Ukushintsha iphuli elizenzakalelayo le-Docker akukubhalisi kabusha amanethiwekhi

Ukushintsha default-address-pools akukubhalisi kabusha amanethiwekhi onawo kakade, futhi ukulindela lokho yikho okwenza uhlelo olunakekile luphenduke ukuphazamiseka okungalindelekile. Lesi silungiselelo silawula ukwabiwa okuzenzakalelayo kwamanethiwekhi adalwa ngemva kokuthi i-daemon iqale kabusha ngesakhiwo esisha. Konke osekuvele kusebenza kugcina i-subnet eyanikezwa yona, ngoba leyo subnet iyingxenye yencazelo egciniwe yenethiwekhi. Inganekwane ilula ngoba iphakamisa ukuthi ukuhlela okukodwa kulungisa konke ukuxabana, kanti iqiniso umsebenzi wezingxenye ezimbili: khetha ibanga elikhululekile ngempela, bese ufudusa amanethiwekhi angenjalo.

Inganekwane: ukushintsha iphuli kanye kulungisa ukuxabana

Inganekwane inesimo esithile. Othile ufunda ukuthi iphuli elizenzakalelayo le-Docker lingashintshwa, alishintshe, aqale kabusha i-daemon futhi aphethe ngokuthi inethiwekhi yamakhontheyna ayisashayisani ne-VPN yasehhovisi. Inethiwekhi endala isikhona, isaxhunyiwe futhi isabambe ikheli elishayisanayo.

Okwashintshayo ukuziphatha kwesikhathi esizayo komabi, okusizuzisa ngempela futhi okukhawulelwe ngempela. Amanethiwekhi amasha adalwe ngaphandle kwe---subnet ecacile asikwa kuphuli elisha; lawo akhona awakaze abe kulelo phuli. Ukuqala kabusha akukhi kabusha amanethiwekhi futhi akuhambisi amakhontheyna phakathi kwawo. Uma uphawu luqhubeka ngemva koshintsho, ushintsho lwalungokoqobo futhi ukuxilongwa kwakungaphelele.

Ibanga eliyisisekelo kanye nesiqalo esabiwe

Isakhiwo sinezinkambu ezimbili okulula ukuzidida. base yibanga umabi asika kulo, futhi size ubude besiqalo senethiwekhi ngayinye eyabiwe, ngakho isisekelo esingu-10.10.0.0/16 esinosayizi 24 sabela /24 ngaphakathi kwalelo /16. Ukushintsha izindima kukhiqiza iphethini yokwaba obekungayilindele, ngokuvamile inethiwekhi eyodwa enkulu kakhulu noma iphuli eliphelile.

Iphuli liwukubekela eceleni, hhayi ubufakazi. I-Docker igwema ukungqubuzana ekubona kuthebula lomzila womsingathi, futhi ayikwazi ukubona i-VPN ongakaxhumani nayo.

Lowo mkhawulo uyisizathu sonke sokukhetha ngamabomu. Amabanga okufaniswa nawo yilawo umsingathi okufanele afinyelele kuwo: i-LAN yasehhovisi, ama-subnet angaphakathi e-VPN yenkampani, iziqalo zelabhu noma ze-staging, nanoma yimuphi omunye umsingathi wamakhontheyna kuleyo overlay efanayo. Zibhale njenge-CIDR ngaphambi kokuthinta i-daemon, ngoba uhlu olusekhanda luzokweqa yilo olubalulekile. Bese ukhetha isisekelo esingahlangani nanoma yiliphi kulawo, futhi gcina uhlu kanye nokuthunyelwa ukuze umuntu olandelayo angaphindi umsebenzi wokuzilolonga ngokukhumbula.

Bhala uhlu ngaphambi kokukhetha

Qala ngokubhala uhlu lwalokho okukhona. docker network ls ibala amanethiwekhi, futhi docker network inspect bridge -f '{{.IPAM.Config}}' iphrinta i-subnet esetshenziswa inethiwekhi ethile. Phinda lokhu kunethiwekhi ngayinye echazwe umsebenzisi, ngoba amaphrojekthi e-Compose akha awe wona futhi i---subnet ecacile kufayela le-compose yeqa iphuli ngokuphelele.

Lelo phuzu lokugcina liyona into ephila ngisho ngemva kokufuduka. Ukushintsha iphuli akuvimbeli uzakwethu ukuthi afake 172.18.0.0/16 kufayela le-compose, futhi ukungqubuzana kubuya nomunye umbhali.

Ukufudusa okukhona kakade

Ukufudusa amanethiwekhi akhona kuwumsebenzi ohlukile nosekelwe. Inethiwekhi ngayinye ethintekile kufanele idalwe kabusha nge-subnet entsha, okusho ukuxhoma nokuxhuma kabusha amakhontheyna ayisebenzisayo, futhi ukudala kabusha inethiwekhi kususa okuxhunyiwe kwamakhontheyna esikhundleni kokukuhambisa. Gcina amavolumu nesakhiwo futhi ubheke ukudala kabusha njengokuthunyelwa, hhayi njengokusetha kabusha idatha. Yenza umsebenzi efasiteleni lokunakekela, ngoba amakhontheyna kunethiwekhi edalwe kabusha aqala kabusha noma ngabe wawukuhlelile noma cha.

Landela isakhiwo se-daemon esibhaliwe kanye nenqubo yokuqala kabusha, futhi uxhumanise ukuphazamiseka. Kumsingathi onedemon eyodwa, systemctl restart docker iqala kabusha amakhontheyna ngokwezinqubomgomo zawo zokuqala kabusha, futhi lokho kuwukuziphatha okufanele kwaziwe ngaphambili hhayi ngemuva.

Bese uqinisekisa izinto ezimbili okwakufanele ushintsho luzilungise. Hlola i-subnet entsha nge-docker network inspect futhi uqinisekise ukuthi isingaphakathi kwesisekelo esikhethiwe, bese uhlola umzila oya endaweni emele i-VPN nge-ip route get 10.20.30.40 futhi uqinisekise ukuthi uya lapho okulindele khona, hhayi ebhulohweni. Hlola futhi ukutholakala kwezinsizakalo nokuxhumana phakathi kwamakhontheyna, ngoba inethiwekhi edalwe kabusha ngamakheli ahlukile ingaphula ukuxazululwa kwamagama ngezindlela ezibonakala njengephutha lohlelo.

Yini esalokhu yephuka ngemuva kwalokho

Ingxenye ehlala njalo umbhalo. Gcina uhlu lokwabiwa, isisekelo nosayizi abakhethiwe, kanye namanethiwekhi adalwe kabusha endaweni efanayo nokuthunyelwa.

Ukuthi ibanga liyimfihlo akukwenzi kuphephe ukusetshenziswa futhi. 10.0.0.0/8 liyimfihlo futhi ngesikhathi esifanayo yinto okungenzeka kakhulu ukuthi isivele isetshenziswa kwenye indawo emzileni, yingakho impendulo iwukubekelwa eceleni okuthile hhayi ukuthanda ibhloko elilodwa. Imibhalo yenethiwekhi ye-Docker ichaza ukwabiwa kwe-subnet okuzenzakalelayo kanye nezinkambu zephuli. Khetha ibanga ngokwalokho okufanele ufinyelele kukho, hhayi ngokwalokho okubukeka kucwebe.