You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
(CNI) plugins for cluster networking. You must use a CNI plugin that is compatible with your cluster and that suits your needs. Different plugins are available (both open- and closed- source) in the wider Kubernetes ecosystem.
15
+
(CNI) plugins for cluster networking. You must use a CNI plugin that is compatible with your
16
+
cluster and that suits your needs. Different plugins are available (both open- and closed- source)
17
+
in the wider Kubernetes ecosystem.
16
18
17
-
A CNI plugin is required to implement the [Kubernetes network model](/docs/concepts/services-networking/#the-kubernetes-network-model).
You must use a CNI plugin that is compatible with the
20
23
[v0.4.0](https://github.com/containernetworking/cni/blob/spec-v0.4.0/SPEC.md) or later
@@ -26,43 +29,62 @@ CNI specification (plugins can be compatible with multiple spec versions).
26
29
27
30
## Installation
28
31
29
-
A Container Runtime, in the networking context, is a daemon on a node configured to provide CRI Services for kubelet. In particular, the Container Runtime must be configured to load the CNI plugins required to implement the Kubernetes network model.
32
+
A Container Runtime, in the networking context, is a daemon on a node configured to provide CRI
33
+
Services for kubelet. In particular, the Container Runtime must be configured to load the CNI
34
+
plugins required to implement the Kubernetes network model.
30
35
31
36
{{< note >}}
32
-
Prior to Kubernetes 1.24, the CNI plugins could also be managed by the kubelet using the `cni-bin-dir` and `network-plugin` command-line parameters.
33
-
These command-line parameters were removed in Kubernetes 1.24, with management of the CNI no longer in scope for kubelet.
37
+
Prior to Kubernetes 1.24, the CNI plugins could also be managed by the kubelet using the
38
+
`cni-bin-dir` and `network-plugin` command-line parameters.
39
+
These command-line parameters were removed in Kubernetes 1.24, with management of the CNI no
40
+
longer in scope for kubelet.
34
41
35
42
See [Troubleshooting CNI plugin-related errors](/docs/tasks/administer-cluster/migrating-from-dockershim/troubleshooting-cni-plugin-related-errors/)
36
43
if you are facing issues following the removal of dockershim.
37
44
{{< /note >}}
38
45
39
-
For specific information about how a Container Runtime manages the CNI plugins, see the documentation for that Container Runtime, for example:
46
+
For specific information about how a Container Runtime manages the CNI plugins, see the
47
+
documentation for that Container Runtime, for example:
For specific information about how to install and manage a CNI plugin, see the documentation for that plugin or [networking provider](/docs/concepts/cluster-administration/networking/#how-to-implement-the-kubernetes-networking-model).
52
+
For specific information about how to install and manage a CNI plugin, see the documentation for
53
+
that plugin or [networking provider](/docs/concepts/cluster-administration/networking/#how-to-implement-the-kubernetes-networking-model).
44
54
45
55
## Network Plugin Requirements
46
56
47
-
For plugin developers and users who regularly build or deploy Kubernetes, the plugin may also need specific configuration to support kube-proxy.
48
-
The iptables proxy depends on iptables, and the plugin may need to ensure that container traffic is made available to iptables.
49
-
For example, if the plugin connects containers to a Linux bridge, the plugin must set the `net/bridge/bridge-nf-call-iptables` sysctl to `1` to ensure that the iptables proxy functions correctly.
50
-
If the plugin does not use a Linux bridge, but uses something like Open vSwitch or some other mechanism instead, it should ensure container traffic is appropriately routed for the proxy.
57
+
For plugin developers and users who regularly build or deploy Kubernetes, the plugin may also need
58
+
specific configuration to support kube-proxy. The iptables proxy depends on iptables, and the
59
+
plugin may need to ensure that container traffic is made available to iptables. For example, if
60
+
the plugin connects containers to a Linux bridge, the plugin must set the
61
+
`net/bridge/bridge-nf-call-iptables` sysctl to `1` to ensure that the iptables proxy functions
62
+
correctly. If the plugin does not use a Linux bridge, but uses something like Open vSwitch or
63
+
some other mechanism instead, it should ensure container traffic is appropriately routed for the
64
+
proxy.
