Skip to content

Commit

Permalink
docs: update docs format
Browse files Browse the repository at this point in the history
Signed-off-by: tao.yang <tao.yang@daocloud.io>
  • Loading branch information
ty-dc committed Dec 13, 2023
1 parent cb6c501 commit 7f9f75b
Show file tree
Hide file tree
Showing 4 changed files with 54 additions and 54 deletions.
48 changes: 24 additions & 24 deletions docs/concepts/ipam-des-zh_CN.md
Original file line number Diff line number Diff line change
Expand Up @@ -18,25 +18,25 @@ Spiderpool 是为 Underlay 网络特点而设计,以下对两种方案进行

1. Pod 子网中的 IP 地址按照节点进行了分割

以一个更小子网掩码长度为单位,把 Pod subnet 分割出更小的 IP block 集合,依据 IP 使用的用量情况,每个 node 都会获取到一个或者多个 IP block。
以一个更小子网掩码长度为单位,把 Pod subnet 分割出更小的 IP block 集合,依据 IP 使用的用量情况,每个 node 都会获取到一个或者多个 IP block。

这意味着两个特点:第一,每个 node 上的 IPAM 插件只需要在本地的 IP block 中分配和释放 IP 地址时,与其它 node 上的 IPAM 无 IP 分配冲突,IPAM 分配效率更高。
第二,某个具体的 IP 地址跟随 IP block 集合,会相对固定的一直在某个 node 上被分配,没法随同 Pod 一起被调度漂移。
这意味着两个特点:第一,每个 node 上的 IPAM 插件只需要在本地的 IP block 中分配和释放 IP 地址时,与其它 node 上的 IPAM 无 IP 分配冲突,IPAM 分配效率更高。
第二,某个具体的 IP 地址跟随 IP block 集合,会相对固定的一直在某个 node 上被分配,没法随同 Pod 一起被调度漂移。

2. IP 地址资源充沛

只要 Pod 子网不与相关网络重叠,再能够合理利用 NAT 技术,Kubernetes 单个集群可以拥有充沛的 IP 地址资源。
因此,应用不会因为 IP 不够而启动失败,IPAM 组件面临的异常 IP 回收压力较小。
只要 Pod 子网不与相关网络重叠,再能够合理利用 NAT 技术,Kubernetes 单个集群可以拥有充沛的 IP 地址资源。
因此,应用不会因为 IP 不够而启动失败,IPAM 组件面临的异常 IP 回收压力较小。

3. 没有应用 "IP 地址固定"需求

对于应用 IP 地址固定需求,有无状态应用和有状态应用的区别:对于 Deployment 这类无状态应用,因为 Pod 名称会随着 Pod 重启而变化,
应用本身的业务逻辑也是无状态的,因此对于 "IP 地址固定" 的需求,只能让所有 Pod 副本固定在一个 IP 地址的集合内;对于 StatefulSet
这类有状态应用,因为 Pod name 等信息都是固定的,应用本身的业务逻辑也是有状态的,因此对于 "IP 地址固定"需求,要实现单个 Pod 和具体 IP 地址的强绑定。
对于应用 IP 地址固定需求,有无状态应用和有状态应用的区别:对于 Deployment 这类无状态应用,因为 Pod 名称会随着 Pod 重启而变化,
应用本身的业务逻辑也是无状态的,因此对于 "IP 地址固定" 的需求,只能让所有 Pod 副本固定在一个 IP 地址的集合内;对于 StatefulSet
这类有状态应用,因为 Pod name 等信息都是固定的,应用本身的业务逻辑也是有状态的,因此对于 "IP 地址固定"需求,要实现单个 Pod 和具体 IP 地址的强绑定。

在 "Overlay 网络方案"方案下,多是借助了 NAT 技术向集群外部暴露服务的入口和源地址,借助 DNS、clusterIP 等技术来实现集群东西向通信。
其次,IPAM 的 IP block 方式把 IP 相对固定到某个节点上,而不能保证应用副本的跟随调度。
因此,应用的 "IP 地址固定"能力无用武之地,当前社区的主流 CNI 多数不支持 "IP 地址固定",或者支持方法较为简陋。
在 "Overlay 网络方案"方案下,多是借助了 NAT 技术向集群外部暴露服务的入口和源地址,借助 DNS、clusterIP 等技术来实现集群东西向通信。
其次,IPAM 的 IP block 方式把 IP 相对固定到某个节点上,而不能保证应用副本的跟随调度。
因此,应用的 "IP 地址固定"能力无用武之地,当前社区的主流 CNI 多数不支持 "IP 地址固定",或者支持方法较为简陋。

