绯诲垪鏂囩珷
- Cilium 绯诲垪鏂囩珷
鍓嶈█
灏?Kubernetes 鐨?CNI 浠庡叾浠栫粍浠跺垏鎹负 Cilium, 宸茬粡鍙互鏈夋晥鍦版彁鍗囩綉缁滅殑鎬ц兘. 浣嗘槸閫氳繃瀵?Cilium 涓嶅悓妯″紡鐨勫垏鎹?鍔熻兘鐨勫惎鐢? 鍙互杩涗竴姝ユ彁鍗?Cilium 鐨勭綉缁滄€ц兘. 鍏蜂綋璋冧紭椤瑰寘鎷笉闄愪簬:
- 鍚敤鏈湴璺敱(Native Routing)
- 瀹屽叏鏇挎崲 KubeProxy
- IP 鍦板潃浼(Masquerading)鍒囨崲涓哄熀浜?eBPF 鐨勬ā寮?/li>
- Kubernetes NodePort 瀹炵幇鍦?DSR(Direct Server Return) 妯″紡涓嬭繍琛?/li>
- 缁曡繃 iptables 杩炴帴璺熻釜(Bypass iptables Connection Tracking)
- 涓绘満璺敱(Host Routing)鍒囨崲涓哄熀浜?BPF 鐨勬ā寮?(闇€瑕?Linux Kernel >= 5.10)
- 鍚敤 IPv6 BIG TCP (闇€瑕?Linux Kernel >= 5.19)
绂佺敤 Hubble(浣嗘槸涓嶅缓璁? 鍙瀵熸€ф瘮涓€鐐圭偣鐨勬€ц兘鎻愬崌鏇撮噸瑕?- 淇敼 MTU 涓哄法鍨嬪抚(jumbo frames) (闇€瑕佺綉缁滄潯浠跺厑璁?
- 鍚敤甯﹀绠＄悊鍣?Bandwidth Manager) (闇€瑕?Kernel >= 5.1)
- 鍚敤 Pod 鐨?BBR 鎷ュ鎺у埗 (闇€瑕?Kernel >= 5.18)
- 鍚敤 XDP 鍔犻€?(闇€瑕?鏀寔鏈湴 XDP 椹卞姩绋嬪簭)
- (楂樼骇鐢ㄦ埛鍙€?璋冩暣 eBPF Map Size
- Linux Kernel 浼樺寲鍜屽崌绾?
CONFIG_PREEMPT_NONE=y
- 鍏朵粬:
- tuned network-* profiles, 濡?
tuned-adm profile network-latency鎴?network-throughput - CPU 璋冧负鎬ц兘妯″紡
- 鍋滄
irqbalance锛屽皢缃戝崱涓柇寮曡剼鎸囧悜鐗瑰畾 CPU
- tuned network-* profiles, 濡?
鍦ㄧ綉缁?缃戝崱璁惧/OS绛夋潯浠舵弧瓒崇殑鎯呭喌涓? 鎴戜滑灏藉彲鑳藉鍦板惎鐢ㄨ繖浜涜皟浼橀€夐」, 鐩稿叧浼樺寲椤逛細鍦ㄥ悗缁枃绔犻€愪竴鏇存柊. 鏁鏈熷緟.
浠婂ぉ鎴戜滑鏉ヨ皟浼?Cilium, 鍚敤 XDP 鍔犻€? 浠ヤ究鑳藉鐩存帴浠?strong>缃戠粶椹卞姩灞?/strong>澶勭悊 NodePort 绛夊叆绔欒姹傦紝杩欐湁鍔╀簬鍑忓皯寤惰繜鍜屾墿灞曟湇鍔°€傚彟澶栧苟瀵?Cilium 鎬ц兘璋冧紭鍋氶樁娈垫€荤粨.
