Antrea LIVE !!!, 10 Mar 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Episode 19 : Antrea Egress

Description

Egress manages external access from the Pods in a Kubernetes cluster. It'll be supported since Antrea 1.6.0. Come and join Wenqi and Jianjun to learn more about this new feature!!

A

Okay, we are live hi. Everyone welcome to this week's entry life show. Today um we are going to talk about the egress and we invited friends from beijing team to join us so welcome when she and and welcome jinjin.

B

Hello, everyone.

A

Hi, um so before we start, uh would you like to give us a short self introduction when she would like to go first.

C

Hello, my name is.

C

Engineer and now I'm working in a building team.

A

Welcome when she, if you're, like first entry like show right, okay, welcome so.

B

A

What what about you, jingjing.

B

Sure everyone is changing here, so I'm from engineering team of wemo and I'm a maintenance projector. I have been on the show for several times, but I'm very glad to be on the issue again.

A

Welcome is our old friends right if you like, uh watch more videos from oh, oh there's like one more one, more friends joining us today. It's like 20.

A

is also from beijing right.

D

A

And- and this is your first live, show so welcome, and would you like to start with a self introduction.

D

Sure hi everybody, my name is tien chen and I'm from.

A

D

Beijing team and I'm working on their project.

B

Chainsaw is also a maintenance, projector.

A

Okay, thanks for joining us today, um and uh we also have a new friends called uh jung. Jo jo jin shun nista miti and welcome to the show, and if this is your first time watching our show, you can like uh check our channel and consider liking or subscribing our channel.

A

uh So I went to would you like to start your demo demo about the e-class.

C

Oh okay, let me share my screen.

A

Oh by the way, so um if this is your first time watching our show, you can sign in to youtube and and uh send comments in the in in the comment part, and we will like show your comments on our screen. But you need to sign in to do the comment.

A

Okay, so everyone say hi in the comments to. Let me know you're here, okay, sorry, to interrupt when she um are you sharing your screen now.

C

uh Yeah, do you, oh, can you see my screen yeah.

A

Yeah we can see your screen.

A

C

So that's me some screen.

C

Hello, everyone I'm very glad to have the opportunity to to choose the english future here. First need I mean to introduce myself again. My name is juan siana, I'm one of the one one word software engineer and I'm working in beijing team.

C

Today, my my presentation will be will be divided into four uh five. Five part five parts. Firstly, I will I will introduce what is android equalizer and we now will use this feature.

C

Then I will use user demo to show uh to show you how to use android equals to to manage it um um and external exact access flow from the post in a cooper controller.

C

In a cluster, uh finally, we we can talk about something about the high ability I hi uh uh uh availability uh equality. We have some time uh and then uh feel free to to write your questions. If you have any and during this um presentation and then let's start.

C

Listening, what's uh what is ingress?

C

um uh Android english is a crd api that that manages uh external access from the posts seeing uh um uh cluster either suppose that's not as not as uh traffic from the the the the connected post to the external network, using the space phase specific equation diabetes and when a snare table such as the internal network, the equal traffic will be tunneled to the nodes that hold the host the equals ip, which way called egress node and if the equals node is different from the node.

C

That way that the port runs on and the traffic will be s not to the equal side, uh the equals ip1, leaving that node.

A

So it's the ignorance, note only uh standard traffic or it's like a normal workload, note which will like have other like services running on there.

C

The eucharist node is just a normal node, hey, okay, yeah, and I.

C

Can but it is different from nominal order. Some traffic could uh some travel to eternal network council. Is it's not okay,.

B

Yeah, probably I can add something here, I think eagle snow that can be a regular quest, workout, uh but just like, uh I think, later, probably when she will shoot in his demo or whatever it's like. When you configure the egress, you can define stone ip pull and in standard pro you can select what node you want to be. Your egos notes for this equals policy insert it can be any node, but, of course, user can also plan for specific set of nodes.

B

They want to do this erase traffic for some specific ports in the in the cluster.

A

B

Probably will be clear if later we see the demo here, yeah sure.

C

Okay, let me continue.

