深入了解 Kubernetes CNI 网络插件 Flannel

mkdir -p ~/charts/flannel/flannel
cd ~/charts/flannel/flannel
helm repo add flannel https://flannel-io.github.io/flannel/
# values.yaml 用来查看默认值
helm show values flannel/flannel > values.yaml
cat <<EOF > custom-values.yaml
podCidr: "10.42.0.0/16"

flannel:
  image:
    repository: docker.io/flannel/flannel
    tag: v0.26.7
  image_cni:
    repository: docker.io/flannel/flannel-cni-plugin
    tag: v1.7.1-flannel1
  args:
  - "--ip-masq"
  - "--kube-subnet-mgr"
  backend: "vxlan"
  backendPort: 8472
  mtu: 1500
  vni: 4096

netpol:
  enabled: true
  args:
  - "--hostname-override=\$(MY_NODE_NAME)"
  - "--v=2"
  image:
    repository: registry.k8s.io/networking/kube-network-policies
    tag: v0.7.0
EOF
kubectl create ns kube-flannel
kubectl label --overwrite ns kube-flannel pod-security.kubernetes.io/enforce=privileged
helm upgrade --install --namespace kube-flannel flannel flannel/flannel -f custom-values.yaml

// pkg/backend/vxlan/vxlan.go
func (be *VXLANBackend) RegisterNetwork(ctx context.Context, wg *sync.WaitGroup, config *subnet.Config) (backend.Network, error) {
	cfg := struct {
		VNI           int
		Port          int
		MTU           int
		GBP           bool
		Learning      bool
		DirectRouting bool
	}{
		VNI: defaultVNI,
		MTU: be.extIface.Iface.MTU, // 默认是外部接口的 MTU
	}

	if len(config.Backend) > 0 {
		// 如果 net-conf.json 有配置 Backend, 则使用配置文件中的 MTU
		if err := json.Unmarshal(config.Backend, &cfg); err != nil {
			return nil, fmt.Errorf("error decoding VXLAN backend config: %v", err)
		}
	}

  // ...
  if config.EnableIPv4 {
		devAttrs := vxlanDeviceAttrs{
			vni:       uint32(cfg.VNI),
			name:      fmt.Sprintf("flannel.%d", cfg.VNI),
			MTU:       cfg.MTU,
			vtepIndex: be.extIface.Iface.Index,
			vtepAddr:  be.extIface.IfaceAddr,
			vtepPort:  cfg.Port,
			gbp:       cfg.GBP,
			learning:  cfg.Learning,
			hwAddr:    hwAddr,
		}

		// 创建 vxlan 设备
		dev, err = newVXLANDevice(&devAttrs)
		if err != nil {
			return nil, err
		}
	}

  // ...
  if config.EnableIPv4 {
		// 设置 subnet ip
		if err := dev.Configure(ip.IP4Net{IP: lease.Subnet.IP, PrefixLen: 32}, config.Network); err != nil {
			return nil, fmt.Errorf("failed to configure interface %s: %w", dev.link.Attrs().Name, err)
		}
	}

  // ...
	return newNetwork(be.subnetMgr, be.extIface, dev, v6Dev, ip.IP4Net{}, lease, cfg.MTU)
}

func newVXLANDevice(devAttrs *vxlanDeviceAttrs) (*vxlanDevice, error) {
	link := &netlink.Vxlan{
		LinkAttrs: netlink.LinkAttrs{
			Name:         devAttrs.name,
			HardwareAddr: hardwareAddr,
			MTU:          devAttrs.MTU - 50, // 这里设置 vxlan 网卡的 MTU 设置为比外部网络小 50
		},
		VxlanId:      int(devAttrs.vni),
		VtepDevIndex: devAttrs.vtepIndex,
		SrcAddr:      devAttrs.vtepAddr,
		Port:         devAttrs.vtepPort,
		Learning:     devAttrs.learning,
		GBP:          devAttrs.gbp,
	}

	link, err = ensureLink(link)
	if err != nil {
		return nil, err
	}
}