XDP 鍔犻€?/h2>
Cilium 鍐呯疆浜嗗 NodePort銆丩oadBalancer 鏈嶅姟鍜屽叿鏈夊閮?IP 鐨勬湇鍔＄殑鍔犻€熸敮鎸侊紝浠ヤ究鍦ㄥ悗绔綅浜庤繙绋嬭妭鐐规椂锛屽皢鍒拌揪鐨勮姹備粠璇ヨ妭鐐圭洿鎺ユ帹鍥炪€傝鍔熻兘鍦?Cilium 1.8 鐗堢殑 XDP锛坋Xpress Data Path锛夊眰涓紩鍏ワ紝eBPF 鐩存帴鍦ㄧ綉缁滈┍鍔ㄧ▼搴忎腑杩愯锛岃€屼笉鏄湪鏇撮珮灞備腑杩愯銆?/p>
鍦ㄨ繖绉嶆儏鍐典笅锛岀綉缁滄暟鎹寘涓嶉渶瑕佷竴鐩存帹閫佸埌涓婂眰缃戠粶鍫嗘爤锛岃€屾槸鍦?XDP 鐨勫府鍔╀笅锛孋ilium 鑳藉鐩存帴浠?strong>缃戠粶椹卞姩灞?/strong>澶勭悊杩欎簺璇锋眰銆傞壌浜庡崟涓妭鐐圭殑杞彂鑳藉姏澶у箙鎻愰珮锛岃繖鏈夊姪浜庡噺灏戝欢杩熷拰鎵╁睍鏈嶅姟銆備粠 Cilium 1.8 鐗堝紑濮嬶紝XDP 灞傜殑 kube-proxy 灏嗚鏇挎崲銆?/p>
瑕佹眰
- Kernel >= 4.19.57, >= 5.1.16, >= 5.2
- 鏀寔鍘熺敓鐨?XDP 椹卞姩绋嬪簭锛屽叿浣撹鏌ョ湅 Cilium 鐨勯┍鍔ㄧ▼搴忓垪琛?
- Direct-routing 閰嶇疆
- 鍩轰簬 eBPF 鐨?kube-proxy 鏇挎崲
瑕佸惎鐢?XDP 鍔犻€燂紝璇锋煡鐪?Cilium 鐨勫叆闂ㄦ寚鍗楋紝鍏朵腑杩樺寘鍚湪鍏叡浜戞彁渚涘晢涓婅繘琛岃缃殑璇存槑銆?/p>
璇ユā寮忚缃?loadBalancer.acceleration 鍏佽閫氳繃 native 閫夐」鍚敤鍔犻€熴€傜鐢ㄩ€夐」鏄粯璁ら€夐」锛岀敤浜庣鐢ㄥ姞閫熴€?strong>澶у鏁版敮鎸?10G 鎴栨洿楂橀€熺巼鐨勯┍鍔ㄧ▼搴忓湪鏈€鏂板唴鏍镐笂涔熸敮鎸?native XDP銆傚浜庡熀浜庝簯鐨勯儴缃诧紝杩欎簺椹卞姩绋嬪簭涓殑澶у鏁伴兘鏈夋敮鎸佹湰鍦?XDP 鐨?SR-IOV 鍙樹綋銆傚浜庡唴閮ㄩ儴缃诧紝Cilium XDP 鍔犻€熷彲涓?Kubernetes 鐨勮礋杞藉钩琛″櫒鏈嶅姟瀹炵幇锛堝 MetalLB锛夌粨鍚堜娇鐢ㄣ€傚姞閫熷姛鑳藉彧鑳藉湪鐢ㄤ簬鐩存帴璺敱鐨勫崟涓澶囦笂鍚敤銆?/p>
璐熻浇骞宠 鍣ㄥ姞閫熻缃敮鎸?DSR銆丼NAT 鍜屾贩鍚堟ā寮?
涓轰簡浜嗚В Cilium 鐨?XDP 鏈嶅姟鍔犻€熷湪鍏ㄥ眬涓殑浣嶇疆锛屼笅鏂囩畝瑕佷粙缁嶄簡 Cilium 1.8 鐨勬湇鍔¤礋杞藉钩琛℃灦鏋?