C

uh When do I use control egress, you may interested in using this feature. If you have other encounters, so you use it um you this uh scenarios. um Firstly, you need.

C

You may need a constant ipad ipad just to content to the to service outside of the um cluster, such as sourcing uh such as source choices in all in audience logs or if you want to uh um filter society in internal farewell or you want to force outgoing external connections to leave the cluster vast. Certain certain laws for security controls.

B

Yes, just like it allows you to control the sfip for eagle traffic, so if, if you have any service outside the cluster, for example, I think when she gives an example like any uh audit log service, or maybe uh some external firewall, that we need to identify the traffic based on the source ip. Then you can use that as that idea to identify traffic and apply your policy here.

C

A

Okay, uh I I see vivek is here, hi vivek welcome and if you have a question about, can there be like multiple ingress note? I think that we will cover this part. We can answer this question when we talk about the uh when we take a closer look at the ingress node.

B

For the simple answer, yes, I think, okay.

A

Awesome uh sorry to interrupt when she please go ahead.

C

Oh okay, uh next time.

C

This sim, this uh two simple uh figures shows how how how network traffic works, change the of the way use egress.

C

After we use the egress, the eagle traffic from the post will be will be turned to the nodes hosted, equals ip.

C

C

Let me introduce some equally future release. Information uh ibrahimovic is introduced in in venice 1.100 as the after future. In this release, he resigns for 30 degrees. That means that the the asana type must be must be specified one one. One click on the equals.

C

Then the way we introduced the high availability equation in venice 1 1.2 in this release, a new crt external people is induced to suppose over. If the increased nodes goes down, um it means that the that means that the the us ip will be located and located from um external people.

C

um Another good news is that the the anterior committee community is playing on graduates. The ukraine's future armpit to to better in ensure 116 is scheduled for the for the for the 18th of this month.

C

Okay, then, let me introduce ensure equally useful crd.

C

Here is a is a equal resource example.

C

There are, there are many three three three field uh firstly uh and uh applied applied to field space field. uh Space phase the post to to which his eagle is uh applies to post can be, can be. Snouted uh can be sniped in the club across the world, using important actor.

C

Will be will be obvious. uh Snapchat uh specific posts from specific namespace can be can be slotted by providing both a postdoctor and a namespace selector md applied to snacks. Nothing.

C

Notice that the applied tool field must be set in ingress and then will the the eagles ip field spaces are.

C

The asana types are traveling from the sniper post to the external network, should use and notice that he must be be reached for from war or not, then. Finally, there is.

B

Sorry for interruption and this ecosip is optional right. um I think if it's not provided and until we automatically allocate one from the us eastern people, I'll probably you will count your country that sorry for interpreting for europe at least I guess.

A

So one more sorry, one more question from vivek so well. The egress notes support multiple interface to which ippos can be allocated.

B

I wouldn't you feel like I can take this one.

C

Raise your questions.

A

Well, they the eagles, no support multiple interface to which ippos can be allocated.

B

Okay, how about let me take this one.

B

I think if, if the quantity means could we use multiple interfaces on the equals node to send the equal traffic, then.

B

D

B

A little complicated um in a typical case, we don't uh the ego's ip- must be reachable from all other node from the transport transporter interface. This is the interface we use to send the port traffic through overlay, um but uh it's also possible if you have multiple interfaces and your you've got egress nodes and you you have some stick results, for example, to to resolve the traffic to uh to I'll try to go through other interface.

B

That is, is also possible. So it depends on your uh routing table on the us notes. um For the multiple case, probably we we just support eyepiece on a single metal interface on equals, notes.

A

Thanks for taking that that one, and also I see jay is here- welcome jay and um okay. um Please go ahead when she.

C

D

C

Then let me introduce a another important resource at the external ippo, the external repo device, one or midplay ip ranges that can be used in the in the internal network uh that is in the poll can be located to the egress source. As as the eagle recycles, this is a external people resource example.

C

There are three important.

C

Field uh fascinating, uh I ip wrench, the the derby run is filled continuous, um unlisted vibe era. I I happy representing the available. Eyepiece of these people. Ecip runs.

