuthi i-ejenti ihlelwe kuma-node lapho ama-pod athintekile asebenza khona ngempela. Ichibi elingenayo i-DaemonSet ligcina imithetho yalo emidala, futhi akukho lutho ku-ConfigMap oluzokukhombisa lokho.

Enye indlela kanye nezindleko zayo

Enye inketho igcina amakheli e-pod engashintshiwe futhi ifundisa umzila ngawo. I-CIDR ye-pod ingena kuzikhethi zethrafikhi ze-Cloud VPN, futhi uhlangothi lwendawo ludinga umzila wokubuyela ukuze izimpendulo zazi lapho ziya khona. Lokho kugcina ubunikazi be-pod, obufunwa amamodeli athile ezokuphepha, futhi kwandisa kokubili ububanzi bomzila nobubanzi be-firewall okufanele uhlangothi olude lukwamukele.

Ukuhwebelana ukufundeka ngokumelene nobubanzi. Ukuhumusha kwenza uhlangothi lwendawo lubone ikheli elilodwa nge-node ngayinye, okulula ukukufaka ohlwini lwemvume futhi kufihla ukuthi iyiphi i-pod ethumele ini. Ngaphandle kokuhumusha, ikheli le-pod ligcinwa kusukela ekugcineni kuya ekugcineni, okungcono ekwabiweni futhi kubi kudivayisi ngayinye emzileni okufanele ifunde ibanga elisha. Akukho nketho eyiphutha le-Docker noma le-CNI; zombili izinqumo zomzila ezinebhili lokusebenza. Khetha leyo ibhili layo ithimba lakho elingayikhokha, futhi ubhale ukuthi kungani.

Qinisekisa futhi uhlehle

Gijima futhi ukubamba okufanayo. Ukubamba kwezinga le-node okusaphrinta ikheli le-pod ngemva kokuhlela kwakho kusho ukuthi imithetho ayikaze ishintshe, noma i-ConfigMap ithini. Ucingo luqobo; konke okunye ukucabanga.

Bese uhlola isiqondiso esiphambene, ngoba uhhafu walezi zinguquko uqinisekiswa ngaphandle kuphela. Qinisekisa ukuthi impendulo ifinyelela i-node noma i-pod ethumele isicelo, futhi uqinisekise ukuthi uhlelo lwephothi lwaqeda esikhundleni sokuthola i-SYN kuphela. Ukubamba okukhombisa isicelo ngaphandle kwempendulo kuyinkinga yomzila ohlangothini olude, hhayi inkinga ye-masquerade kulolu hlangothi.

Ukuhlehlisa i-ConfigMap yangaphambili, isetshenziswe ngendlela efanayo, ngesiqinisekiso esifanayo sokuthi i-ejenti iqale kabusha futhi imithetho yashintsha. Gcina ikheli lomthombo ngaphambi nangemva kwesicelo esisodwa esaziwayo kurekhodi loshintsho, ngoba lowo mugqa owodwa uyiwona ofakazayo ukuthi ushintsho lwenze okushilo. Umhlahlandlela we-GKE we-ejenti ye-IP masquerade ubhala okungokwemvelo nezinkambu ze-ConfigMap. Uma ikheli lomthombo lingashintshile ngemva kokusatshalaliswa, i-ejenti ayisebenzi kuleyo node futhi akukho ukuhlela kwe-YAML okuzokulungisa.