主页
产品
OpenShift Container Platform
4.19
多网络
3.8. 关于在容器网络命名空间中配置 master 接口

3.8. 关于在容器网络命名空间中配置 master 接口

您可以基于 master 接口创建和管理 MAC-VLAN、IP-VLAN 和 VLAN 子接口。

3.8.1. 关于在容器网络命名空间中配置 master 接口
复制链接

您可以创建一个基于容器命名空间中的 master 接口的 MAC-VLAN、IP-VLAN 或 VLAN 子接口。您还可以在单独的网络附加定义 CRD 中作为 pod 网络配置的一部分创建 master 接口。

要使用容器命名空间 master 接口，您必须为 NetworkAttachmentDefinition CRD 的子接口配置中存在的 linkInContainer 参数指定 true。

3.8.1.1. 在 SR-IOV VF 上创建多个 VLAN
复制链接

您可以根据 SR-IOV VF 创建多个 VLAN。对于此配置，创建一个 SR-IOV 网络，然后为 VLAN 接口定义网络附加。

下图显示了在 SR-IOV VF 上创建多个 VLAN 的设置过程。

先决条件

已安装 OpenShift CLI（oc）。
您可以使用具有 cluster-admin 角色的用户访问集群。
已安装 SR-IOV Network Operator。

流程

使用以下命令，创建您要部署 pod 的专用容器命名空间：
```
oc new-project test-namespace
```
```
$ oc new-project test-namespace
```
Copy to Clipboard Toggle word wrap

创建 SR-IOV 节点策略。

创建一个 SriovNetworkNodePolicy 对象，然后在 sriov-node-network-policy.yaml 文件中保存 YAML：

apiVersion: sriovnetwork.openshift.io/v1
kind: SriovNetworkNodePolicy
metadata:
 name: sriovnic
 namespace: openshift-sriov-network-operator
spec:
 deviceType: netdevice
 isRdma: false
 needVhostNet: true
 nicSelector:
   vendor: "15b3"
   deviceID: "101b"
   rootDevices: ["00:05.0"]
 numVfs: 10
 priority: 99
 resourceName: sriovnic
 nodeSelector:
    feature.node.kubernetes.io/network-sriov.capable: "true"

apiVersion: sriovnetwork.openshift.io/v1
kind: SriovNetworkNodePolicy
metadata:
 name: sriovnic
 namespace: openshift-sriov-network-operator
spec:
 deviceType: netdevice
 isRdma: false
 needVhostNet: true
 nicSelector:
   vendor: "15b3"
   deviceID: "101b"
   rootDevices: ["00:05.0"]
 numVfs: 10
 priority: 99
 resourceName: sriovnic
 nodeSelector:
    feature.node.kubernetes.io/network-sriov.capable: "true"

Copy to Clipboard

Toggle word wrap

其中：

vendor: SR-IOV 网络设备厂商的十六进制代码。值 15b3 与 Mellanox NIC 关联。
deviceID: SR-IOV 网络设备的设备十六进制代码。
注意
SR-IOV 网络节点策略配置示例，使用设置 deviceType: netdevice，专为 Mellanox 网络接口卡(NIC)量身定制。

运行以下命令来应用 YAML 配置：
```
oc apply -f sriov-node-network-policy.yaml
```
```
$ oc apply -f sriov-node-network-policy.yaml
```
Copy to Clipboard Toggle word wrap
注意
应用 YAML 配置可能需要一些时间，因为节点重启操作。

创建 SR-IOV 网络：

如以下示例 CR 所示，为额外的二级 SR-IOV 网络附加创建 SriovNetwork 自定义资源(CR)。将 YAML 保存为 sriov-network-attachment.yaml 文件：

apiVersion: sriovnetwork.openshift.io/v1
kind: SriovNetwork
metadata:
 name: sriov-network
 namespace: openshift-sriov-network-operator
spec:
 networkNamespace: test-namespace
 resourceName: sriovnic
 spoofChk: "off"
 trust: "on"

apiVersion: sriovnetwork.openshift.io/v1
kind: SriovNetwork
metadata:
 name: sriov-network
 namespace: openshift-sriov-network-operator
spec:
 networkNamespace: test-namespace
 resourceName: sriovnic
 spoofChk: "off"
 trust: "on"

Copy to Clipboard

Toggle word wrap

运行以下命令来应用 YAML：
```
oc apply -f sriov-network-attachment.yaml
```
```
$ oc apply -f sriov-network-attachment.yaml
```
Copy to Clipboard Toggle word wrap