这个方案的优点是,无论集群部署在什么样的底层网络环境上,CNI 插件的兼容性都非常好,且都能够为 Pod 提供子网独立、IP 地址资源充沛的网络。

Expand All @@ -48,36 +48,36 @@ Underlay 网络方案的实施,有两种典型的场景:一种是集群部

1. 单个 IP 地址应该能够在任一节点上被分配

这个需求有多方面的原因:随着数据中心的网络设备增加、多集群技术的发展,IPv4 地址资源稀缺,要求 IPAM 提高 IP 资源的使用效率;
对于有 "IP 地址固定"需求的应用,其 Pod 副本可能会调度到集群的任意一个节点上,并且,在故障场景下还会发生节点间的漂移,要求 IP 地址一起漂移。
这个需求有多方面的原因:随着数据中心的网络设备增加、多集群技术的发展,IPv4 地址资源稀缺,要求 IPAM 提高 IP 资源的使用效率;
对于有 "IP 地址固定"需求的应用,其 Pod 副本可能会调度到集群的任意一个节点上,并且,在故障场景下还会发生节点间的漂移,要求 IP 地址一起漂移。

因此,在集群中的任意一个节点上,一个 IP 地址应该具备能够被分配给 Pod 使用的可能。
因此,在集群中的任意一个节点上,一个 IP 地址应该具备能够被分配给 Pod 使用的可能。

2. 同一应用的不同副本,能实现跨子网获取 IP 地址

例如,一个集群中,宿主机1的区域只能使用子网 172.20.1.0/24,而宿主机2的区域只能使用子网 172.20.2.0/24,在此背景下,
当一个应用跨子网部署副本时,要求 IPAM 能够在不同的节点上,为同一个应用下的不同 Pod 分配出子网匹配的 IP 地址。
例如,一个集群中,宿主机1的区域只能使用子网 172.20.1.0/24,而宿主机2的区域只能使用子网 172.20.2.0/24,在此背景下,
当一个应用跨子网部署副本时,要求 IPAM 能够在不同的节点上,为同一个应用下的不同 Pod 分配出子网匹配的 IP 地址。

3. 应用 IP 地址固定

很多传统应用在云化改造前,是部署在裸金属环境上的,服务之间的网络未引入 NAT 地址转换,微服务架构中需要感知对方的源 IP 或目的 IP,
并且,网络管理员也习惯了使用防火墙等手段来精细管控网络安全。
很多传统应用在云化改造前,是部署在裸金属环境上的,服务之间的网络未引入 NAT 地址转换,微服务架构中需要感知对方的源 IP 或目的 IP,
并且,网络管理员也习惯了使用防火墙等手段来精细管控网络安全。

因此,应用上云后,无状态应用希望能够实现 IP 范围的固定,有状态应用希望能够实现 IP 地址的唯一对应,这样,能够减少对微服务架构的改造工作。
因此,应用上云后,无状态应用希望能够实现 IP 范围的固定,有状态应用希望能够实现 IP 地址的唯一对应,这样,能够减少对微服务架构的改造工作。

4. 一个 Pod 的多网卡获取不同子网的 IP 地址

既然是对接 Underlay 网络,Pod 就会有多网卡需求,以使其通达不同的 Underlay 子网,这要求 IPAM 能够给应用的不同网卡分配不同子网下的 IP 地址。
既然是对接 Underlay 网络,Pod 就会有多网卡需求,以使其通达不同的 Underlay 子网,这要求 IPAM 能够给应用的不同网卡分配不同子网下的 IP 地址。

5. IP 地址冲突

在 Underlay 网络中,更加容易出现 IP 冲突,例如,Pod 与集群外部的主机 IP 发生了冲突,与其它对接了相同子网的集群冲突,
而 IPAM 组件很难感知外部这些冲突的 IP 地址,多需要借助 CNI 插件进行实时的 IP 冲突检测。
在 Underlay 网络中,更加容易出现 IP 冲突,例如,Pod 与集群外部的主机 IP 发生了冲突,与其它对接了相同子网的集群冲突,
而 IPAM 组件很难感知外部这些冲突的 IP 地址,多需要借助 CNI 插件进行实时的 IP 冲突检测。