鍙互鐪嬪嚭锛孋ilium 鍦?eBPF 涓殑 kube-proxy 鏇夸唬鏂规鍦ㄩ珮灞備笂鐢变袱涓富瑕侀儴鍒嗙粍鎴愶細濂楁帴瀛楀眰鐨?eBPF 鍜岄┍鍔ㄥ眰鐨?eBPF銆?/p>
- 涓滆タ鍚戞祦閲忥紝鍗虫墍鏈?Cilium 绠＄悊鑺傜偣涔嬮棿鐨勬湇鍔℃祦閲忥紝浠呭湪鍐呮牳鐨勫鎺ュ瓧灞傚鐞嗭紝鍦ㄦ涔嬪墠涓嶄細涓烘暟鎹寘鍏冩暟鎹垎閰嶅唴瀛樸€傚湪杩欎竴鐐逛笂鎵ц锛屽彲浣?Cilium 娑堥櫎鏈嶅姟杞崲鐨勬瘡鍖呮垚鏈€?/li>
- 鍗楀寳娴侀噺锛屽嵆浠庡閮ㄦ簮鍒?Cilium 绠＄悊鑺傜偣鐨勬墍鏈夊叆绔欐湇鍔℃祦閲忥紝閮藉湪灏藉彲鑳介潬杩戦┍鍔ㄥ眰鐨勫湴鏂硅繘琛屽鐞嗭紝鍦ㄥ崟涓帴鍙ｄ笂杩涜鍏ュ彛鍜屽嚭鍙ｆ搷浣溿€傝繖鏍峰氨鑳介潪甯稿揩閫熷湴澶勭悊杞彂锛岀敋鑷冲彲浠ュ湪鍫嗘爤涓婂眰杩涜浠讳綍鏄傝吹鐨勬搷浣滀箣鍓嶏紝灏嗘祦閲忎涪寮冩垨鍙嶅皠鍥炲叆绔欐帴鍙ｃ€傚鐞嗗崡鍖楁祦閲忕殑鍚庝竴涓粍浠跺垯閫氳繃 XDP 杩涜鍔犻€熴€?/li>
Cilium 鐨勬湇鍔?XDP 鍔犻€熺洰鍓嶆敮鎸佺洿鎺ヨ矾鐢辨ā寮忥紝涓庢垜浠殑 tc eBPF 瀹炵幇鍏变韩鐩稿悓鐨勬牳蹇冧唬鐮併€傚湪 XDP 鏈嶅姟杞崲鍚庯紝鎻愪緵浜嗕笁绉嶅皢娴侀噺閲嶅畾鍚戝埌杩滅▼鍚庣鐨勯€夐」锛欴SR銆丼NAT 鍜?Hybrid銆?/p>
瀹炴柦
helm upgrade cilium cilium/cilium --version 1.13.4 \
--namespace kube-system \
--reuse-values \
--set loadBalancer.acceleration=native
楠岃瘉
瑕侀獙璇佹偍鐨勫畨瑁呮槸鍚︿娇鐢ㄤ簡 XDP 鍔犻€熷姛鑳斤紝璇峰湪浠讳綍涓€涓?Cilium pod 涓繍琛?cilium status锛屽苟鏌ユ壘鎶ュ憡 "XDP Acceleration"鐘舵€佺殑琛岋紝鍏朵腑搴旀樉绀?"Native"銆傚涓嬫墍绀?
$ kubectl -n kube-system exec ds/cilium -- cilium status --verbose | grep XDP
XDP Acceleration: Native
璇锋敞鎰忥紝鍦?XDP 灞備负澶勭悊 NodePort 鑰屼粠璁惧鎺ㄥ洖鐨勬暟鎹寘鍦?tcpdump 涓槸鐪嬩笉鍒扮殑锛屽洜涓烘暟鎹寘鎶藉ご鏄湪缃戠粶鍫嗘爤鐨勮緝鍚庨樁娈靛嚭鐜扮殑銆傚彲浠ヤ娇鐢?Cilium 鐨勭洃鎺у懡浠ゆ垨 metric counters 鏉ヨ幏寰楀彲瑙佹€с€?/p>
鎬ц兘鎻愬崌
