k8s: calico学习
点朗读开始；播放中可点段落跳转。屏幕默认常亮。
常用命令
root@k8smaster:/home/ubuntu# ip netns exec ns1 ip route add 169.254.1.1 dev veth1-ns1 scope link# 创建名称空间
ip netns ad ns1
ip netns ad ns2
# 查询
ip netns
# 创建成对网卡 veth1 是名字 ，类型：veth peer， 另外一个叫veth1-ns1
ip link add veth1 type veth peer name veth1-ns1
ip link add veth2 type veth peer name veth2-ns2
# 将网卡放到名称空间
ip link set veth1-ns1 netns ns1
ip link set veth2-ns2 netns ns2
# 查看
root@k8smaster:/home/ubuntu# ip netns
ns2
ns1 (id: 5)
root@k8smaster:/home/ubuntu# ip netns exec ns1 ip a
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
588: veth1-ns1@if589: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
link/ether fa:fb:a4:73:11:3d brd ff:ff:ff:ff:ff:ff link-netnsid 0
# 添加ip
root@k8smaster:/home/ubuntu# ip netns exec ns1 ip addr add 192.168.100.101/32 dev veth1-ns1
#删除ip
ip netns exec ns1 ip addr del 192.168.100.101/32 dev veth1-ns1
# 查看
root@k8smaster:/home/ubuntu# ip netns exec ns1 ip a
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
588: veth1-ns1@if589: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN (注意这里) group default qlen 1000
link/ether fa:fb:a4:73:11:3d brd ff:ff:ff:ff:ff:ff link-netnsid 0
inet 192.168.100.102/32 scope global veth1-ns1
valid_lft forever preferred_lft forever
# 开启网卡
root@k8smaster:/home/ubuntu# ip netns exec ns1 ip link set veth1-ns1 up
root@k8smaster:/home/ubuntu# ip netns exec ns1 ip a
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
588: veth1-ns1@if589: <NO-CARRIER,BROADCAST,MULTICAST,UP（注意这里）> mtu 1500 qdisc noqueue state LOWERLAYERDOWN group default qlen 1000
link/ether fa:fb:a4:73:11:3d brd ff:ff:ff:ff:ff:ff link-netnsid 0
inet 192.168.100.102/32 scope global veth1-ns1
valid_lft forever preferred_lft forever
# 没有路由表
root@k8smaster:/home/ubuntu# ip netns exec ns1 route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
#设置路由
root@k8smaster:/home/ubuntu# ip netns exec ns1 ip route add 169.254.1.1 dev veth1-ns1 scope link
root@k8smaster:/home/ubuntu# ip netns exec ns1 ip route add default via 169.254.1.1 dev veth1-ns1
root@k8smaster:/home/ubuntu# ip netns exec ns1 route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 169.254.1.1 0.0.0.0 UG 0 0 0 veth1-ns1
169.254.1.1 0.0.0.0 255.255.255.255 UH 0 0 0 veth1-ns1
root@k8smaster:/home/ubuntu# ip netns exec ns1 arp -n
# 开启宿主机网卡
root@k8smaster:/home/ubuntu# ip link set veth1 up
# 开启内核路由表转发功能
root@k8smaster:/home/ubuntu# sysctl -w net.ipv4.ip_forward=1
# 在host上设置回复的路由
root@k8smaster:/home/ubuntu# ip route add 192.168.100.101/32 dev veth1
root@k8smaster:/home/ubuntu# ip route add 192.168.100.102/32 dev veth2
root@k8smaster:/home/ubuntu# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 10.0.0.1 0.0.0.0 UG 100 0 0 eth0
10.0.0.0 0.0.0.0 255.255.252.0 U 100 0 0 eth0
10.0.0.1 0.0.0.0 255.255.255.255 UH 100 0 0 eth0
183.60.82.98 10.0.0.1 255.255.255.255 UGH 100 0 0 eth0
183.60.83.19 10.0.0.1 255.255.255.255 UGH 100 0 0 eth0
192.168.16.128 0.0.0.0 255.255.255.192 U 0 0 0 *
192.168.16.129 0.0.0.0 255.255.255.255 UH 0 0 0 cali4eecddba221
192.168.16.130 0.0.0.0 255.255.255.255 UH 0 0 0 caliaf2f6408e43
192.168.16.131 0.0.0.0 255.255.255.255 UH 0 0 0 cali26c87924cc6
192.168.16.132 0.0.0.0 255.255.255.255 UH 0 0 0 calif6389fdb26f
192.168.16.133 0.0.0.0 255.255.255.255 UH 0 0 0 cali0ffef0b6a88
192.168.16.143 0.0.0.0 255.255.255.255 UH 0 0 0 cali9b56937c9a7
192.168.16.144 0.0.0.0 255.255.255.255 UH 0 0 0 calid23e67a6b1e
192.168.16.145 0.0.0.0 255.255.255.255 UH 0 0 0 cali8208dc633f1
192.168.16.150 0.0.0.0 255.255.255.255 UH 0 0 0 cali5447d0b9da1
192.168.16.157 0.0.0.0 255.255.255.255 UH 0 0 0 cali7f073a73da3
192.168.16.180 0.0.0.0 255.255.255.255 UH 0 0 0 caliab06f9d637f
192.168.16.181 0.0.0.0 255.255.255.255 UH 0 0 0 cali3b92b99dfb5
192.168.16.184 0.0.0.0 255.255.255.255 UH 0 0 0 cali03bdae8f4b7
192.168.100.101 0.0.0.0 255.255.255.255 UH 0 0 0 veth1
192.168.100.102 0.0.0.0 255.255.255.255 UH 0 0 0 veth2
root@k8smaster:/home/ubuntu# ip netns exec ns1 ping 192.168.100.102 # 不通
PING 192.168.100.102 (192.168.100.102) 56(84) bytes of data.
