069、Calico的默认连通性（2019-04-12 周五）-白红宇

069、Calico的默认连通性（2019-04-12 周五）

阅读量：6959 次

发布时间：2019-06-27

本文共 2758 字，大约阅读时间需要 9 分钟。

参考

Calico 跨主机连通性测试

root@host1:~# docker exec bbox1 ping -c 2 bbox2
      PING bbox2 (192.168.183.64): 56 data bytes 
      64 bytes from 192.168.183.64: seq=0 ttl=62 time=0.433 ms 
      64 bytes from 192.168.183.64: seq=1 ttl=62 time=0.322 ms 
      --- bbox2 ping statistics --- 
      2 packets transmitted, 2 packets received, 0% packet loss 
      round-trip min/avg/max = 0.322/0.377/0.433 ms 
root@host1:~# docker exec bbox1 ip r
      default via 169.254.1.1 dev cali0    
①
      169.254.1.1 dev cali0 scope link 
root@host1:~# ip r
      default via 10.12.28.6 dev ens160 onlink 
      10.2.46.0/24 dev docker0  proto kernel  scope link  src 10.2.46.1 linkdown 
      10.12.28.0/22 dev ens160  proto kernel  scope link  src 10.12.31.211 
      172.22.0.0/16 via 10.12.28.1 dev ens160 
      192.168.119.0 dev cali129890bc0f3  scope link 
      blackhole 192.168.119.0/26  proto bird 
      192.168.183.64/26 via 10.12.31.212 dev ens160  proto bird    
②
root@host2:~# ip r
      default via 10.12.28.6 dev ens160 onlink 
      10.2.44.0/24 dev docker0  proto kernel  scope link  src 10.2.44.1 linkdown 
      10.12.28.0/22 dev ens160  proto kernel  scope link  src 10.12.31.212 
      172.22.0.0/16 via 10.12.28.1 dev ens160 
      192.168.119.0/26 via 10.12.31.211 dev ens160  proto bird 
      192.168.183.64 dev calicb5d10d0884  scope link    
③
      blackhole 192.168.183.64/26  proto bird 

root@host1:~# docker network create --driver calico --ipam-driver calico-ipam cal_net2
      cca5ff37f60dc4f6096388ef4d20b5222c8cef32dd9bc0e389f71dd8776a7fdd 
root@host1:~# docker run -itd --name bbox3 --network cal_net2 busybox
      9c942b23532a9a42a6be216b2f7b7b047814f327607a88ce8e54e05c00397cb4 
root@host1:~# docker exec bbox3 ip a
      1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1 
          link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 
          inet 127.0.0.1/8 scope host lo 
             valid_lft forever preferred_lft forever 
      9: cali0@if10: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue 
          link/ether ee:ee:ee:ee:ee:ee brd ff:ff:ff:ff:ff:ff 
          inet 192.168.119.1/32 brd 192.168.119.1 scope global cali0 
             valid_lft forever preferred_lft forever 
root@host1:~# docker exec bbox1 ping -c 2 192.168.119.1
      PING 192.168.119.1 (192.168.119.1): 56 data bytes 
      --- 192.168.119.1 ping statistics --- 
      2 packets transmitted, 0 packets received, 100% packet loss 

calico 默认的 policy 规则是：容器只能与同一个calico网络中的容器通信，即使两个容器在同一个 host 上也不行

查看calico网络policy，如果calico的配置文件在默认位置（

/etc/calico/calicoctl.cfg），在使用calico命令的时候可以省略指定--config

root@host1:~# calicoctl get profile cal_net1 -o yaml --config /etc/calicoctl.cfg
      - apiVersion: v1 
        kind: profile 
        metadata: 
          name: cal_net1 
          tags: 
          - cal_net1 
        spec: 
          egress:    
#    出方向，allow any to any
          - action: allow 
            destination: {} 
            source: {} 
          ingress:    
#    进方向，allow cal_net1 to any (这里的any只有cal_net1网络)，也就是 allow cal_net1 to cal_net1
          - action: allow 
            destination: {} 
            source: 
              tag: cal_net1 