You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
You must use a CNI plugin that is compatible with the
25
30
[v0.4.0](https://github.com/containernetworking/cni/blob/spec-v0.4.0/SPEC.md) or later
@@ -37,80 +42,96 @@ CNI 规范的插件（插件可以兼容多个规范版本）。
37
42
<!--
38
43
## Installation
39
44
40
-
A CNI plugin is required to implement the [Kubernetes network model](/docs/concepts/services-networking/#the-kubernetes-network-model). The CRI manages its own CNI plugins. There are two Kubelet command line parameters to keep in mind when using plugins:
45
+
A Container Runtime, in the networking context, is a daemon on a node configured to provide CRI Services for kubelet. In particular, the Container Runtime must be configured to load the CNI plugins required to implement the Kubernetes network model.
46
+
-->
47
+
## 安装 {#installation}
48
+
49
+
在网络语境中，容器运行时（Container Runtime）是在节点上的守护进程，
50
+
被配置用来为 kubelet 提供 CRI 服务。具体而言，容器运行时必须配置为加载所需的
51
+
CNI 插件，从而实现 Kubernetes 网络模型。
52
+
53
+
{{< note >}}
54
+
<!--
55
+
Prior to Kubernetes 1.24, the CNI plugins could also be managed by the kubelet using the `cni-bin-dir` and `network-plugin` command-line parameters.
56
+
These command-line parameters were removed in Kubernetes 1.24, with management of the CNI no longer in scope for kubelet.
* `cni-bin-dir`: Kubelet probes this directory for plugins on startup
43
-
* `network-plugin`: The network plugin to use from `cni-bin-dir`. It must match the name reported by a plugin probed from the plugin directory. For CNI plugins, this is "cni".
62
+
<!--
63
+
See [Troubleshooting CNI plugin-related errors](/docs/tasks/administer-cluster/migrating-from-dockershim/troubleshooting-cni-plugin-related-errors/)
64
+
if you are facing issues following the removal of dockershim.
For specific information about how to install and manage a CNI plugin, see the documentation for that plugin or [networking provider](/docs/concepts/cluster-administration/networking/#how-to-implement-the-kubernetes-networking-model).
Besides providing the [`NetworkPlugin` interface](https://github.com/kubernetes/kubernetes/tree/{{< param "fullversion" >}}/pkg/kubelet/dockershim/network/plugins.go) to configure and clean up pod networking, the plugin may also need specific support for kube-proxy. The iptables proxy obviously depends on iptables, and the plugin may need to ensure that container traffic is made available to iptables. For example, if the plugin connects containers to a Linux bridge, the plugin must set the `net/bridge/bridge-nf-call-iptables` sysctl to `1` to ensure that the iptables proxy functions correctly. If the plugin does not use a Linux bridge (but instead something like Open vSwitch or some other mechanism) it should ensure container traffic is appropriately routed for the proxy.
84
+
<!--
85
+
## Network Plugin Requirements
60
86
61
-
By default if no kubelet network plugin is specified, the `noop` plugin is used, which sets `net/bridge/bridge-nf-call-iptables=1` to ensure simple configurations (like Docker with a bridge) work correctly with the iptables proxy.
87
+
For plugin developers and users who regularly build or deploy Kubernetes, the plugin may also need specific configuration to support kube-proxy.
88
+
The iptables proxy depends on iptables, and the plugin may need to ensure that container traffic is made available to iptables.
89
+
For example, if the plugin connects containers to a Linux bridge, the plugin must set the `net/bridge/bridge-nf-call-iptables` sysctl to `1` to ensure that the iptables proxy functions correctly.
90
+
If the plugin does not use a Linux bridge (but instead something like Open vSwitch or some other mechanism) it should ensure container traffic is appropriately routed for the proxy.
例如，如果插件将容器连接到 Linux 网桥，插件必须将 `net/bridge/bridge-nf-call-iptables`
70
-
系统参数设置为`1`，以确保 iptables 代理正常工作。
98
+
sysctl 参数设置为 `1`，以确保 iptables 代理正常工作。
71
99
如果插件不使用 Linux 网桥（而是类似于 Open vSwitch 或者其它一些机制），
72
100
它应该确保为代理对容器通信执行正确的路由。
73
101
102
+
<!--
103
+
By default if no kubelet network plugin is specified, the `noop` plugin is used, which sets `net/bridge/bridge-nf-call-iptables=1` to ensure simple configurations (like Docker with a bridge) work correctly with the iptables proxy.
The CNI plugin is selected by passing Kubelet the `--network-plugin=cni` command-line option. Kubelet reads a file from `--cni-conf-dir` (default `/etc/cni/net.d`) and uses the CNI configuration from that file to set up each pod's network. The CNI configuration file must match the [CNI specification](https://github.com/containernetworking/cni/blob/master/SPEC.md#network-configuration), and any required CNI plugins referenced by the configuration must be present in `--cni-bin-dir` (default `/opt/cni/bin`).
111
+
### Loopback CNI
82
112
83
-
If there are multiple CNI configuration files in the directory, the kubelet uses the configuration file that comes first by name in lexicographic order.
84
-
85
-
In addition to the CNI plugin specified by the configuration file, Kubernetes requires the standard CNI [`lo`](https://github.com/containernetworking/plugins/blob/master/plugins/main/loopback/loopback.go) plugin, at minimum version 0.2.0
113
+
In addition to the CNI plugin installed on the nodes for implementing the Kubernetes network model, Kubernetes also requires the container runtimes to provide a loopback interface `lo`, which is used for each sandbox (pod sandboxes, vm sandboxes, ...).
114
+
Implementing the loopback interface can be accomplished by re-using the [CNI loopback plugin.](https://github.com/containernetworking/plugins/blob/master/plugins/main/loopback/loopback.go) or by developing your own code to achieve this (see [this example from CRI-O](https://github.com/cri-o/ocicni/blob/release-1.24/pkg/ocicni/util_linux.go#L91)).
The CNI networking plugin supports `hostPort`. You can use the official [portmap](https://github.com/containernetworking/plugins/tree/master/plugins/meta/portmap)
108
129
plugin offered by the CNI plugin team or use your own plugin with portMapping functionality.
109
130
110
131
If you want to enable `hostPort` support, you must specify `portMappings capability` in your `cni-conf-dir`.
@@ -159,7 +180,7 @@ plugin offered by the CNI plugin team or use your own plugin with bandwidth cont
159
180
If you want to enable traffic shaping support, you must add the `bandwidth` plugin to your CNI configuration file
160
181
(default `/etc/cni/net.d`) and ensure that the binary is included in your CNI bin dir (default `/opt/cni/bin`).
161
182
-->
162
-
####支持流量整形
183
+
### 支持流量整形 {#support-traffic-shaping}
163
184
164
185
**实验功能**
165
186
@@ -216,16 +237,6 @@ metadata:
216
237
kubernetes.io/egress-bandwidth: 1M
217
238
...
218
239
```
219
-
<!--
220
-
## Usage Summary
221
-
222
-
* `--network-plugin=cni` specifies that we use the `cni` network plugin with actual CNI plugin binaries located in `--cni-bin-dir` (default `/opt/cni/bin`) and CNI plugin configuration located in `--cni-conf-dir` (default `/etc/cni/net.d`).
0 commit comments