Kubernetes Networking Awesome
约 2 分钟阅读
标签：资源精选
- kube-router
- metallb
- k8snetworkplumbingwgGitHub Orgk8snetworkplumbingwg
- squat/kiloGitHubsquat/kilo
- multi-cloud network overlay built on WireGuard and designed for Kubernetes (k8s + wg = kg)
- kilo + vcluster - 多集群
- 参考
Ingress & Gateway
- Ingress V2 -> Gateway
- Ingress Controller 实现
Ingress 实现情况
- 针对实现 Ingress API
- 通常不暴露额外的 CDR
- 例如 ingress-nginx
- 基于现有 Web 服务支持 Ingress
- 通常支持自定义 CDR
- 例如 traefik
- 基于现有 平台 支持 Ingress
- 通常支持 接口 操作规则
- 服务有状态
- 例如 kong, apisix
Ingress 选择
- 最好选择简单实用熟悉的
- 例如 已知怎么定义一些特殊规则
- 选择轻量，功能单一的
- 例如 证书尽量配合 cert-manager 使用
- 需要支持复杂 API 网关场景最好利用多 IngressClass 或 通过服务 进行继承使用
- 例如 使用 kong 或 apisix 统一管理 API - ingress 执行 网关服务
- 将 Ingress 看作是反向代理的替代
- 推荐 - ingress-nginx
- IngressClass 可配合使用
- HAProxy 擅长 TLS、SNI、LB
- Nginx 擅长 反向代理
- Envoy 擅长 协议感知、定制性高
- 自定义网关 擅长 API 管理、集成、Web 可视化管理
| ingress | stars | based on | ingress | gateway | governance |
|---|---|---|---|---|---|
| ingress-nginx |  | nginx | 🟢 | 🔴 | |
| haproxy-ingress |  | haproxy | 🟢 | 🟢 | |
| haproxytech-ingressGitHubhaproxytech/kubernetes-ingress |  | haproxy | 🟢 | 🔴 | haproxytech |
| istio | envoy | 🟢 | 🟢 | CNCF/google | |
| contourGitHubprojectcontour/contour | envoy | 🟢 | 🟢 | CNCF | |
| traefik笔记Traefik IngressTraefik 的 K8S 分为 CRD 方式和标准的 IngressController · CRD 支持更多功能 - Helm 安装 · Traefik 支持非常多的功能 - ACME, SNI, Dashboard, Tracing, Metrics打开：/notes/devops/kubernetes/network/traefik-ingress | traefik | 🟢 | 🟢 | ||
| glooGitHubsolo-io/gloo | envoy | 🟢 | 🟡 | ||
| Emissary-IngressGitHubemissary-ingress/emissaryemissary-ingress/emissary · Apache-2.0, Go+Python · API Gateway + Layer 7 LB + Kubernetes Ingress · Envoy Proxy · 之前为 Ambassador API Gateway笔记：emissary-ingress |  | envoy | 🟢 | 🟢 | |
| kongGitHubKong/kubernetes-ingress-controller | nginx/kong | 🟢 | 🟡 | Kong | |
| apisixGitHubapache/apisix-ingress-controller | nginx/apisix | 🟢 | 🟡 | Apache | |
| citrixGitHubcitrix/citrix-k8s-ingress-controller | Citrix ADC | 🟢 | |||
| enrouteGitHubsaarasio/enroute | envoy | 🟢 | CNCF/saarasio | ||
| easegressGitHubmegaease/easegress |  | easegress | 🟢 | megaease | |
| voyagerGitHubvoyagermesh/voyager | haproxy | 🟢 | AppsCode | ||
| tykGitHubTykTechnologies/tyk-operator | typ | 🟢 | |||
| skipperGitHubzalando/skipper | skipper | 🟢 |
- ingress-nginx
- ssl passthrough 性能问题 ingress-nginx#7827GitHub Issuekubernetes/ingress-nginx#7827
- haproxy-ingress
- 支持外部 HAProxy
CNI
| vs. | starts | IPv6 | Windows | Policy |
|---|---|---|---|---|
| calico笔记Calicoprojectcalico/calico · 提供 · 网络联通 · 管理 · 安全 · layer 3, BGP · Network policy · 可集成 istio 拦截流量 · 参考 · Node requirements打开：/notes/devops/kubernetes/network/calico |  | ✅ | ✅ | ✅ |