Cilium 杩涜浜嗗垵姝ョ殑鍩哄噯娴嬭瘯锛屽皢鍗曚釜鏈嶅姟閮ㄧ讲鍒颁竴涓垰鍒氶儴缃蹭簡 kubeadm 鐨勮妭鐐逛笂锛岃鑺傜偣鐨勫唴鏍镐负 5.7锛屼娇鐢ㄥ熀浜?iptables 鍜?ipvs 鐨?kube-proxy 杩愯浠ヨ幏寰楀熀绾匡紝鐒跺悗灏?Cilium 鐨?kube-proxy 鏇挎崲浠?tc 鍜?XDP 绔彃鍏?eBPF锛屽苟灏嗗叾缃簬 eBPF 鐨勬鍓嶆柟锛?/p>
鍒濇缁撴灉鏄剧ず锛孋ilium 鐨?kube-proxy 鏇夸唬鍝佺殑 XDP 鍔犻€熻兘鍔涘ぇ骞呮彁鍗囷紝鑳藉鏈€澶ч檺搴﹀湴鍒╃敤鏁版嵁鍖呯敓鎴愬櫒锛屽皢鎵€鏈?1000 涓囦釜浼犲叆璇锋眰鎺ㄩ€佸埌杩滅▼鏈嶅姟鍚庣锛岃€屼娇鐢?kube-proxy 鏃讹紝琚祴鑺傜偣姣忕鍙兘涓哄悓涓€鏈嶅姟杞彂绾?210 涓囦釜璇锋眰锛屽叾浣欒姹傚垯浼氳涓㈠純銆傚湪 ipvs 涓篃瑙傚療鍒颁簡绫讳技鐨勬儏鍐碉紝灏界涓?iptables 鐩告瘮锛宨pvs 瀵瑰ぇ閲忔湇鍔＄殑 "棣栧寘 "鍙墿灞曟€ф洿濂斤紝浣嗘瘡鍖呮垚鏈技涔庣暐楂樸€傚皢 kube-proxy 鏇挎崲涓?Cilium 鐨?tc eBPF 瀹炵幇锛屼笉浠呰В鍐充簡 "绗竴鏁版嵁鍖?鍙墿灞曟€ч棶棰橈紝杩樻彁楂樹簡鎬ц兘锛岃繖涓€鐐逛粠璇ヨ妭鐐规瘡绉掔害 360 涓囨璇锋眰涓彲浠ョ湅鍑猴紝涓嶈繃杩欎粛鐒舵棤娉曚笌 Cilium 鍦?XDP 灞傝繘琛屽姞閫熸椂鑾峰緱鐨勬樉钁楀鐩婄浉姣旓細
姣旇緝 kube-proxy 鍜?Cilium 鐨?XDP 瀹炵幇鍦ㄦ瘡绉?1000 涓囨璇锋眰涓嬬殑鐏劙鍥撅紝杩樻樉绀轰簡鍦ㄩ┍鍔ㄧ▼搴忕殑杞渚嬬▼涓姞閫熸湇鍔″鐞嗙殑鎹峰緞銆傛澶栵紝涓庡湪 tc 涓嬭繍琛?eBPF 鐨?Cilium 浠ュ強鍦?iptables 鍜?ipvs 妯″紡涓嬬殑 kube-proxy 鐩告瘮锛屽湪 softirq 鐜涓嬶紝XDP 鍔犻€熻浆鍙戞墍闇€鐨勫鐞嗗紑閿€瑕佸皯寰楀銆備笅闈㈢殑娴嬭瘯鍦ㄥ師鏈┖闂茬殑绯荤粺涓婅繍琛岋紝鑺傜偣鐨?CPU 浠呯敤浜庡鐞?softirq銆傚浘涓樉绀轰簡鍙敤鐨勫墿浣?CPU 瀹归噺銆備粠鍥句腑鍙互鐪嬪嚭锛屽嵆浣垮湪鐗瑰畾鑺傜偣姣忕绾?100 涓囦釜璇锋眰鐨勪綆閫熺巼涓嬶紝CPU 涔熷彧灏嗙害 13% 鐨勬椂闂寸敤浜庡鐞?XDP 鐨?softirq 涓婁笅鏂囷紝鍥犳杩樻湁 87% 鐨勫墿浣欏閲忓彲鐢ㄤ簬鍏朵粬鏂归潰锛岃€屽湪 kube-proxy 鎯呭喌涓嬶紝CPU 鑷冲皯灏?60% 鐨勬椂闂寸敤浜庢湇鍔?softirq 涓婁笅鏂囷紝鏈€澶氬彧鏈?40% 鐨勫墿浣欏彲鐢ㄥ閲忋€傚湪姣忕绾?200 涓囨垨 400 涓囦釜璇锋眰鐨勬儏鍐典笅锛宬ube-proxy 鐨勬儏鍐典細鍙樺緱鏇寸碂锛屽彧鏈?1-2% 鐨勭┖闂蹭唤棰濓紝鑰?CPU 瑕佽姳 98% 鐨勬椂闂村湪 softirq 涓婁笅鏂囦腑澶勭悊鏁版嵁鍖咃細