创建 VLAN 二级网络。

使用以下 YAML 示例，创建一个名为 vlan100-additional-network-configuration.yaml 的文件：

apiVersion: k8s.cni.cncf.io/v1
kind: NetworkAttachmentDefinition
metadata:
  name: vlan-100
  namespace: test-namespace
spec:
  config: |
    {
      "cniVersion": "0.4.0",
      "name": "vlan-100",
      "plugins": [
        {
          "type": "vlan",
          "master": "ext0",
          "mtu": 1500,
          "vlanId": 100,
          "linkInContainer": true,
          "ipam": {"type": "whereabouts", "ipRanges": [{"range": "1.1.1.0/24"}]}
        }
      ]
    }

apiVersion: k8s.cni.cncf.io/v1
kind: NetworkAttachmentDefinition
metadata:
  name: vlan-100
  namespace: test-namespace
spec:
  config: |
    {
      "cniVersion": "0.4.0",
      "name": "vlan-100",
      "plugins": [
        {
          "type": "vlan",
          "master": "ext0",
          "mtu": 1500,
          "vlanId": 100,
          "linkInContainer": true,
          "ipam": {"type": "whereabouts", "ipRanges": [{"range": "1.1.1.0/24"}]}
        }
      ]
    }

Copy to Clipboard

Toggle word wrap

其中：

master: VLAN 配置需要指定 master 名称。您可以在 pod 的网络注解中指定名称。
linkInContainer: 必须指定 linkInContainer 参数。

运行以下命令来应用 YAML 文件：

oc apply -f vlan100-additional-network-configuration.yaml

$ oc apply -f vlan100-additional-network-configuration.yaml

Copy to Clipboard

Toggle word wrap

使用早期指定的网络创建 pod 定义。

使用以下 YAML 配置示例，创建名为 pod-a.yaml 文件的文件：

注意

清单示例包括以下资源：

带有安全标签的命名空间
带有适当的网络注解的 Pod 定义

apiVersion: v1
kind: Namespace
metadata:
  name: test-namespace
  labels:
    pod-security.kubernetes.io/enforce: privileged
    pod-security.kubernetes.io/audit: privileged
    pod-security.kubernetes.io/warn: privileged
    security.openshift.io/scc.podSecurityLabelSync: "false"
---
apiVersion: v1
kind: Pod
metadata:
  name: nginx-pod
  namespace: test-namespace
  annotations:
    k8s.v1.cni.cncf.io/networks: '[
      {
        "name": "sriov-network",
        "namespace": "test-namespace",
        "interface": "ext0"
      },
      {
        "name": "vlan-100",
        "namespace": "test-namespace",
        "interface": "ext0.100"
      }
    ]'
spec:
  securityContext:
    runAsNonRoot: true
  containers:
    - name: nginx-container
      image: nginxinc/nginx-unprivileged:latest
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop: ["ALL"]
      ports:
        - containerPort: 80
      seccompProfile:
        type: "RuntimeDefault"

apiVersion: v1
kind: Namespace
metadata:
  name: test-namespace
  labels:
    pod-security.kubernetes.io/enforce: privileged
    pod-security.kubernetes.io/audit: privileged
    pod-security.kubernetes.io/warn: privileged
    security.openshift.io/scc.podSecurityLabelSync: "false"
---
apiVersion: v1
kind: Pod
metadata:
  name: nginx-pod
  namespace: test-namespace
  annotations:
    k8s.v1.cni.cncf.io/networks: '[
      {
        "name": "sriov-network",
        "namespace": "test-namespace",
        "interface": "ext0"
      },
      {
        "name": "vlan-100",
        "namespace": "test-namespace",
        "interface": "ext0.100"
      }
    ]'
spec:
  securityContext:
    runAsNonRoot: true
  containers:
    - name: nginx-container
      image: nginxinc/nginx-unprivileged:latest
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop: ["ALL"]
      ports:
        - containerPort: 80
      seccompProfile:
        type: "RuntimeDefault"

Copy to Clipboard

Toggle word wrap

其中：

interface: 用作 VLAN 接口 主接口 的名称。

运行以下命令来应用 YAML 文件：
```
oc apply -f pod-a.yaml
```
```
$ oc apply -f pod-a.yaml
```
Copy to Clipboard Toggle word wrap

