docs/v1.13.x/guide/vpc/

[giscus[bot]]

docs/v1.13.x/guide/vpc/

None

https://kubeovn.github.io/docs/v1.13.x/guide/vpc/

[kldancer]

请问VCP网关需要配置的外部网络的网卡，能和Underlay网络的业务网卡复用吗？

[zbb88888]

可以

[zbb88888]

iptables 那个 vpc nat 网关是基于 macvlan 的， underlay 网络也用 macvlan 就行

[zbb88888]

kubeovn 的 underlay 网络是基于 ovs 网桥的，我理解不能和 macvlan 用同一张网卡了

[kldancer]

验证了一下，应该是可行的。有物理网卡ens5f1。分别创建物理网络、外部网络都指定该网卡。物理网络使用配置好的vlan 800网段创建子网、外部网络使用配置好的vlan 400 网段创建子网。

结果：物理网络为ens5f1网卡在ovs网桥创建端口；macvlan外部网络也为ensf51网卡创建vlan子网卡ensf51.400，并且将该子网卡的macvlan子设备放入nat-gw pod。

[root@node152 ~]#  ip a | grep ens5f1 
11: ens5f1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq master ovs-system state UP group default qlen 1000
7539: ens5f1.400@ens5f1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default 
7804: br-ens5f1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000
[root@node152 ~]# nerdctl exec -it ba390bd4e21d -- bash -c "ovs-vsctl show | grep ens5f1"
    Bridge br-ens5f1
        Port br-ens5f1
            Interface br-ens5f1
        Port ens5f1
            Interface ens5f1
[root@node152 ~]# kubectl get subnets.kubeovn.io net-yl6lged4  -o=jsonpath='{.spec}'
{"cidrBlock":"172.80.0.0/24","default":false,"disableGatewayCheck":true,"enableLb":true,"excludeIps":["172.80.0.1"],"gateway":"172.80.0.1","gatewayNode":"","gatewayType":"distributed","natOutgoing":false,"private":false,"protocol":"IPv4","provider":"net-yl6lged4.kube-system.ovn","vlan":"pn-chnxitug-vlan800","vpc":"ovn-cluster"}[root@node152 ~]# 
[root@node152 ~]# 
[root@node152 ~]# 
[root@node152 ~]# kubectl get network-attachment-definitions.k8s.cni.cncf.io -n kube-system net-1jhtyyb9  -o=jsonpath='{.spec}'
{"config":"{\"cniVersion\":\"0.3.0\",\"ipam\":{\"provider\":\"net-1jhtyyb9.kube-system\",\"server_socket\":\"/run/openvswitch/kube-ovn-daemon.sock\",\"type\":\"kube-ovn\"},\"master\":\"ens5f1.400\",\"mode\":\"bridge\",\"type\":\"macvlan\"}"}[root@node152 ~]# 
[root@node152 ~]# kubectl get subnets.kubeovn.io net-1jhtyyb9 -o=jsonpath='{.spec}'
{"cidrBlock":"172.40.0.0/24","default":false,"enableLb":true,"excludeIps":["172.40.0.1"],"gateway":"172.40.0.1","gatewayNode":"","gatewayType":"distributed","natOutgoing":false,"private":false,"protocol":"IPv4","provider":"net-1jhtyyb9.kube-system"}[root@node152 ~]# 

联通性：使用物理网络的容器，或者在外部均能够通过EIP访问到自定义VPC容器。

# 外部访问EIP访问目的自定义VPC pod
[root@node152 ~]# ssh [email protected] 
[email protected]'s password: 
Activate the web console with: systemctl enable --now cockpit.socket

Last login: Fri Nov 22 10:44:27 2024 from 10.210.20.152
[root@y-y1 ~]# ip a 
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1400 qdisc mq state UP group default qlen 1000
    link/ether 00:00:00:06:8d:d8 brd ff:ff:ff:ff:ff:ff
    inet 100.64.0.2/16 brd 100.64.255.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::200:ff:fe06:8dd8/64 scope link 
       valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1400 qdisc mq state UP group default qlen 1000
    link/ether 00:00:00:ea:43:c8 brd ff:ff:ff:ff:ff:ff
    inet 40.40.1.7/24 brd 40.40.1.255 scope global dynamic eth1
       valid_lft 86255596sec preferred_lft 86255596sec
    inet6 fe80::200:ff:feea:43c8/64 scope link 
       valid_lft forever preferred_lft forever
# 自定义VPC pod内访问underlay网络pod
[root@y-y1 ~]# ping 172.80.0.2 
PING 172.80.0.2 (172.80.0.2) 56(84) bytes of data.
64 bytes from 172.80.0.2: icmp_seq=1 ttl=62 time=3.61 ms
64 bytes from 172.80.0.2: icmp_seq=2 ttl=62 time=2.66 ms
^C
--- 172.80.0.2 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1002ms
rtt min/avg/max/mdev = 2.655/3.130/3.606/0.478 ms

# underlay pod内收到正确的抓包
[root@y-u1 ~]# tcpdump -i any icmp -envvv 
dropped privs to tcpdump
tcpdump: listening on any, link-type LINUX_SLL (Linux cooked v1), capture size 262144 bytes
11:07:42.255634  In 48:73:97:2c:0e:5e ethertype IPv4 (0x0800), length 100: (tos 0x0, ttl 61, id 19864, offset 0, flags [DF], proto ICMP (1), length 84)
    172.40.0.2 > 172.80.0.2: ICMP echo request, id 2585, seq 1, length 64
11:07:42.255698 Out 00:00:00:12:b3:73 ethertype IPv4 (0x0800), length 100: (tos 0x0, ttl 64, id 35401, offset 0, flags [none], proto ICMP (1), length 84)
    172.80.0.2 > 172.40.0.2: ICMP echo reply, id 2585, seq 1, length 64

[zbb88888]

ok, macvlan 用的字接口