绠€鑰岃█涔嬶紝鍒╃敤 Cilium 鍔犻€?XDP 涓嬬殑 Kubernetes 鏈嶅姟澶勭悊锛?strong>鍙ぇ骞呮彁楂樺悜杩滅▼鍚庣鎺ㄩ€佹暟鎹寘鐨勬€ц兘锛屽悓鏃舵樉钁楅檷浣?CPU 寮€閿€銆傚湪榛樿澶栭儴娴侀噺绛栫暐锛?code>externalTrafficPolicy: Cluster锛変笅锛岃繖涔?strong>鎻愰珮浜嗛泦缇ょ殑鏁翠綋瀹归噺銆傝繖鎰忓懗鐫€锛屽皢鏈嶅姟鎵╁睍鍒版洿澶氬悗绔彧鑳借揪鍒板崟涓妭鐐瑰悜杩欎簺鍚庣杞彂鑳藉姏鐨勪笂闄愩€備笉杩囷紝鍗充娇 Kubernetes 閮ㄧ讲涓嶉渶瑕佸鐞嗛偅涔堝鏁版嵁鍖咃紝杩欎簺 CPU 鍛ㄦ湡涔熷彲浠ラ噴鏀惧嚭鏉ワ紝鐢ㄤ簬瀹為檯鐨勭敤鎴峰伐浣滆礋杞姐€?/p>
灏忕粨
鏈枃缁х画璋冧紭 Cilium, 鍚敤 XDP 鍔犻€? 浠ヤ究鑳藉鐩存帴浠庣綉缁滈┍鍔ㄥ眰澶勭悊 NodePort 绛夊叆绔欒姹? 鍏蜂綋鏀剁泭涓?
- 澶у箙鎻愰珮鍚戣繙绋嬪悗绔帹閫佹暟鎹寘鐨勬€ц兘
- 鏄捐憲闄嶄綆 CPU 寮€閿€
- 鎻愰珮闆嗙兢鐨勬暣浣撳閲?/li>
鑷虫锛屾€ц兘璋冧紭宸插畬鎴愬疄鎴橀獙璇侊細
- 鉁旓笍 鍚敤鏈湴璺敱 (Native Routing)
- 鉁旓笍 瀹屽叏鏇挎崲 KubeProxy
- 鉁旓笍 IP 鍦板潃浼 (Masquerading) 鍒囨崲涓哄熀浜?eBPF 鐨勬ā寮?/li>
- 鉁旓笍 Kubernetes NodePort 瀹炵幇鍦?DSR(Direct Server Return) 妯″紡涓嬭繍琛?/li>
- 鉁旓笍 缁曡繃 iptables 杩炴帴璺熻釜 (Bypass iptables Connection Tracking)
- 鉁旓笍 涓绘満璺敱 (Host Routing) 鍒囨崲涓哄熀浜?BPF 鐨勬ā寮?(闇€瑕?Linux Kernel >= 5.10)
- 鉂?鍚敤 IPv6 BIG TCP (闇€瑕?Linux Kernel >= 5.19, 鏀寔鐨?NICs: mlx4, mlx5)
- 鐢变簬娌℃湁鏀寔鐨勭綉鍗? 鏃犳硶瀹屾垚楠岃瘉
- 鉂?淇敼 MTU 涓哄法鍨嬪抚 (jumbo frames) 锛堥渶瑕佺綉缁滄潯浠跺厑璁革級
- 鐢变簬缃戠粶鏉′欢涓嶅厑璁? 鏃犳硶瀹屾垚楠岃瘉
- 鉁旓笍 鍚敤甯﹀绠＄悊鍣?(Bandwidth Manager) (闇€瑕?Kernel >= 5.1)
- 鉁旓笍 鍚敤 Pod 鐨?BBR 鎷ュ鎺у埗 (闇€瑕?Kernel >= 5.18)
- 鉁旓笍 鍚敤 XDP 鍔犻€?锛堥渶瑕?鏀寔鏈湴 XDP 椹卞姩绋嬪簭锛?/li>
Cilium 鎬ц兘璋冧紭鎬荤粨
鑷虫, 鎴戜滑闃舵鎬у湴瀹屾垚浜?Cilium 涓昏鐨勬€ц兘浼樺寲鐐?
Cilium 璋冧紭鍒嗕负浠ヤ笅鍑犱釜澶х淮搴?