运行以下命令，在 test-namespace 中获取 nginx-pod 的详细信息：

oc describe pods nginx-pod -n test-namespace

$ oc describe pods nginx-pod -n test-namespace

Copy to Clipboard

Toggle word wrap

Name:         nginx-pod
Namespace:    test-namespace
Priority:     0
Node:         worker-1/10.46.186.105
Start Time:   Mon, 14 Aug 2023 16:23:13 -0400
Labels:       <none>
Annotations:  k8s.ovn.org/pod-networks:
                {"default":{"ip_addresses":["10.131.0.26/23"],"mac_address":"0a:58:0a:83:00:1a","gateway_ips":["10.131.0.1"],"routes":[{"dest":"10.128.0.0...
              k8s.v1.cni.cncf.io/network-status:
                [{
                    "name": "ovn-kubernetes",
                    "interface": "eth0",
                    "ips": [
                        "10.131.0.26"
                    ],
                    "mac": "0a:58:0a:83:00:1a",
                    "default": true,
                    "dns": {}
                },{
                    "name": "test-namespace/sriov-network",
                    "interface": "ext0",
                    "mac": "6e:a7:5e:3f:49:1b",
                    "dns": {},
                    "device-info": {
                        "type": "pci",
                        "version": "1.0.0",
                        "pci": {
                            "pci-address": "0000:d8:00.2"
                        }
                    }
                },{
                    "name": "test-namespace/vlan-100",
                    "interface": "ext0.100",
                    "ips": [
                        "1.1.1.1"
                    ],
                    "mac": "6e:a7:5e:3f:49:1b",
                    "dns": {}
                }]
              k8s.v1.cni.cncf.io/networks:
                [ { "name": "sriov-network", "namespace": "test-namespace", "interface": "ext0" }, { "name": "vlan-100", "namespace": "test-namespace", "i...
              openshift.io/scc: privileged
Status:       Running
IP:           10.131.0.26
IPs:
  IP:  10.131.0.26

Name:         nginx-pod
Namespace:    test-namespace
Priority:     0
Node:         worker-1/10.46.186.105
Start Time:   Mon, 14 Aug 2023 16:23:13 -0400
Labels:       <none>
Annotations:  k8s.ovn.org/pod-networks:
                {"default":{"ip_addresses":["10.131.0.26/23"],"mac_address":"0a:58:0a:83:00:1a","gateway_ips":["10.131.0.1"],"routes":[{"dest":"10.128.0.0...
              k8s.v1.cni.cncf.io/network-status:
                [{
                    "name": "ovn-kubernetes",
                    "interface": "eth0",
                    "ips": [
                        "10.131.0.26"
                    ],
                    "mac": "0a:58:0a:83:00:1a",
                    "default": true,
                    "dns": {}
                },{
                    "name": "test-namespace/sriov-network",
                    "interface": "ext0",
                    "mac": "6e:a7:5e:3f:49:1b",
                    "dns": {},
                    "device-info": {
                        "type": "pci",
                        "version": "1.0.0",
                        "pci": {
                            "pci-address": "0000:d8:00.2"
                        }
                    }
                },{
                    "name": "test-namespace/vlan-100",
                    "interface": "ext0.100",
                    "ips": [
                        "1.1.1.1"
                    ],
                    "mac": "6e:a7:5e:3f:49:1b",
                    "dns": {}
                }]
              k8s.v1.cni.cncf.io/networks:
                [ { "name": "sriov-network", "namespace": "test-namespace", "interface": "ext0" }, { "name": "vlan-100", "namespace": "test-namespace", "i...
              openshift.io/scc: privileged
Status:       Running
IP:           10.131.0.26
IPs:
  IP:  10.131.0.26

Copy to Clipboard

Toggle word wrap

3.8.1.2. 基于容器命名空间中的网桥主接口创建子接口
复制链接

您可以根据容器命名空间中的桥接 master 接口创建子接口。创建子接口可应用到其他类型的接口。

先决条件

已安装 OpenShift CLI(oc)。
以具有 cluster-admin 权限的用户身份登录 OpenShift Container Platform 集群。

流程

输入以下命令，创建一个要部署 pod 的专用容器命名空间：
```
oc new-project test-namespace
```
```
$ oc new-project test-namespace
```
Copy to Clipboard Toggle word wrap

