Kuryr-Kubernetes - Neutron networking for K8s

---

---

---

---

---

# Kuryr-Kubernetes

## Neutron networking for K8s

Michał Dulko - Software Engineer - Red Hat<br>
<br>
OpenStack Day Poland, 12.06.2018<br>

---

# AGENDA
--

1. Networking concepts in K8s and CNI
--

2. Kuryr-Kubernetes
   * Basics
   * Under the hood
   * Limitations and future

Slides available at: **https://dulek.github.io/openstack-days-kuryr**

---

Kubernetes and Container Network Interface (CNI)

---

# Kubernetes and CNI

## Kubernetes networking concepts

**Pod** - smallest schedulable K8s entity consisting of one or more containers
guaranteed to be placed on a single host. **Those containers are sharing the
networking settings and IP.**

**Service** - an entitity making K8s Pods providing the same service accessible
through a single IP or hostname. There are multiple types of Services:

--
* `ClusterIP` - exposed only on cluster-internal IP.
--

* `LoadBalancer` - exposed outside using cloud provider's load balancer.
--

* `NodePort` - exposed on a certain port of the K8s node.
--

* `ExternalName` - returns CNAME record.

---

# Kubernetes and CNI

## Kubernetes networking concepts

**Pod** - smallest schedulable K8s entity consisting of one or more containers
guaranteed to be placed on a single host. **Those containers are sharing the
networking settings and IP.**

**Service** - an entitity making K8s Pods providing the same service accessible
through a single IP or hostname. There are multiple types of Services:

* `ClusterIP` - exposed only on cluster-internal IP.
* `LoadBalancer` - exposed outside using cloud provider's load balancer.
* ~~`NodePort` - exposed on a certain port of the K8s node.~~
* ~~`ExternalName` - returns CNAME record.~~

**Ingress (Router)** - entity defining rules allowing inbound connections to reach
services on K8s cluster, normally implemented as L7 load balancer. Single
Ingress can give **multiple** services externally reachable URLs, LB, terminate
SSL. Requires *Ingress controller*, e.g. pod that watches for Ingress resources
and adjusts its nginx rules accordingly.

**Network Policies** - Kubernetes equivalent of Security Groups.

---

# Kubernetes and CNI

## Service of type `LoadBalancer` vs Ingress

![Insert graphic here](assets/lb-service.svg)]

]
--

![Insert graphic here](assets/ingress.svg)]

]

---

# Kubernetes and CNI

## Container Network Interface

* Project governed by CNCF (*Cloud Native Computing Foundation*).
--

* API is based on net.d configuration, executables and environment variables:
--

* CNI plugins are configured in net.d directory (default `/etc/cni/net.d`)
    by config files. CNI starts looking from first file lexicographically, e.g.
    `10-kuryr.conf`.
--
  * CNI plugins are just binaries that should be run with certain environment
    variables set.
--
     - `CNI_COMMAND` - either `ADD`, `DEL` or `VERSION`.
--
     - `CNI_CONTAINERID` - unique container ID, key when storing state.
--
     - `CNI_NETNS` - network namespace that interface should be placed in.
--
     - `CNI_IFNAME` - requested name of the interface in the `CNI_NETNS`.
--
  * When run with `CNI_COMMAND`=`ADD`, CNI plugin is responsible for putting
    the interface named `CNI_IFNAME` into `CNI_NETNS` network namespace. This
    interface should be connected to the desired network. Returned are the
    interface details like its IP, gateway, DNS and routes.
--
  * Opposite applies for `CNI_COMMAND`=`DEL`, just the interface doesn't need
    to be deleted as it will go automatically with deleted netns.

---

# Kubernetes and CNI

## CNI ADD example