diff --git a/content/rancher/v2.x/en/faq/network/_index.md b/content/rancher/v2.x/en/faq/network/_index.md new file mode 100644 index 00000000000..a05e993968e --- /dev/null +++ b/content/rancher/v2.x/en/faq/network/_index.md @@ -0,0 +1,9 @@ +--- +title: Network +weight: 8005 +--- + +Network FAQ's + +- [CNI provider]({{< baseurl >}}/rancher/v2.x/en/faq/network/cni-providers/) + diff --git a/content/rancher/v2.x/en/faq/network/cni-providers/_index.md b/content/rancher/v2.x/en/faq/network/cni-providers/_index.md new file mode 100644 index 00000000000..6abb62fe8c7 --- /dev/null +++ b/content/rancher/v2.x/en/faq/network/cni-providers/_index.md @@ -0,0 +1,156 @@ +--- +title: CNI providers +weight: 2300 +draft: true +--- + +--- + +### What is CNI? + +CNI (Container Network Interface), a [Cloud Native Computing Foundation project](https://cncf.io/), consists of a specification and libraries for writing plugins to configure network interfaces in Linux containers, along with a number of supported plugins. CNI concerns itself only with network connectivity of containers and removing allocated resources when the container is deleted. + +K8S uses CNI as an interface between network providers and k8s pods networking. + +CNI logo + +For more information visit [CNI GitHub project](https://github.com/containernetworking/cni). + +### What network models are used in CNI? + +CNI providers implement their network fabric using either an encapsulated network model such as VXLAN or an unencapsulated network model such as BGP. + +#### What is an encapsulated network? + +This network model provides a logical L2 network encapsulated over the existing L3 network topology spanning the k8s cluster nodes. With this model you have an isolated l2 network for containers without needed routing distribution, at the cost of an little overhead in terms of processing and increasing ip package size with an ip header generated by overlay encapsulation. Encapsulation information is used to be distributed by udp port between k8s workers, interchanging network control plane information about how mac addressed could be reached. Common encapsulation used in this kind of network model are vxlan, ipsec, ip-in-ip... + +Simplifying, this network model generates a kind of network bridge extended between k8s workers, where pods will be connected. + +This network model is indeed when a extended layer 2 bridge is preferred. This network model is sensible to layer 3 network latencies of the k8s workers. If datacenters are in distinct geo-locations, be sure to have low latencies between them to avoid eventual network segmentation. + +CNI providers using this network model, flannel, canal, weave... + +Encapsulated network + +#### What is an unencapsulated network? + +This network model provides a l3 network to route packets between containers. This model doesn't generate an isolated l2 network, neither generates overhead, at the cost of route distribution needed, that is managed by k8s workers. Instead of ip headers to encapsutate, it uses a network protocol between k8s workers to distribute routing information to reach pods, like [bgp](https://en.wikipedia.org/wiki/Border_Gateway_Protocol). + +Simplifying, this network model generates a kind of network router extended between k8s workers, that provides information how to reach pods. + +This network model is indeed when a routed layer 3 network is preferred. This mode dinamically update routes at os level at k8s workers. It's less sensible to latency but + +CNI providers using this network model, calico, romana... + +Unencapsulated network + +### What CNI provides Rancher? + +Rancher supports three different CNI providers for k8s clusters. They could be choosed when you create new k8s cluster from Rancher. + +#### What is canal? + +Canal logo + +Canal is a CNI provider that gives you the best of Flannel and Calico. It allows users to easily deploy Calico and flannel networking together as a unified networking solution, combining Calico’s network policy enforcement with the rich superset of Calico (unencapsulated) and/or flannel (encapsulated) network connectivity options. + +On Rancher, canal is the default CNI provider combined with flannel and vxlan encapsulation. + +K8S workers should open udp port 8472 (vxlan) and 9099 (healthcheck) + +Canal diagram + +More info: +https://github.com/projectcalico/canal + + +#### What is flannel? + +Flannel logo + +Flannel is a simple and easy way to configure a layer 3 network fabric designed for Kubernetes. Flannel runs a single