1、面向生產(chǎn)的容器網(wǎng)絡(luò)思科ACI CNI容器網(wǎng)絡(luò)解決方案#CLUS 2018 Cisco and/or its affiliates. All rights reserved. Cisco PublicBRKSDN-21152容器上生產(chǎn)在網(wǎng)絡(luò)上的挑戰(zhàn)現(xiàn)有容器網(wǎng)絡(luò)技術(shù)現(xiàn)狀 思科容器網(wǎng)絡(luò)解決方案Agenda思科ACI發(fā)布 VMware NSX發(fā)布VMware ESX V1.0 發(fā)布思科 Nexus1000v 發(fā)布標(biāo)準(zhǔn)交換機(jī)(單機(jī)網(wǎng)絡(luò))分布式交換機(jī)（集群網(wǎng)絡(luò)）黃金時(shí)代SDN(軟件定義網(wǎng)絡(luò))青銅時(shí)代2013以史為鑒，讓我們回頭看看虛擬化網(wǎng)絡(luò)的演進(jìn)VMware vswitch發(fā) 布20012002VMwar

2、e vSphere 4.0發(fā)布20082009白銀時(shí)代容器上生產(chǎn)在網(wǎng)絡(luò)上的挑戰(zhàn)挑戰(zhàn)安全和運(yùn)維是主要挑戰(zhàn)75%71%64%62%61%安全管理擴(kuò)展性網(wǎng)絡(luò)集成需要商業(yè)產(chǎn)品級(jí)別的容器平臺(tái)Source: n= 151, Forrester Consulting, May 2016. Study commissioned by Red Hat01020304050607大規(guī)模容器集群實(shí)踐高可用、業(yè)務(wù)連續(xù)性隔離域及多業(yè)務(wù)隔離監(jiān)控、監(jiān)管、4A審計(jì)IaaS和容器云統(tǒng)一管理網(wǎng)絡(luò)遵循現(xiàn)有網(wǎng)絡(luò)管理模式提供有狀態(tài)服務(wù)能力K8S京東/谷歌/唯品會(huì)生產(chǎn)實(shí)踐K8S副本模式，F(xiàn)ederation跨集群容災(zāi)網(wǎng)絡(luò)多租戶、訪問控制

3、策略ELK/普羅米修斯/zipkin監(jiān)管監(jiān)控三方云管平臺(tái) CloudCenter二層接入、云間路由互通、職責(zé)清晰數(shù)據(jù)庫，持久化存儲(chǔ)，StatusfulSET生產(chǎn)環(huán)境對(duì)容器云的基本需求現(xiàn)有容器網(wǎng)絡(luò)技術(shù)方案青銅時(shí)代的容器組網(wǎng)方案 Docker NetworkingHost-1Container 1Eth0172.17.0.12Container 2Eth0172.17.0.13docker0 Bridge 172.17.42.1veth774786dvethde4e22eeth0iptablesHost-1docker0 Bridge 172.17.42.1Eth0172.17.0.12veth7

4、74786dEth0172.17.0.12Bridge modeHost-1Eth0 (host interface) 192.168.0.2Eth0192.168.0.2Eth0192.168.0.2Container 1Container 2Host ModeContainer 1Container 2Mapped Mode單機(jī)網(wǎng)絡(luò)白銀時(shí)代的容器組網(wǎng)方案 三塊布WeaveFlannelCalico集群網(wǎng)絡(luò)組網(wǎng)方案和優(yōu)缺點(diǎn)BackboneStatic LabelBGP-LS BGP-LUStatic LabelBGP-LS BGP-LUCustomer_E-LINE組網(wǎng)方式一：Underla

5、y方案組網(wǎng)方式二：OverLay方案Calico macvlan性能好，流量可視化，無層級(jí)隔離、QOS易于組網(wǎng)、規(guī)模大，但性能差，封閉網(wǎng)絡(luò)、無層級(jí)隔離網(wǎng)絡(luò)能力由服務(wù)器實(shí)現(xiàn)/NFVDC physical-networkDC Cloud-networkWeave flannel組網(wǎng)方案比較擴(kuò)展性 876543210性能安全SDN融合可視化可管理性支持Calico Weave Flannel MACVLAN安全！ 運(yùn)維！挑 戰(zhàn)思科容器網(wǎng)絡(luò)解決方案-ACI CNI領(lǐng)先的云架構(gòu)交換平臺(tái)Nexus 9000基于策略驅(qū)動(dòng)的網(wǎng)絡(luò)控制器APIC自動(dòng)化安全可擴(kuò)展彈性擴(kuò)展Extend your networkand