- Cilium 璋冧紭
- 搴曞眰缃戠粶璋冧紭
- Linux Kernel 浼樺寲鍜屽崌绾?/li>
- 鍏朵粬缁村害璋冧紭
Cilium 璋冧紭
Cilium 璋冧紭鍖呮嫭:
- 鍚敤鏈湴璺敱(Native Routing)
- 瀹屽叏鏇挎崲 KubeProxy
- IP 鍦板潃浼(Masquerading)鍒囨崲涓哄熀浜?eBPF 鐨勬ā寮?/li>
- Kubernetes NodePort 瀹炵幇鍦?DSR(Direct Server Return) 妯″紡涓嬭繍琛?/li>
- 缁曡繃 iptables 杩炴帴璺熻釜(Bypass iptables Connection Tracking)
- 涓绘満璺敱(Host Routing)鍒囨崲涓哄熀浜?BPF 鐨勬ā寮?(闇€瑕?Linux Kernel >= 5.10)
- 鍚敤 IPv6 BIG TCP (闇€瑕?Linux Kernel >= 5.19)
绂佺敤 Hubble(浣嗘槸涓嶅缓璁? 鍙瀵熸€ф瘮涓€鐐圭偣鐨勬€ц兘鎻愬崌鏇撮噸瑕?- 鍚敤甯﹀绠＄悊鍣?Bandwidth Manager) (闇€瑕?Kernel >= 5.1)
- 鍚敤 Pod 鐨?BBR 鎷ュ鎺у埗 (闇€瑕?Kernel >= 5.18)
- 鍚敤 XDP 鍔犻€?(闇€瑕?鏀寔鏈湴 XDP 椹卞姩绋嬪簭)
- (楂樼骇鐢ㄦ埛鍙€?璋冩暣 eBPF Map Size
搴曞眰缃戠粶璋冧紭
搴曞眰缃戠粶璋冧紭鍖呮嫭:
- 淇敼 MTU 涓哄法鍨嬪抚(jumbo frames) (闇€瑕佺綉缁滄潯浠跺厑璁?
Linux Kernel 浼樺寲鍜屽崌绾?/h3>
Linux Kernel 浼樺寲鍜屽崌绾у寘鎷?
CONFIG_PREEMPT_NONE=y
鍏朵粬缁村害璋冧紭
鍏朵粬缁村害璋冧紭鍖呮嫭:
- tuned network-* profiles, 濡?
tuned-adm profile network-latency鎴?network-throughput - CPU 璋冧负鎬ц兘妯″紡
- 鍋滄
irqbalance锛屽皢缃戝崱涓柇寮曡剼鎸囧悜鐗瑰畾 CPU
Cilium "缁堟瀬"浼樺寲閰嶇疆
鏍规嵁涓汉缁忛獙, 鎺ㄨ崘鐨?Cilium "鎬ц兘妯″紡" 閰嶇疆涓?
棣栧厛, Kernel >= 5.10, 杩欐槸鏈€鏂扮殑绋冲畾鐗堢殑鍐呮牳, 鍙互鍚敤瀵硅皟浼橀潪甯搁噸瑕佺殑"鍩轰簬 BPF 鐨勪富鏈鸿矾鐢?鍔熻兘, 鍙互鍚敤 Cilium 鐨勫ぇ閮ㄥ垎鍔熻兘, 濡備笅:
| Cilium 鍔熻兘 | 鏈€灏?Kernel 鐗堟湰 |
|---|---|
| 甯﹀绠＄悊鍣?/td> | >= 5.1 |
| Egress Gateway | >= 5.2 |
| VXLAN 闅ч亾绔偣 (VTEP) 闆嗘垚 | >= 5.2 |
| WireGuard 閫忔槑鍔犲瘑 | >= 5.6 |
| Session Affinity鐨勫畬鏁存敮鎸?/td> | >= 5.7 |
| 鍩轰簬 BPF 鐨勪唬鐞嗛噸瀹氬悜 | >= 5.7 |
| pod netns 涓殑濂楁帴瀛楃骇 LB 鏃佽矾 | >= 5.7 |
| L3 璁惧 | >= 5.8 |
| 鍩轰簬 BPF 鐨勪富鏈鸿矾鐢?/td> | >= 5.10 |
| Pod 鐨?BBR 鎷ュ鎺у埗 | >=5.18 |
| IPv6 BIG TCP 鏀寔 | >= 5.19 |
涔嬪悗, 鎺ㄨ崘 Cilium 閰嶇疆鍜屽姛鑳藉寘鎷?
