067、如何部署Calico网络 （2019-04-10 周三）

参考https://www.cnblogs.com/CloudMan6/p/7509975.html

 

Calico 是一个纯三层的虚拟网络方案，Calico为每个容器分配一个IP，每个host都是router，把不同host的容器连接起来。与vxlan不同的是，Calico不对数据包做额外封装，不需要NAT和端口映射，扩展性和性能都很好。

 

与其他容器网络方案相比，Calico还有一大优势：network policy。用户可以动态定义CAL规则，控制进出容器的数据包，实现业务需求。

 

实验环境描述

 

Calico依赖etcd在不同主机间共享和交换信息，存储Calico网络状态。我们将在10.12.31.213 上运行etcd。

 

Calico网络中的每个主机都需要运行Calico组件，提供容器interface管理、动态路由、动态CAL、报告状态等功能

 

    host1    10.12.31.211 

    host2    10.12.31.212

    etcd      10.12.31.213

 

 

#    1、启动etcd数据库

 

[root@etcd ~]# etcd -listen-client-urls http://10.12.31.213:2379 -advertise-client-urls http://10.12.31.213:2379 &

 

#    2、修改 host1 和 host2 Docker daemon 配置文件

 

root@host1:~# cat /etc/systemd/system/docker.service.d/10-machine.conf

[Service]

ExecStart=

ExecStart=/usr/bin/dockerd -H tcp://0.0.0.0:2376 -H unix:///var/run/docker.sock --storage-driver overlay2 --tlsverify --tlscacert /etc/docker/ca.pem --tlscert /etc/docker/server.pem --tlskey /etc/docker/server-key.pem --label provider=generic --cluster-store=etcd://10.12.31.213:2379

Environment=

root@host1:~# systemctl daemon-reload

root@host1:~# systemctl restart docker.service

 

root@host2:~# cat /etc/systemd/system/docker.service.d/10-machine.conf

[Service]

ExecStart=

ExecStart=/usr/bin/dockerd -H tcp://0.0.0.0:2376 -H unix:///var/run/docker.sock --storage-driver overlay2 --tlsverify --tlscacert /etc/docker/ca.pem --tlscert /etc/docker/server.pem --tlskey /etc/docker/server-key.pem --label provider=generic  --cluster-store=etcd://10.12.31.213:2379

Environment=

root@host2:~# systemctl daemon-reload

root@host2:~# systemctl restart docker.service

 

#    3、在 host1 和 host2 上安装 Calico

 

root@host1:~# wget -O /usr/local/bin/calicoctl https://github.com/projectcalico/calicoctl/releases/download/v1.0.2/calicoctl

root@host1:~# chmod +x /usr/local/bin/calicoctl

 

root@host2:~# wget -O /usr/local/bin/calicoctl https://github.com/projectcalico/calicoctl/releases/download/v1.0.2/calicoctl

root@host2:~# chmod +x /usr/local/bin/calicoctl

 

#    4、在 host1 和 host2 上启动 Calico

 

root@host1:~# cat /etc/calicoctl.cfg

apiVersion: v1

kind: calicoApiConfig

metadata:

spec:

  datastoreType: "etcdv2"

  etcdEndpoints: http://10.12.31.213:2379

 

root@host1:~# calicoctl node run --config=/etc/calicoctl.cfg

Running command to load modules: modprobe -a xt_set ip6_tables

Enabling IPv4 forwarding    #    开始host上的路由转发功能

Enabling IPv6 forwarding

Increasing conntrack limit

Removing old calico-node container (if running).

Running the following command to start calico-node:

    

    #   下载并启动calico-node容器，calico会以容器的形式运行（与weave类似） 

docker run --net=host --privileged --name=calico-node -d --restart=always -e NO_DEFAULT_POOLS= -e CALICO_LIBNETWORK_ENABLED=true -e CALICO_LIBNETWORK_IFPREFIX=cali -e ETCD_ENDPOINTS=http://10.12.31.213:2379 -e ETCD_AUTHORITY= -e ETCD_SCHEME= -e NODENAME=host1 -e CALICO_NETWORKING_BACKEND=bird -v /var/run/docker.sock:/var/run/docker.sock -v /var/run/calico:/var/run/calico -v /lib/modules:/lib/modules -v /var/log/calico:/var/log/calico -v /run/docker/plugins:/run/docker/plugins calico/node:v1.0.2

 

Image may take a short time to download if it is not available locally.