6. 已用 IP 地址的释放回收

因为 Underlay 网络 IP 地址资源的稀缺性,且应用有 IP 地址固定需求,所以,"应当"被释放的 IP 地址若未被 IPAM 组件回收,新启动的 Pod 可能会因为缺少 IP 地址而失败。
这就要求 IPAM 组件拥有更加精准、高效、及时的 IP 回收机制。
因为 Underlay 网络 IP 地址资源的稀缺性,且应用有 IP 地址固定需求,所以,"应当"被释放的 IP 地址若未被 IPAM 组件回收,新启动的 Pod 可能会因为缺少 IP 地址而失败。
这就要求 IPAM 组件拥有更加精准、高效、及时的 IP 回收机制。

这个方案的优势有:无需网络 NAT 映射的引入,对应用的云化网络改造,提出了最大的便利;底层网络的火墙等设备,可对 Pod 通信实现相对较为精细的管控;无需隧道技术,
网络通信的吞吐量和延时性能也相对的提高了。
Expand Down
34 changes: 17 additions & 17 deletions docs/concepts/ipam-des.md
Original file line number Diff line number Diff line change
Expand Up @@ -17,21 +17,21 @@ These IPAM solutions have the following characteristics:

1. Divide Pod subnets into node-based IP blocks

In terms of a smaller subnet mask, the Pod subnet is divided into smaller IP blocks, and each node is assigned one or more IP blocks depending on the actual IP allocation account.
In terms of a smaller subnet mask, the Pod subnet is divided into smaller IP blocks, and each node is assigned one or more IP blocks depending on the actual IP allocation account.

First, since the IPAM plugin on each node only needs to allocate and release IP addresses in the local IP block, there is no IP allocation conflict with IPAM on other nodes, achieving more efficient allocation.
Second, a specific IP address follows an IP block and is allocated within one node all the time, so it cannot be assigned on other nodes together with a bound Pod.
First, since the IPAM plugin on each node only needs to allocate and release IP addresses in the local IP block, there is no IP allocation conflict with IPAM on other nodes, achieving more efficient allocation.
Second, a specific IP address follows an IP block and is allocated within one node all the time, so it cannot be assigned on other nodes together with a bound Pod.

2. Sufficient IP address resources

Subnets not overlapping with any CIDR, could be used by the cluster, so the cluster has enough IP address resources as long as NAT technology is used in an appropriate manner. As a result, IPAM components face less pressure to reclaim abnormal IP addresses.
Subnets not overlapping with any CIDR, could be used by the cluster, so the cluster has enough IP address resources as long as NAT technology is used in an appropriate manner. As a result, IPAM components face less pressure to reclaim abnormal IP addresses.

3. No requirement for static IP addresses

For the static IP address requirement, there is a difference between a stateless application and a stateful application. Regarding stateless application like deployment, the Pod's name will change when the Pod restarts, and the business logic of the application itself is stateless. Thus static IP addresses means that all the Pod replicas are fixed in a set of IP addresses; for stateful applications such as statefulset, considering both the fixed information including Pod's names and stateful business logic, the strong binding of one Pod and one specific IP address needs to be implemented for static IP addresses.
For the static IP address requirement, there is a difference between a stateless application and a stateful application. Regarding stateless application like deployment, the Pod's name will change when the Pod restarts, and the business logic of the application itself is stateless. Thus static IP addresses means that all the Pod replicas are fixed in a set of IP addresses; for stateful applications such as statefulset, considering both the fixed information including Pod's names and stateful business logic, the strong binding of one Pod and one specific IP address needs to be implemented for static IP addresses.

The "overlay network solution" mostly exposes the ingress and source addresses of services to the outside of the cluster with the help of NAT technology, and realizes the east-west communication through DNS, clusterIP and other technologies.
In addition, although the IP block of IPAM fixes the IP to one node, it does not guarantee the application replicas follow the scheduling. Therefore, there is no scope for the static IP address capability. Most of the mainstream CNIs in the community have not yet supported "static IP addressed", or support it in a rough way.
The "overlay network solution" mostly exposes the ingress and source addresses of services to the outside of the cluster with the help of NAT technology, and realizes the east-west communication through DNS, clusterIP and other technologies.
In addition, although the IP block of IPAM fixes the IP to one node, it does not guarantee the application replicas follow the scheduling. Therefore, there is no scope for the static IP address capability. Most of the mainstream CNIs in the community have not yet supported "static IP addressed", or support it in a rough way.