binary agent called flanneld on each host, that is responsible for allocating a subnet lease to each host out of a larger, preconfigured address space. Flannel uses either the Kubernetes API or etcd directly to store the network configuration, the allocated subnets, and any auxiliary data (such as the host's public IP). Packets are forwarded using one of several backend mechanisms, being the default encapsulation [vxlan](https://github.com/coreos/flannel/blob/master/Documentation/backends.md#vxlan). +Encapsulated traffic is clear by default, flannel provides experimental backend for cipher it, [ipsec](https://github.com/coreos/flannel/blob/master/Documentation/backends.md#ipsec), that make use of strongswam to stablish ciphered ipsec tunnels between k8s workers. + +K8S workers should open udp port 8472 (vxlan) and 9099 (healthcheck) + +Flannel diagram + +More info: +https://github.com/coreos/flannel + +#### What is calico? + +Calico logo + +Calico enables networking and network policy in k8s clusters across the cloud. Calico uses a pure unencapsulated IP network fabric and policy engine to provide networking solution to your k8s workloads. K8S workloads are able to peer with cloud infrastructure such as on-premise, using BGP. +Calico also provides a stateless IP-in-IP encapsulation mode that can be used, if necessary. +Calico also offers policy isolation, allowing you to secure and govern your k8s workloads using advanced ingress and egress policies. + +K8S workers should open tcp port 179 (bgp) + +Calico diagram + +More info: +https://www.projectcalico.org/ +https://github.com/projectcalico/calico + + +### What can I find out more about the different network projects? + +Once 3 distinct CNI providers are presented, it's time to see summarize features and popularity activity on github projects. + +#### What are CNI features? + +Here is a summary of different features of each of the CNI providers supported on Rancher. + +| Provider | Network Model | Route Distribution | Network Policies | Mesh | External Datastore | Encryption | Ingress/Egress Policies | Commercial Support | +| ---- | ---- | ---- | ---- | ---- | ---- | ---- | ---- | ---- | +| Canal | Encapsulated (vxlan) | No | Yes | No | K8S api | No | Yes | No | +| flannel | Encapsulated (vxlan) | No | No | No | K8S api | No | No | No | +| Calico | Unencapsulated | Yes | Yes | Yes | Etcd | Yes | Yes | Yes | + + +- Network Model: ecnapsulated or unencapsulated. More info at CNI network model section + +- Route Distribution: It is a must on Unencapsulated CNI providers, and it is typically done by BGP. Route distribution is a nice to have a feature with CNI, if you plan to build clusters split across network segments. It is an exterior gateway protocol designed to exchange routing and reachability information on the Internet. BGP can assist with pod to pod networking between clusters. + +- Network Policies: K8S offers functionality to enforce rules about which service can communicate with each other using network policies. This feature is stable from k8s 1.7 and is ready to use with supported networking plugins. + +- Mesh: This feature allows service to service networking communication between distinct k8s clusters. + +- External Datastore: if CNI provider needs an external datastore to persist own data. + +- Encyption: This feature allows cypher and secure network control and data planes. + +- Ingress/Egress Policies: This feature allows manage routing control for k8s and Non-k8s communications. + +#### What are Github projects? + +Here is a summary of different github metics to take an idea of projects popularity and activity about of each of the CNI providers supported on Rancher. + +| Provider | Project | Stars | Forks | Contributors | +| ---- | ---- | ---- | ---- | ---- | +| Canal | https://github.com/projectcalico/canal | 536 | 75 | 19 | +| flannel | https://github.com/coreos/flannel | 3.279 | 774 | 107 | +| Calico | https://github.com/projectcalico/calico | 572 | 225 | 82 | + +- Project: main url of the project +- Stars: Likes on GitHub +- Contributors: number of people maintaining the code base and documentation. +- Forks: number of copies of the repo. Contributors typically have to fork the repo. Other people will fork the project to build a custom copy, push code to a feature branch that they own, or for various reasons. + +Note: Tables is updated with 26th july 2018 data + +### Which CNI provider? + +The above question doesn't have a trivial answer. There are many different providers, which have