C

Constant con of crd or web star and and and and ips and results, the the standard and and ips are included in the inner range, uh no structure.

C

The knowledge netflix uh speed phase, which notes that the eyepiece in this port can be as uh assigned to is useful when you want to limit eagles traffic to to to certain notes, notice that the no selector field that can be can be empty, which means wall nose can be selected.

C

Then uh I'll show you the um the relationship between external people and the egress.

C

This image shows and the relationship between the eagles and the internal people before before we create uglies using external ippo. We must create a externality for fast um in this in this image. um The the the external ip4.

C

Ip ranges start from 10.10.0.02.

C

C

uh It means uh there is a the three everybody free eyepiece, also from the front start to the end, and then there is a noise actor whose rule is equal is gateway. So it means words. What was the ordinals in the class? Who has a neighbor row equal to egress gateway can be an egress node.

C

So if a node was.

C

Studied as a u.s node, it can get an equal recipe from the external people and then the the equal resource there is apply applied to a field in in this resource.

C

And the port snack is abp equal to pro so in the cluster. If the in the cluster.

C

All the posts will be will be selected.

C

Traffic to the internal network will be uh has not to worry obs node by the eclipse node and finally, it has a external people field, which is from the external people. On the right.

C

You can say, the external people is equal to the the the external people resource name, internal ip4, demo,.

C

Oh okay, uh uh let me continue next night, uh then how to use anchor equals, uh as with the other other features, the future gates equals must be enable enabled and show controller and natural engine for the future to work.

C

So if you, so, if the conservation version you used is newer than 1.1.0, you can experience the the grease feature um you you maybe just need two to two steps: um firstly, modify the control yarn field and then restart the intro.

C

Then there is a kubernetes cluster. In my even weekend. We can have a practice about the equals.

C

C

Let me start queues, see my screen. There.

C

Thus, there are three three nodes in my cluster: there is a control, plane, node and two worker node.

C

C

So that two notes in the cluster.

C

C

C

Okay, step by step, let me first reset the cluster and then we can create a new and a clear cluster cooper. Google kubernetes.

C

This is the lock.

C

A

I so you uh reset all the previous configuration on the to worker node.

C

Yeah yeah, then we'll install, install a new, kubernetes caster and then install control, uh install and I'm sure and.

C

Okay, yes uh cooper, the main initial programming.

C

C

No join the note.

C

C

The the new notes in the cluster is ready now.

C

Okay, good pause.

C

Deploy the the intro.

C

Firstly, we must modify the control yarn field.

C

The newest adventure one one thoughts, one dollar, five, so let's modify the yarn field.

C

Okay, okay, see uh I've modified the field before you can see the the the change the equation.

C

So they said that you equals to two.

C

This is a controller. We also need to set it to then, let's deploy the uh deploy, the.

C

C

C

Oh right, I mentioned.

C

um It seems war, the post is running now.

C

Okay, let me see.

C

uh Then, firstly, uh we can create a aesthetic equation.

C

Let me try to create a grease with the prosthetic happy, perversely and his equals eyepiece.

C

Two: six dots, eight.

C

Two six uh tolerator is uh it's another, uh no typey, that's right!.

C

We can say we can see the um the increase in the the nodes. The node ipv is two six dots right.

A

um uh Just a recap: the static uh egress means that that's that the egress ip is like a fixed one right.

C

uh The the the the study uh egress means, the eagles ip um usibi is, is is assigned by yusuf, so that was okay.

C

The the the study.

C

Department department to check the connection between the posts and the external internal nodes, the let me be boy uh high people for right uh port.

C

That's fine! Let's create a name space. First limit space, ammo.

C

Let me check the ports.

C

Okay, the wall post is running.

C

C

Another is in you know,.

C

Okay, we now in the port.

C

C

And then we start a several uh in uh yeah.

C

C

Pif3 and so the server is stuck, we will pin, pin the server from the.

C

From the ports, I.

C

C

Okay, nice, uh then we can see the connection information and now it the the source id is one is 26.8.