51
65
52
-
By default, if no kubelet network plugin is specified, the `noop` plugin is used, which sets `net/bridge/bridge-nf-call-iptables=1` to ensure simple configurations (like Docker with a bridge) work correctly with the iptables proxy.
66
+
By default, if no kubelet network plugin is specified, the `noop` plugin is used, which sets
67
+
`net/bridge/bridge-nf-call-iptables=1` to ensure simple configurations (like Docker with a bridge)
68
+
work correctly with the iptables proxy.
53
69
54
70
### Loopback CNI
55
71
56
-
In addition to the CNI plugin installed on the nodes for implementing the Kubernetes network model, Kubernetes also requires the container runtimes to provide a loopback interface `lo`, which is used for each sandbox (pod sandboxes, vm sandboxes, ...).
57
-
Implementing the loopback interface can be accomplished by re-using the [CNI loopback plugin.](https://github.com/containernetworking/plugins/blob/master/plugins/main/loopback/loopback.go) or by developing your own code to achieve this (see [this example from CRI-O](https://github.com/cri-o/ocicni/blob/release-1.24/pkg/ocicni/util_linux.go#L91)).
72
+
In addition to the CNI plugin installed on the nodes for implementing the Kubernetes network
73
+
model, Kubernetes also requires the container runtimes to provide a loopback interface `lo`, which
74
+
is used for each sandbox (pod sandboxes, vm sandboxes, ...).
75
+
Implementing the loopback interface can be accomplished by re-using the
or by developing your own code to achieve this (see
78
+
[this example from CRI-O](https://github.com/cri-o/ocicni/blob/release-1.24/pkg/ocicni/util_linux.go#L91)).
58
79
59
80
### Support hostPort
60
81
61
-
The CNI networking plugin supports `hostPort`. You can use the official [portmap](https://github.com/containernetworking/plugins/tree/master/plugins/meta/portmap)
82
+
The CNI networking plugin supports `hostPort`. You can use the official
plugin offered by the CNI plugin team or use your own plugin with portMapping functionality.
63
85
64
-
If you want to enable `hostPort` support, you must specify `portMappings capability` in your`cni-conf-dir`.
65
-
For example:
86
+
If you want to enable `hostPort` support, you must specify `portMappings capability` in your
87
+
`cni-conf-dir`. For example:
66
88
67
89
```json
68
90
{
@@ -97,11 +119,13 @@ For example:
97
119
98
120
**Experimental Feature**
99
121
100
-
The CNI networking plugin also supports pod ingress and egress traffic shaping. You can use the official [bandwidth](https://github.com/containernetworking/plugins/tree/master/plugins/meta/bandwidth)
122
+
The CNI networking plugin also supports pod ingress and egress traffic shaping. You can use the
123
+
official [bandwidth](https://github.com/containernetworking/plugins/tree/master/plugins/meta/bandwidth)
101
124
plugin offered by the CNI plugin team or use your own plugin with bandwidth control functionality.
102
125
103
-
If you want to enable traffic shaping support, you must add the `bandwidth` plugin to your CNI configuration file
104
-
(default `/etc/cni/net.d`) and ensure that the binary is included in your CNI bin dir (default `/opt/cni/bin`).
126
+
If you want to enable traffic shaping support, you must add the `bandwidth` plugin to your CNI
127
+
configuration file (default `/etc/cni/net.d`) and ensure that the binary is included in your CNI
128
+
bin dir (default `/opt/cni/bin`).
105
129
106
130
```json
107
131
{
@@ -132,8 +156,8 @@ If you want to enable traffic shaping support, you must add the `bandwidth` plug
132
156
}
133
157
```
134
158
135
-
Now you can add the `kubernetes.io/ingress-bandwidth` and `kubernetes.io/egress-bandwidth` annotations to your pod.
136
-
For example:
159
+
Now you can add the `kubernetes.io/ingress-bandwidth` and `kubernetes.io/egress-bandwidth`
0 commit comments