various features and options. There isn't one provider that meets everyones needs, and there are many different options. By the moment, at rancher v2.0.x we are supporting 3 of the major CNI providers that could be used by every user. + +At rancher v2.0.x, canal is the default CNI provider. We recommend to use it in most cases. It provides encapsulated networking for containers with flannel, adding project calico network policies that can provide project/namespace isolation in terms of networking. + +Anyway, all of 3 solutions could be a good CNI provider choose and may work perfectly fine. + + + + + + diff --git a/content/rancher/v2.x/en/faq/network/cni-providers/img/calico-diagram.svg b/content/rancher/v2.x/en/faq/network/cni-providers/img/calico-diagram.svg new file mode 100644 index 00000000000..a8a95ec7b50 --- /dev/null +++ b/content/rancher/v2.x/en/faq/network/cni-providers/img/calico-diagram.svg @@ -0,0 +1 @@ +arch-oss-value-prop5-sm \ No newline at end of file diff --git a/content/rancher/v2.x/en/faq/network/cni-providers/img/calico-logo.png b/content/rancher/v2.x/en/faq/network/cni-providers/img/calico-logo.png new file mode 100644 index 00000000000..1babef8df8d Binary files /dev/null and b/content/rancher/v2.x/en/faq/network/cni-providers/img/calico-logo.png differ diff --git a/content/rancher/v2.x/en/faq/network/cni-providers/img/canal-diagram.png b/content/rancher/v2.x/en/faq/network/cni-providers/img/canal-diagram.png new file mode 100644 index 00000000000..51252382eb3 Binary files /dev/null and b/content/rancher/v2.x/en/faq/network/cni-providers/img/canal-diagram.png differ diff --git a/content/rancher/v2.x/en/faq/network/cni-providers/img/canal-logo.png b/content/rancher/v2.x/en/faq/network/cni-providers/img/canal-logo.png new file mode 100644 index 00000000000..22b02f3f8bb Binary files /dev/null and b/content/rancher/v2.x/en/faq/network/cni-providers/img/canal-logo.png differ diff --git a/content/rancher/v2.x/en/faq/network/cni-providers/img/cni-logo.png b/content/rancher/v2.x/en/faq/network/cni-providers/img/cni-logo.png new file mode 100644 index 00000000000..50c54d2f524 Binary files /dev/null and b/content/rancher/v2.x/en/faq/network/cni-providers/img/cni-logo.png differ diff --git a/content/rancher/v2.x/en/faq/network/cni-providers/img/encapsulated-network.svg b/content/rancher/v2.x/en/faq/network/cni-providers/img/encapsulated-network.svg new file mode 100644 index 00000000000..3f5634e6af2 --- /dev/null +++ b/content/rancher/v2.x/en/faq/network/cni-providers/img/encapsulated-network.svg @@ -0,0 +1,109 @@ + + + + Produced by OmniGraffle 7.4.3 + 2018-07-27 08:48:50 +0000 + + + + + + + + + + Canvas 1 + + + Layer 1 + + + + + k8s worker + + + + + workload 1 + 10.42.0.2 + + + + + fl + anneld + 10.42.0.1 + + + + + workload 2 + 10.42.0.3 + + + + + 192.168.34.10 + + + + + docker0 + + + + + + + + + + k8s worker + + + + + workload 1 + 10.42.1.2 + + + + + fl + anneld + 10.42.1.1 + + + + + workload 2 + 10.42.1.3 + + + + + 192.168.34.11 + + + + + docker0 + + + + + + + + + + encapsulation + + + + Overlay network 10.42.0.0/16 + + + + diff --git a/content/rancher/v2.x/en/faq/network/cni-providers/img/flannel-diagram.png b/content/rancher/v2.x/en/faq/network/cni-providers/img/flannel-diagram.png new file mode 100644 index 00000000000..aba8b2bc42b Binary files /dev/null and b/content/rancher/v2.x/en/faq/network/cni-providers/img/flannel-diagram.png differ diff --git a/content/rancher/v2.x/en/faq/network/cni-providers/img/flannel-logo.png b/content/rancher/v2.x/en/faq/network/cni-providers/img/flannel-logo.png new file mode 100644 index 00000000000..632441620f8 Binary files /dev/null and b/content/rancher/v2.x/en/faq/network/cni-providers/img/flannel-logo.png differ diff --git a/content/rancher/v2.x/en/faq/network/cni-providers/img/unencapsulated-network.svg b/content/rancher/v2.x/en/faq/network/cni-providers/img/unencapsulated-network.svg new file mode 100644 index 00000000000..58bfdbf3760 --- /dev/null +++ b/content/rancher/v2.x/en/faq/network/cni-providers/img/unencapsulated-network.svg @@ -0,0 +1,105 @@ + + + + Produced by OmniGraffle 7.4.3 + 2018-07-27 09:12:19 +0000 + + + + + + + + + + Canvas 1 + + + Layer 1 + + + + + k8s worker + + + + + workload 1 + 10.42.0.2 + + + + + bgp r + outing + + + + + workload 2 + 10.42.0.3 + + + + + 192.168.34.10 + + + + + docker0 + + + + + + + + + + k8s worker + + + + + workload 1 + 10.42.1.2 + + + + + bgp r + outing + + + + + workload 2 + 10.42.1.3 + + + + + 192.168.34.11 + + + + + docker0 + + + + + + + + + + ETCD + + + + + +