The advantage of the "overlay network solution" is that the CNI plugins are highly compatible with any underlying network environment, and can provide independent subnets with sufficient IP addresses for Pods.

Expand All @@ -43,33 +43,33 @@ There are two typical scenarios for underlay network solutions: clusters deploye

1. An IP address able to be assigned to any node

As the number of network devices in the data center increases and multi-cluster technology evolves, IPv4 address resources become scarce, thus requiring IPAM to improve the efficiency of IP usage.
As the Pod replicas of the applications requiring "static IP addresses" could be scheduled to any node in the cluster and drift between nodes, IP addresses might drift together.
As the number of network devices in the data center increases and multi-cluster technology evolves, IPv4 address resources become scarce, thus requiring IPAM to improve the efficiency of IP usage.
As the Pod replicas of the applications requiring "static IP addresses" could be scheduled to any node in the cluster and drift between nodes, IP addresses might drift together.

Therefore, an IP address should be able to be allocated to a Pod on any node.
Therefore, an IP address should be able to be allocated to a Pod on any node.

2. Different replicas within one application could obtain IP addresses across subnets

Take as an example one node could access subnet 172.20.1.0/24 while another node just only access subnet 172.20.2.0/24. In this case, when the replicas within one application need to be deployed across subnets, IPAM is required to be able to assign subnet-matched IP addresses to the application on different nodes.
Take as an example one node could access subnet 172.20.1.0/24 while another node just only access subnet 172.20.2.0/24. In this case, when the replicas within one application need to be deployed across subnets, IPAM is required to be able to assign subnet-matched IP addresses to the application on different nodes.

3. Static IP addresses

For some traditional applications, the source IPs or destination IPs need to be sensed in the microservice. And network admins are used to enabling fine-grained network security control via firewalls and other means.
For some traditional applications, the source IPs or destination IPs need to be sensed in the microservice. And network admins are used to enabling fine-grained network security control via firewalls and other means.

Therefore, in order to reduce the transformation chores after the applications move to the Kubernetes, applications need static IP addresses.
Therefore, in order to reduce the transformation chores after the applications move to the Kubernetes, applications need static IP addresses.

4. Pods with Multiple NICs need IP addresses of different underlay subnets

Since the Pod is connected to an underlay network, it has the need for multiple NICs to reach different underlay subnets.
Since the Pod is connected to an underlay network, it has the need for multiple NICs to reach different underlay subnets.

5. IP conflict

Underlay networks are more prone to IP conflicts. For instance, Pods conflict with host IPs outside the cluster, or conflict with other clusters under the same subnet. But it is difficult for IPAM to discover these conflicting IP addresses externally unless CNI plugins are involved for real-time IP conflict detection.
Underlay networks are more prone to IP conflicts. For instance, Pods conflict with host IPs outside the cluster, or conflict with other clusters under the same subnet. But it is difficult for IPAM to discover these conflicting IP addresses externally unless CNI plugins are involved for real-time IP conflict detection.

6. Release and recover IP addresses

Because of the scarcity of IP addresses in underlay networks and the static IP address requirements of applications, a newly launched Pod may fail due to the lack of IP addresses owing to some IP addresses not being released by abnormal Pods.
This requires IPAMs to have a more accurate, efficient and timely IP recovery mechanism.
Because of the scarcity of IP addresses in underlay networks and the static IP address requirements of applications, a newly launched Pod may fail due to the lack of IP addresses owing to some IP addresses not being released by abnormal Pods.
This requires IPAMs to have a more accurate, efficient and timely IP recovery mechanism.

The advantages of the underlay network solution include: no need for network NAT mapping, which makes cloud-based network transformation for applications way more convenient; the underlying network firewall and other devices can achieve relatively fine control of Pod communication; no tunneling technology contributes to improved throughput and latency performance of network communications.

Expand Down
Loading

0 comments on commit 7f9f75b

Please sign in to comment.