使用以下 YAML 配置示例，创建一个名为 bridge-nad.yaml 的桥接 NetworkAttachmentDefinition 自定义资源定义(CRD)文件：

apiVersion: "k8s.cni.cncf.io/v1"
kind: NetworkAttachmentDefinition
metadata:
  name: bridge-network
spec:
  config: '{
    "cniVersion": "0.4.0",
    "name": "bridge-network",
    "type": "bridge",
    "bridge": "br-001",
    "isGateway": true,
    "ipMasq": true,
    "hairpinMode": true,
    "ipam": {
      "type": "host-local",
      "subnet": "10.0.0.0/24",
      "routes": [{"dst": "0.0.0.0/0"}]
    }
  }'

apiVersion: "k8s.cni.cncf.io/v1"
kind: NetworkAttachmentDefinition
metadata:
  name: bridge-network
spec:
  config: '{
    "cniVersion": "0.4.0",
    "name": "bridge-network",
    "type": "bridge",
    "bridge": "br-001",
    "isGateway": true,
    "ipMasq": true,
    "hairpinMode": true,
    "ipam": {
      "type": "host-local",
      "subnet": "10.0.0.0/24",
      "routes": [{"dst": "0.0.0.0/0"}]
    }
  }'

Copy to Clipboard

Toggle word wrap

运行以下命令，将 NetworkAttachmentDefinition CRD 应用到 OpenShift Container Platform 集群：
```
oc apply -f bridge-nad.yaml
```
```
$ oc apply -f bridge-nad.yaml
```
Copy to Clipboard Toggle word wrap
输入以下命令验证您是否已成功创建了 NetworkAttachmentDefinition CRD。预期输出显示 NAD CRD 的名称和创建年龄（以分钟为单位）。
```
oc get network-attachment-definitions
```
```
$ oc get network-attachment-definitions
```
Copy to Clipboard Toggle word wrap

使用以下 YAML 示例，为 IPVLAN 二级网络配置创建一个名为 ipvlan-additional-network-configuration.yaml 的文件：

apiVersion: k8s.cni.cncf.io/v1
kind: NetworkAttachmentDefinition
metadata:
  name: ipvlan-net
  namespace: test-namespace
spec:
  config: '{
    "cniVersion": "0.3.1",
    "name": "ipvlan-net",
    "type": "ipvlan",
    "master": "net1",
    "mode": "l3",
    "linkInContainer": true,
    "ipam": {"type": "whereabouts", "ipRanges": [{"range": "10.0.0.0/24"}]}
  }'

apiVersion: k8s.cni.cncf.io/v1
kind: NetworkAttachmentDefinition
metadata:
  name: ipvlan-net
  namespace: test-namespace
spec:
  config: '{
    "cniVersion": "0.3.1",
    "name": "ipvlan-net",
    "type": "ipvlan",
    "master": "net1",
    "mode": "l3",
    "linkInContainer": true,
    "ipam": {"type": "whereabouts", "ipRanges": [{"range": "10.0.0.0/24"}]}
  }'

Copy to Clipboard

Toggle word wrap

其中：

master: 指定要与网络附加关联的以太网接口。之后，以太网接口会在 pod 网络注解中配置。
linkInContainer: 指定容器网络命名空间中存在 master 接口。

运行以下命令来应用 YAML 文件：

oc apply -f ipvlan-additional-network-configuration.yaml

$ oc apply -f ipvlan-additional-network-configuration.yaml

Copy to Clipboard

Toggle word wrap

运行以下命令验证 NetworkAttachmentDefinition CRD 是否已成功创建。预期输出显示 NAD CRD 的名称和创建年龄（以分钟为单位）。
```
oc get network-attachment-definitions
```
```
$ oc get network-attachment-definitions
```
Copy to Clipboard Toggle word wrap

使用以下 YAML 配置示例，为 pod 定义创建一个名为 pod-a.yaml 的文件：

apiVersion: v1
kind: Pod
metadata:
  name: pod-a
  namespace: test-namespace
  annotations:
    k8s.v1.cni.cncf.io/networks: '[
      {
        "name": "bridge-network",
        "interface": "net1" 
      },
      {
        "name": "ipvlan-net",
        "interface": "net2"
      }
    ]'
spec:
  securityContext:
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: test-pod
    image: quay.io/openshifttest/hello-sdn@sha256:c89445416459e7adea9a5a416b3365ed3d74f2491beb904d61dc8d1eb89a72a4
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop: [ALL]

apiVersion: v1
kind: Pod
metadata:
  name: pod-a
  namespace: test-namespace
  annotations:
    k8s.v1.cni.cncf.io/networks: '[
      {
        "name": "bridge-network",
        "interface": "net1"


      },
      {
        "name": "ipvlan-net",
        "interface": "net2"
      }
    ]'
spec:
  securityContext:
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: test-pod
    image: quay.io/openshifttest/hello-sdn@sha256:c89445416459e7adea9a5a416b3365ed3d74f2491beb904d61dc8d1eb89a72a4
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop: [ALL]