C

C

And let me create a increase.

B

I want you a little confused, so so you are running two ports and then your ip. I prove slashing between these two ports right.

C

C

That who pose why scene um note one one is not true. We can see the information.

B

C

Why is in in in notes another one? Another is in you know, so if we um pin from the the the port.

C

We we, we came from the the ports.

C

uh Eight five and uh it's source ip will be no two.

B

Okay, uh probably there's something I missed so the I, the ipod server is not is not on any of this port hyper survey is tonal khan. Sorry, it's turning node right.

C

B

C

B

It that's sorry for foreign.

A

Can you show the ip of the node again, okay,.

C

uh In the class, there are two nodes: uh okay, okay, exactly it's uh dots, one, zero five and the dots eight. Oh.

A

C

The several the seven of the eyepiece is in the bottom, so we can.

C

We can see the.

B

Got it I I know, god, you just want to use ipod to show the clan dive here, the society of the clan yeah. It's a good idea.

C

C

Okay, now we can say the the source the society is: is uh dot one zero five, which is the the control plane nodes ip.

C

Then we its increase with.

C

Okay, uh we can see the egress was great, was created exactly and the equally side piece.

C

C

And then let me try the connection between the client and the server.

C

Okay, so yeah, we can say the source id has changed.

C

The source iv has changed to the the us ip, which is one of the cluster node.

C

So this is. This is a study categories.

C

Okay, now let me go back to the.

B

Yeah for the one thing I observed that the the superfood actually dropped quite a lot. uh Originally, I think it's like four gigabytes per second right. uh Sorry, four gig bits per second right. Now, it's just around 1.5 gigabits. Now it probably is padded, since we have an iso hope um for you guys for the traffic goes to the us, yeah that on the top we can stay here.

C

C

Okay, man, um I think, then we can donate to the ukraine and uh we will show something about the the.

C

External people, how to use external people.

C

So fascinating.

C

Activate increase.

C

A

C

Firstly, that we create a create a internal people.

C

Let me see the external people.

C

C

Okay, uh there is a external people. Resource example, and this is appearance- is staff from two five zero.

B

uh So this iv4 has a single ip right, because that.

C

Yes, okay, uh let me pin the keyboard so so this ip is free.

C

C

uh Now let me go to the information of the internal people.

C

We can see the the total the total ip of the examiner people is one and the user is zero.

C

uh It means uh there are one three ip, the either external people and uh zero of them of them are used.

C

um Then let me create an increase with external people.

C

Okay, uh we will fill the external ippo with the erp test, ip ipv4 dash, one, which is the internal people we just created.

C

A support connector is abb equal to ipr, f3, and so uh let's create a increase. Firstly, then we we will check the ip address of the of the workload.

C

We can see the android egress xero interface, dyno ips ipc in this in this interface, and then we will create with the emails.

C

C

C

The equals ipe was unlocked located to the nodes, the node 1.

C

Let me check the node information.

C

The node one is the control, control, plane, node, and we can see the ip address.

C

C

C

Pin the servo from the post again.

C

Let me see the.

C

Okay, we can see the source ib has changed to the new egress ip one dot fight there, but this is the usability we just pre created.

B

Yeah for this time, the the super is pretty good too right. That's because the the the the client port on the same note as the eagles node.

C

Let me check that I.

B

Guess might be okay.

D

I guess so, maybe when she could try to change the selector node selector of the external p4, so that we can migrate the egress ip to another node to see whether there is degrees.

D

And then this may show the capacity of migrating you glass, eyepiece right.

B

Yeah, that's a good idea, I guess maybe we can try, which.

C

B

uh I guess you need to change the yarmouth. Alright.

C

Because there are only two notes in the cluster: if we want to test the field, we must first create an increase located in in the wakanda. Then we um uh restart the the working order and uh we was- and there was a egress wall well, so we will move to control, plane, node and so.

B

Yeah, I guess probably we don't have time for the overpass. uh I think the change is asking. Could we could we change the to the the worker node? So we can see any change in the bandwidth and we can see if the ego has actually moved to that workload.