- 绂佺敤闅ч亾, 绂佺敤鍔犲瘑
- 鍚敤鏈湴璺敱(Native Routing)
- 瀹屽叏鏇挎崲 KubeProxy
- IP 鍦板潃浼(Masquerading)鍒囨崲涓哄熀浜?eBPF 鐨勬ā寮?/li>
- Kubernetes NodePort 瀹炵幇鍦?DSR(Direct Server Return) 妯″紡涓嬭繍琛?/li>
- 涓绘満璺敱(Host Routing)鍒囨崲涓哄熀浜?BPF 鐨勬ā寮?(闇€瑕?Linux Kernel >= 5.10)
- 鍚敤甯﹀绠＄悊鍣?Bandwidth Manager) (闇€瑕?Kernel >= 5.1)
- 鍚敤 XDP 鍔犻€?(闇€瑕?鏀寔鏈湴 XDP 椹卞姩绋嬪簭, 浣嗘槸澶ч儴鍒?10G/40G 缃戝崱, 鍖呮嫭铏氭嫙缃戝崱浠ュ強浜戜緵搴斿晢宸茬粡鏀寔浜?)
缁曡繃 iptables 杩炴帴璺熻釜(Bypass iptables Connection Tracking) 灏辨槸鍙€夐」浜? 鍥犱负鍚敤浜?鍩轰簬 BPF 妯″紡鐨勪富鏈鸿矾鐢?鍚? 鏄病鏈夊繀瑕佽缃敼閫夐」鐨?
鍚敤 IPv6 BIG TCP 涓嶅缓璁惎鐢? 涓€鏂归潰鏄鍐呮牳瑕佹眰杈冮珮, 闇€瑕?Linux Kernel >= 5.19; 鍙︿竴鏂归潰鏄?IPv6 鍦?Kubernetes 鐨勪娇鐢ㄨ繕鏈ぇ瑙勬ā鏅強.
涔熶笉寤鸿涓轰簡鎻愬崌鎬ц兘鑰岀鐢?Hubble, 鍥犱负鍙瀵熸€ф瘮涓€鐐圭偣鐨勬€ц兘鎻愬崌鏇撮噸瑕?
涓嶅缓璁惎鐢?Pod 鐨?BBR 鎷ュ鎺у埗, 涔熸槸鍥犱负鍏跺鍐呮牳瑕佹眰杈冮珮, 闇€瑕?Kernel >= 5.18. 鏈夋潯浠剁殑鍙互鎸夐渶鍚敤.
鏈€缁? 瀹夎鐨勫懡浠ゅ涓?
helm install cilium cilium/cilium --version 1.13.4 \
--namespace kube-system \
--set operator.replicas=2 \
--set hubble.relay.enabled=true \
--set hubble.ui.enabled=true
--set tunnel=disabled \
--set kubeProxyReplacement=strict \
--set bpf.masquerade=true \
--set loadBalancer.mode=dsr \
--set bandwidthManager.enabled=true \
--set loadBalancer.acceleration=native \
--set k8sServiceHost=${API_SERVER_IP} \
--set k8sServicePort=${API_SERVER_PORT}
馃惥Warning
- 鏈湴璺敱闇€瑕佹坊鍔犳洿澶?helm 鍙傛暟, 璇锋寜鐓ф偍鐨勫疄闄呮儏鍐佃繘琛岄€夋嫨鍜屾坊鍔?
loadBalancer.mode鏍规嵁鎮ㄧ殑瀹為檯闇€姹? 浠?DSR 鍜?hybrid 涓€夋嫨. (榛樿 SNAT 妯″紡)
馃帀馃帀馃帀
馃摎锔忓弬鑰冩枃妗?/h2>
- LoadBalancer & NodePort XDP Acceleration - Kubernetes Without kube-proxy 鈥?Cilium 1.13.4 documentation
- Cilium 1.8: XDP Load Balancing, Cluster-wide Flow Visibility, Host Network Policy, Native GKE & Azure modes, Session Affinity, CRD-mode Scalability, Policy Audit mode, ...
- Tuning Guide 鈥?Cilium 1.13.4 documentation
涓変汉琛? 蹇呮湁鎴戝笀; 鐭ヨ瘑鍏变韩, 澶╀笅涓哄叕. 鏈枃鐢变笢椋庡井楦ｆ妧鏈崥瀹?EWhisper.cn 缂栧啓.
涓変汉琛? 蹇呮湁鎴戝笀; 鐭ヨ瘑鍏变韩, 澶╀笅涓哄叕. 鏈枃鐢变笢椋庡井楦ｆ妧鏈崥瀹?EWhisper.cn 缂栧啓.