Copy to Clipboard

Toggle word wrap

其中：

k8s.v1.cni.cncf.io/networks,interface: 指定用作 IPVLAN 接口的 master 的名称。

运行以下命令来应用 YAML 文件：
```
oc apply -f pod-a.yaml
```
```
$ oc apply -f pod-a.yaml
```
Copy to Clipboard Toggle word wrap

验证

使用以下命令验证 pod 是否正在运行：

oc get pod -n test-namespace

$ oc get pod -n test-namespace

Copy to Clipboard

Toggle word wrap

NAME    READY   STATUS    RESTARTS   AGE
pod-a   1/1     Running   0          2m36s

NAME    READY   STATUS    RESTARTS   AGE
pod-a   1/1     Running   0          2m36s

Copy to Clipboard

Toggle word wrap

运行以下命令，显示 test-namespace 中 pod-a 资源的网络接口信息：

oc exec -n test-namespace pod-a -- ip a

$ oc exec -n test-namespace pod-a -- ip a

Copy to Clipboard

Toggle word wrap

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
3: eth0@if105: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1400 qdisc noqueue state UP group default
    link/ether 0a:58:0a:d9:00:5d brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 10.217.0.93/23 brd 10.217.1.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::488b:91ff:fe84:a94b/64 scope link
       valid_lft forever preferred_lft forever
4: net1@if107: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
    link/ether be:da:bd:7e:f4:37 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 10.0.0.2/24 brd 10.0.0.255 scope global net1
       valid_lft forever preferred_lft forever
    inet6 fe80::bcda:bdff:fe7e:f437/64 scope link
       valid_lft forever preferred_lft forever
5: net2@net1: <BROADCAST,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default
    link/ether be:da:bd:7e:f4:37 brd ff:ff:ff:ff:ff:ff
    inet 10.0.0.1/24 brd 10.0.0.255 scope global net2
       valid_lft forever preferred_lft forever
    inet6 fe80::beda:bd00:17e:f437/64 scope link
       valid_lft forever preferred_lft forever

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
3: eth0@if105: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1400 qdisc noqueue state UP group default
    link/ether 0a:58:0a:d9:00:5d brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 10.217.0.93/23 brd 10.217.1.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::488b:91ff:fe84:a94b/64 scope link
       valid_lft forever preferred_lft forever
4: net1@if107: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
    link/ether be:da:bd:7e:f4:37 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 10.0.0.2/24 brd 10.0.0.255 scope global net1
       valid_lft forever preferred_lft forever
    inet6 fe80::bcda:bdff:fe7e:f437/64 scope link
       valid_lft forever preferred_lft forever
5: net2@net1: <BROADCAST,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default
    link/ether be:da:bd:7e:f4:37 brd ff:ff:ff:ff:ff:ff
    inet 10.0.0.1/24 brd 10.0.0.255 scope global net2
       valid_lft forever preferred_lft forever
    inet6 fe80::beda:bd00:17e:f437/64 scope link
       valid_lft forever preferred_lft forever

Copy to Clipboard

Toggle word wrap

此输出显示网络接口 net2 与物理接口 net1 关联。

返回顶部

3.8. 关于在容器网络命名空间中配置 master 接口

3.8.1. 关于在容器网络命名空间中配置 master 接口
复制链接

3.8.1.1. 在 SR-IOV VF 上创建多个 VLAN
复制链接

3.8.1.2. 基于容器命名空间中的网桥主接口创建子接口
复制链接

学习

尝试、购买和销售

社区

关于红帽文档

让开源更具包容性

關於紅帽

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links

3.8. 关于在容器网络命名空间中配置 master 接口

3.8.1. 关于在容器网络命名空间中配置 master 接口复制链接链接已复制到粘贴板!

3.8.1.1. 在 SR-IOV VF 上创建多个 VLAN复制链接链接已复制到粘贴板!

3.8.1.2. 基于容器命名空间中的网桥主接口创建子接口复制链接链接已复制到粘贴板!

学习

尝试、购买和销售

社区

关于红帽文档

让开源更具包容性

關於紅帽

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links

3.8.1. 关于在容器网络命名空间中配置 master 接口
复制链接

3.8.1.1. 在 SR-IOV VF 上创建多个 VLAN
复制链接

3.8.1.2. 基于容器命名空间中的网桥主接口创建子接口
复制链接