https://www.henrydu.com/tags/networks/ Recent content in Networks on Henry Du Blog Hugo -- gohugo.io en-us Sat, 13 Jan 2024 00:00:00 +0000 https://www.henrydu.com/2024/01/13/netfilter-iptables-1/ Sat, 13 Jan 2024 00:00:00 +0000 https://www.henrydu.com/2024/01/13/netfilter-iptables-1/ Reading Notes: Netfilter and iptables Netfilter is firewalling subsystem in the Linux kernel as a modular[1]. For example, some fields are included in the sk_buf data structure only if the kernel is compiled with support for Netfilter feature. struct sk_buff is defined in linux/include/skbuff.h. There is a well defined document on the top of the file. It include the netfilter common header file #if IS_ENABLED(CONFIG_NF_CONNTRACK) #include <linux/netfilter/nf_conntrack_common.h>#endif Firewalling, essentially, hooks into certain places in the network stack code that packets always pass through when the packets or the kernel meet certain conditions. https://www.henrydu.com/2021/12/01/cross-host-container-network-vxlan-mode/ Wed, 01 Dec 2021 00:00:00 +0000 https://www.henrydu.com/2021/12/01/cross-host-container-network-vxlan-mode/ Cross-host Container Networks - VXLAN mode VXLAN We have reviewed the UDP mode of cross-host container networks. We realized that there will be a performance issue because the IP packets have to be processed by the user space application. VXLAN allows us to handle the encapsulation/decapsulation in Linux kernel space. Virtual Extensible LAN a.k.a VXLAN (RFC7348) is supported by Linux kernel. It is able to encapsulate the IP packets by another layer and construct the overlay networks like the UDP tunnel does. https://www.henrydu.com/2021/11/28/cross-host-container-network-udp-mode/ Sun, 28 Nov 2021 00:00:00 +0000 https://www.henrydu.com/2021/11/28/cross-host-container-network-udp-mode/ Cross-host Container Networks - UDP mode In the previous article, we walked through containers network in one Linux host. However, by default Docker configuration, one container is unable to communicate with the other container in different host. In order to solve cross-host container communication problem, there are many solutions. We will go through some of them one by one. First and very famous one is Flannel CNI. Flannel CNI Flannel CNI project is the one of the projects developed by CoreOS. https://www.henrydu.com/2020/12/12/k8s-runtime/ Sat, 12 Dec 2020 00:00:00 +0000 https://www.henrydu.com/2020/12/12/k8s-runtime/ K8S Container Runtime Evolution With Docker In Kubernetes v1.20 release note, the major change is to deprecate dockershim, which means, K8S will never use Docker as container runtime. The Kubernetes community has written a blog post about this in detail. The docker runtime is just one component of Docker suite. Developers still use Docker to compile a docker image, and use docker hub to store docker images, as a docker image repository. https://www.henrydu.com/2020/12/03/cilium-service-lb-2/ Thu, 03 Dec 2020 00:00:00 +0000 https://www.henrydu.com/2020/12/03/cilium-service-lb-2/ Cilium’s service LB based on eBPF/XDP The first part introduced K8S service. Now, we can focus on Cilium’s service LB based on eBPF/XDP. Cilium agent Cilium service LB implements data path for all K8s service types via BPF. cilium-agent on each node watches kube-apiserver. cilium-agent observes the changes in K8S service. cilium-agent dynamically update BPF configuration according to changes in K8S service. As the diagram shown above, there are two components realized the service https://www.henrydu.com/2020/11/30/cilium-service-lb-1/ Mon, 30 Nov 2020 00:00:00 +0000 https://www.henrydu.com/2020/11/30/cilium-service-lb-1/ Cilium: K8S Service Load Balancing - Part 1 This blog is my reading note when I read K8S Service Load Balancing with BPF & XDP, presented by Daniel Borkmann and Martynas Pumputis in Linux Plumbers Conference. Kubernetes Networking Basic I have summarized kubernetes network feature when I introduced Flannel CNI. Kubenetes network is a flat network in the sense that each pod must be reachable by its IP address within a cluster. https://www.henrydu.com/2020/11/16/k3s-cni-flannel/ Mon, 16 Nov 2020 00:00:00 +0000 https://www.henrydu.com/2020/11/16/k3s-cni-flannel/ K3S Supports Container Network Interface (CNI) and Flannel Introduction Kubernetes network provide the following features: Pods can communicate directly with all other pods on all nodes (no NAT). All nodes agents can communicate with other pods on all nodes (no NAT). The IP that a container sees itself as is the same IP that others see it as. This article explains how every pod is assigned an IP address managed by K3S.