B

Yeah, we can also do this.

B

D

Yes, I think so yeah, oh really.

B

I don't know that.

D

We watched the uh update or for eastern ivy poor and we already act.

B

Okay, but in this case, since we just add a new node, uh we will have under existing sun in it or we can we, we might recompute.

D

Yeah we we will compute, because uh it's based on consistent hashing, so.

B

D

How about let's.

B

Let's just try uh we just kept, we just kept two loads in the values and then we replied the yamu.

B

Yeah we, let's can see if we can, you know, support the runtime update and then, if we happen to reassign ip to the new node now uh could we just apply. I I think I think.

D

D

Maybe, let's check again the throughput, so this this update should be transparent to the client that it will keep the original glass ip, but we may expect some decrease in throughput because it is no longer in its same the node, the eagles node will be different from the node. It runs on yeah yeah. We can see yeah.

C

C

B

Okay, we can even show field.

C

The node is is already still ready.

C

B

Just for people don't have enough contacts here. uh Basically, I think when you just shoot, we support all to fade over eos ip, when the current equals node are failed, for example, in the in in this case, when she has reset the node, so it will be removed from cluster, and in that case we can auto, detect the load failure and we are to move the usb from the filter load to the new node, and in this case, since we don't, we just have two nodes, so it will move to the conjugate node.

A

Okay, so if the egress node is changed, will the ip of the node change to the like for, for example, if the first note that is down- and we change the egress node to the second node so well, the node, I p of the second node- be changed to the egress ip.

B

No, uh I think, that's the key right uh we with us. We allow you to specify a particular ip for your ui traffic and we also now. We also want to automatically allocate a dedicated ip for the traffic in either case. We keep the ip unchanged unless you change the policy, otherwise the the ip can move between nodes. If one of the failed, we move to move it to other nodes automatic automatically.

A

Okay, gotcha and the user will not like detect this change. Okay, look at that! That's really smooth.

C

uh Okay, the demo is sorry.

C

But then we go back to the presentation.

A

Oh sorry to interrupt, but there's one more question are the long are long-running tcp connections reset during the egress failover.

A

B

As an answer yes, actually we cannot keep the existing connection since we lose the state tdp state um on the e-waste, node right move to a new node. We don't so far. We don't sync the state between nodes, so the connection will be, uh you know, uh broken and then probably the client will start a new connection.

C

uh Okay: let's go back to the.

C

uh So about the I'm sure which I feel over, we can say it's very fast in the entire agent, because there is a member membrane. Cluster was created in the background when the eagle's future is turned on, uh and the and the local node we were doing was the other um kubernetes nodes in memory cluster, which was using ghostbuster protocol.

C

The ghost political is a community communication protocol that allows state xiaomi in in sharing in uh distributed system, and typically it takes another three seconds to the detector. Note, not the venue.

C

uh So we can see the the intelligent uh quickly detected the node fairly and move the equation to a larger node.

C

um Okay, then uh there are some limitations about the equal feature.

C

The future is a currency.

C

On ipv6, the the support for windows and other traffic modes will be added in the future.

C

So this is the end of my presentation today and feel free to ask any questions uh about time. It seems that the android project will will we will release a new, unsure vision, uh 1.6 uh in this. uh In this release, the uh I'm sure uh virtual will will uh will turn well turn on by default.

C

Okay, it seems that the.

C

Entropy maintenance are.

C

Here I think you they can answer some some more db, some in in-depth technical questions. uh Thank you.

B

Yes, while last time I went she, I got to say we're almost done with the ivory features of this egress functionality.

C

Okay, thank you.

A

Oh sorry, I think that the one here what I'm saying uh I mean that um thanks wendy for this demo, it's really great and really cool to see this running here and and also congratulations to having this feature ready in the entrail 1.6 release, and also like thanks everyone for uh watching this episode and we are about. We are right about time to finish. So. uh Is there any questions? Last one.

A

Okay seems like, um if you like, have any further questions feel free to reach out to us in the andreas slack channel and uh thanks everyone for watching appreciate your time. See you next week, bye, bye,.

B