| kube-router笔记kube-routercloudnativelabs/kube-router · LVS/IPVS service proxy - IPVS+IPTables · Pod Networking - Router Controller - GoBGP+routing打开：/notes/devops/kubernetes/network/kube-router |  | ❌ | ❌ | ❌ |
| flannel笔记Flannelflannel-io/flannel · layer 2 · overlay network · 每个节点一个 CIDR 段 · 支持后端 · vxlan · 大多时候默认 · DirectRouting 可以在相同 subnet 时直连 - 类似 host-gw打开：/notes/devops/kubernetes/network/flannel |  | ❌ | ✅ | ❌ |
| cilium |  | ❌ | ❌ | ✅ |
- 不支持 IPv6 也不支持 DualStack
- NetworkPolicy 支持控制 Ingress 和 Egress 网络
- kube-router
- layer 3, lvs/ipvs
- flannel
- overlay
- 轻量, 专注网络层
- 后端: vxlan, host-gw, udp, ipip, ipsec, wireguard
- 配置: etcd, k8s api
- calico
- layer 3, overlay, BGP,
- 后端: vxlan, pip, eBPF, WindowsHNS
- IPv6 不支持 IPIP/VXLAN calico#5206GitHub Issueprojectcalico/calico#5206
- cilium
- layer 3/4/7, eBPF
- IPv6 cilium#13891GitHub Issuecilium/cilium#13891
- weave
- IPsec ESP
- canal - 停止 - calico+flannel - 目前 calico 内置 vxlan
网络组件功能选项
- Policy
- IPAM
- CNI
- Overlay - VXLAN, IPIP, WG, IPIP, IPSec
- Routing - BGP, VPC
Overlay
- tinc
- n2n
关联信息
反向链接和本文引用的外部资料。
References
GitHub
18 条- apache/apisix-ingress-controllergithub.com/apache/apisix-ingress-controller
- cilium/cilium#13891github.com/cilium/cilium/issues/13891
- citrix/citrix-k8s-ingress-controllergithub.com/citrix/citrix-k8s-ingress-controller
- emissary-ingress/emissarygithub.com/emissary-ingress/emissary
- haproxytech/kubernetes-ingressgithub.com/haproxytech/kubernetes-ingress
- k8snetworkplumbingwggithub.com/k8snetworkplumbingwg
- k8snetworkplumbingwg/multus-cnigithub.com/k8snetworkplumbingwg/multus-cni
- Kong/kubernetes-ingress-controllergithub.com/Kong/kubernetes-ingress-controller
另有 10 个未显示 references。
其他外链
13 条- img.shields.io/github/stars/cilium/ciliumimg.shields.io/github/stars/cilium/cilium
- img.shields.io/github/stars/cloudnativelabs/kube-routerimg.shields.io/github/stars/cloudnativelabs/kube-router
- img.shields.io/github/stars/emissary-ingress/emissaryimg.shields.io/github/stars/emissary-ingress/emissary
- img.shields.io/github/stars/flannel-io/flannelimg.shields.io/github/stars/flannel-io/flannel
- img.shields.io/github/stars/haproxytech/kubernetes-ingressimg.shields.io/github/stars/haproxytech/kubernetes-ingress
- img.shields.io/github/stars/jcmoraisjr/haproxy-ingressimg.shields.io/github/stars/jcmoraisjr/haproxy-ingress
- img.shields.io/github/stars/Kong/kubernetes-ingress-controllerimg.shields.io/github/stars/Kong/kubernetes-ingress-controller
- img.shields.io/github/stars/kubernetes/ingress-nginximg.shields.io/github/stars/kubernetes/ingress-nginx
另有 5 个未显示 references。
另有 15 个 references 未显示。