^C
--- 192.168.100.102 ping statistics ---
16 packets transmitted, 0 received, 100% packet loss, time 15365ms
root@k8smaster:/home/ubuntu# ip netns exec ns1 arp -n
Address HWtype HWaddress Flags Mask Iface
169.254.1.1 (incomplete) （不完整） veth1-ns1
# 广播无应答
root@k8smaster:/home/ubuntu# tcpdump -i veth1 -nn arp # 169.254.1.1 保留地址
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on veth1, link-type EN10MB (Ethernet), snapshot length 262144 bytes
09:38:55.488032 ARP, Request who-has 169.254.1.1 tell 192.168.100.101, length 28
09:38:56.549365 ARP, Request who-has 169.254.1.1 tell 192.168.100.101, length 28
09:38:57.573354 ARP, Request who-has 169.254.1.1 tell 192.168.100.101, length 28
09:38:58.597401 ARP, Request who-has 169.254.1.1 tell 192.168.100.101, length 28
09:38:59.621359 ARP, Request who-has 169.254.1.1 tell 192.168.100.101, length 28
09:39:00.645353 ARP, Request who-has 169.254.1.1 tell 192.168.100.101, length 28
09:39:01.670480 ARP, Request who-has 169.254.1.1 tell 192.168.100.101, length 28
09:39:02.693374 ARP, Request who-has 169.254.1.1 tell 192.168.100.101, length 28
09:39:03.717358 ARP, Request who-has 169.254.1.1 tell 192.168.100.101, length 28
09:39:04.741423 ARP, Request who-has 169.254.1.1 tell 192.168.100.101, length 28
09:39:05.765361 ARP, Request who-has 169.254.1.1 tell 192.168.100.101, length 28
09:39:06.789354 ARP, Request who-has 169.254.1.1 tell 192.168.100.101, length 28
# 原因是没有开启proxy
root@k8smaster:/home/ubuntu# cat /proc/sys/net/ipv4/conf/veth1/proxy_arp
0
root@k8smaster:/home/ubuntu# echo 1 > /proc/sys/net/ipv4/conf/veth1/proxy_arp
root@k8smaster:/home/ubuntu# echo 1 > /proc/sys/net/ipv4/conf/veth2/proxy_arp
root@k8smaster:/home/ubuntu# cat /proc/sys/net/ipv4/conf/veth1/proxy_arp
1
# 然后网络就通了
root@k8smaster:/home/ubuntu# ip netns exec ns1 ping 192.168.100.102
PING 192.168.100.102 (192.168.100.102) 56(84) bytes of data.
64 bytes from 192.168.100.102: icmp_seq=1 ttl=63 time=536 ms
64 bytes from 192.168.100.102: icmp_seq=2 ttl=63 time=0.059 ms
64 bytes from 192.168.100.102: icmp_seq=3 ttl=63 time=0.059 ms
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on veth1, link-type EN10MB (Ethernet), snapshot length 262144 bytes
09:43:30.149761 ARP, Request who-has 169.254.1.1 tell 192.168.100.101, length 28
09:43:30.557359 ARP, Reply 169.254.1.1 is-at 6a:f5:c0:53:3f:d1, length 28
^X09:43:36.037354 ARP, Request who-has 192.168.100.101 tell 10.0.0.4, length 28
09:43:36.037400 ARP, Reply 192.168.100.101 is-at fa:fb:a4:73:11:3d, length 28
路由讲解
root@k8smaster:/home/ubuntu# ip netns exec ns1 route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 169.254.1.1 0.0.0.0 UG 0 0 0 veth1-ns1
169.254.1.1 0.0.0.0 255.255.255.255 UH 0 0 0 veth1-ns1
- 直连路由（第二行）
169.254.1.1 0.0.0.0 255.255.255.255 UH 0 0 0 veth1-ns1
* 目的地址与掩码（169.254.1.1 / 255.255.255.255）：这代表一个具体的、精确的单个 IP（即 `/32` 掩码）。`169.254.x.x` 是 IPv4 的链路本地地址（Link-local）。
* 网关（0.0.0.0）：没有网关。这意味着该目标和当前网卡是直接相连的，不需要经过跳板。
* 标志 Flags（UH）：Up（路由有效）和 Host（目标是一个具体主机，而非网段）。
* 通俗解释：告诉系统：“`169.254.1.1` 这个地址就在 `veth1-ns1` 这根网线的另一端，有发往它的包，直接从这块网卡丢过去就行。”
- 默认网关路由（第一行）
0.0.0.0 169.254.1.1 0.0.0.0 UG 0 0 0 veth1-ns1
* 目的地址与掩码（0.0.0.0 / 0.0.0.0）：代表“所有未知目的地”（即默认路由，网络上所有去往外网、其他节点、其他 Pod 的流量）。
* 网关（169.254.1.1）：所有这些外发流量，必须全部送给 `169.254.1.1` 让它帮你转发。
* 标志 Flags（UG）：Up（路由有效）和 Gateway（需要经过网关转发）。
* 通俗解释：告诉系统：“只要不是发给本地或第二行那个 IP 的包，一律打包通过 `veth1-ns1` 网卡丢给 `169.254.1.1` 处理。”