6、 recognize anomalies統(tǒng)一策略Unified network Policyto all DC主動(dòng)運(yùn)維Find root cause fasterwith granular details思科SDN解決方案 ACI以應(yīng)用為中心的基礎(chǔ)架構(gòu) ACI統(tǒng)一的網(wǎng)絡(luò)平臺(tái)15BRKACI-3330Bare MetalACI作為成熟的SDN網(wǎng)絡(luò) 平臺(tái)統(tǒng)一管理容器裸金屬虛機(jī)云平臺(tái)容器網(wǎng)絡(luò)模型及資源對(duì)應(yīng)Clusternamespace/deploymentPODNetwork PolicyTenantEpgEndpointOvs FlowK8S資源ACI資源12部署/擴(kuò)展容器集群創(chuàng)建容器WEBAP

7、PWEBAPPDBServer 1Server 2Opflex/OVSHost level Policy EnforcementACI FabricACI與K8s集成創(chuàng)建ACI網(wǎng)絡(luò)21部署網(wǎng)絡(luò)安全策略3網(wǎng)絡(luò)日常監(jiān)控管理4注解策略3EPG開發(fā)團(tuán)隊(duì)網(wǎng)絡(luò)運(yùn)維團(tuán)隊(duì)安全管理員Infrastructure Policy Enforcement1定義容器網(wǎng)絡(luò)安全策略安全策略部署流程17清晰的 運(yùn)維邊 界基于Cluster隔離靈活的安全策略基于Namespace 隔離基于Deployment隔離PodPodPodPodPodPod整個(gè)Cluster Mapping到一個(gè)EPG，默認(rèn)行為應(yīng)用或POD間通過K8S

8、 Network Policy控制每個(gè)NameSpace映射到一個(gè)獨(dú)立的EPGContract控制NameSpace間訪問K8s Network Policy負(fù)責(zé)POD訪問控制每個(gè)應(yīng)用部署一個(gè)EPGContracts負(fù)責(zé)部應(yīng)用署間的訪問控制PodPodPodPodPodPodPodPodPodPodPodPodPodPodPodPodPodPodContractPodPodPodPodPodPodPodPodPodPodPodPodContractContractContractContractEPGNetwork Policy網(wǎng)絡(luò)可視化PODDeploymentServiceClusterN

9、amespace實(shí)現(xiàn)開發(fā)團(tuán)隊(duì)和網(wǎng)絡(luò)團(tuán)隊(duì)運(yùn)維工具的隔離！清晰的 管理邊 界可視化排錯(cuò)ClientK8s POD20集成IPAM及高級(jí)負(fù)載均衡特性ACI LeafK8s-node-01ACI LeafOpFlexOVSPODPODPODPODK8s-node-02OpFlexOVSPODPODPODPODWANK8s-masterOpFlexOVSPODPODPODPOD-apiVersion: v1kind: Service metadata:labels:app: nginx name: nginx namespace: defaultspec:ports:- name: 80-tcp por

10、t: 80 protocol: TCP targetPort: 80selector:app: nginxtype: ClusterIPAPIC provisions IPAM and distributed load balancer on OVS將容器網(wǎng)絡(luò)擴(kuò)展至多數(shù)據(jù)中心Kubernetes ClusterBD kube-node(K8s Nodes API ETDC)BD kube-pod (EPGs for cluster, namespace, deployment, etc.)Inter-Pod IP NetworkInter-Pod IP NetworkDC1 POD1DCn PODnPODPODPODPODPODPODThe easiest DCI solution in Industry!ACI CNI與傳統(tǒng)容器組網(wǎng)方案比較6543210擴(kuò)展性987安全SDN融合可視化可管理性支持性能Calico Wea