Container started, checking progress logs.

Waiting for etcd connection...    #    连接etcd数据库

Using auto-detected IPv4 address: 10.12.31.211

No IPv6 address configured

Using global AS number

Calico node name:  host1

CALICO_LIBNETWORK_ENABLED is true - start libnetwork service

Calico node started successfully    #    calico启动成功

 

root@host2:~# cat /etc/calicoctl.cfg

apiVersion: v1

kind: calicoApiConfig

metadata:

spec:

  datastoreType: "etcdv2"

  etcdEndpoints: http://10.12.31.213:2379

root@host2:~# calicoctl node run --config=/etc/calicoctl.cfg

Running command to load modules: modprobe -a xt_set ip6_tables

Enabling IPv4 forwarding

Enabling IPv6 forwarding

Increasing conntrack limit

Removing old calico-node container (if running).

Running the following command to start calico-node:

 

docker run --net=host --privileged --name=calico-node -d --restart=always -e NODENAME=host2 -e CALICO_NETWORKING_BACKEND=bird -e NO_DEFAULT_POOLS= -e CALICO_LIBNETWORK_ENABLED=true -e CALICO_LIBNETWORK_IFPREFIX=cali -e ETCD_ENDPOINTS=http://10.12.31.213:2379 -e ETCD_AUTHORITY= -e ETCD_SCHEME= -v /var/run/calico:/var/run/calico -v /lib/modules:/lib/modules -v /var/log/calico:/var/log/calico -v /run/docker/plugins:/run/docker/plugins -v /var/run/docker.sock:/var/run/docker.sock calico/node:v1.0.2

 

Image may take a short time to download if it is not available locally.

Container started, checking progress logs.

Waiting for etcd connection...

Using auto-detected IPv4 address: 10.12.31.212

No IPv6 address configured

Using global AS number

Calico node name:  host2

CALICO_LIBNETWORK_ENABLED is true - start libnetwork service

Calico node started successfully

 

#    5、创建calico网络

 

--driver calico    #    指定使用calico的libnetwork CNM driver

--ipam-driver calico-ipam    #    指定使用calico的IPAM driver管理IP

calico网络为global网络，会自动同步到所有主机

 

root@host1:~# docker network create --driver calico --ipam-driver calico-ipam cal_net1

22fd17cb2e0db50e8ad40b3f1687e40baf26b6f1a16d0486ba6afa4e4cd37291

root@host1:~# docker network ls

NETWORK ID          NAME                DRIVER              SCOPE

29c9c519a9cf        bridge              bridge              local

22fd17cb2e0d        cal_net1            calico              global

bb03f7574aa2        host                host                local

d60df792c936        mac_net1            macvlan             local

884e50ddfb92        mac_net10           macvlan             local

c402380a197d        mac_net20           macvlan             local

11e39328a6d1        none                null                local

root@host1:~# docker ps -a

CONTAINER ID        IMAGE                COMMAND             CREATED             STATUS              PORTS               NAMES

f80b34d63a07        calico/node:v1.0.2   "start_runit"       12 minutes ago      Up 12 minutes                           calico-node

 

root@host2:~# docker network ls

NETWORK ID          NAME                DRIVER              SCOPE

14ff2235fb9c        bridge              bridge              local

22fd17cb2e0d        cal_net1            calico              global

cf4c89650a1f        host                host                local

39f1aab9f5b8        mac_net1            macvlan             local

a90d23d941a9        mac_net10           macvlan             local

d73128405403        mac_net20           macvlan             local

2f7d79e0114d        none                null                local

root@host2:~# docker ps -a

CONTAINER ID        IMAGE                COMMAND             CREATED             STATUS              PORTS               NAMES

428c6c975c73        calico/node:v1.0.2   "start_runit"       6 minutes ago       Up 6 minutes                            calico-node