本書是容器與Kubernetes網絡的基礎和進階書籍，旨在讓更多人了解和學習云原生時代的底層網絡模型與實現機制，指導企業在落地云原生時的網絡方案選型。全書包括：容器網絡虛擬化基礎、Docker容器網絡、Kubernetes網絡和Istio網絡4部分，共6章。第1章容器網絡虛擬化基礎將支撐容器網絡的內核技術娓娓道來。第2章簡單介紹了Docker原生的容器網絡能力。Kubernetes網絡分為3章，第3章介紹Kubernetes網絡的基礎概念和使用，第4章為讀者剖析了Kubernetes網絡的底層實現原理，第5章詳解了業界主流的Kubernetes網絡插件。Istio網絡總共1章，重點解析Istio網絡流量管控的背后機制。本書適合作為高等院校計算機相關專業云計算課程的參考資料，也適合云計算從業者，特別是希望對云原生網絡技術有較深入了解并希望將其應用到日常工作中的所有讀者閱讀。
杜軍，浙大SEL實驗室碩士，曾任華為云架構師、咨詢組專家，國內最早的容器技術布道師。開源社區自身貢獻者與維護著，CNCF TOC Contributor，Kubernetes和Istio雙科maintainer，對云計算技術演進與內在驅動力有深刻見解，主要研究方向為容器、微服務、DevOps、邊緣計算。
目錄
第 1 章 夯實基礎：Linux 網絡虛擬化 1
1.1 網絡虛擬化基石：network namespace ············································.1
1.1.1 初識 network namespace ··················································.2
1.1.2 配置 network namespace ··················································.3
1.1.3 network namespace API 的使用 ···········································.6
1.1.4 小結 ·······································································.12
1.2 千呼萬喚始出來：veth pair ·······················································.12
1.2.1 veth pair 內核實現·························································.14
1.2.2 容器與 host veth pair 的關系 ··············································.15
1.2.3 小結 ·······································································.17
1.3 連接你我他：Linux bridge ························································.17
1.3.1 Linux bridge 初體驗 ·······················································.17
1.3.2 把 IP 讓給 Linux bridge ···················································.21
1.3.3 將物理網卡添加到 Linux bridge ··········································.22
1.3.4 Linux bridge 在網絡虛擬化中的應用 ·····································.25
1.3.5 網絡接口的混雜模式 ·····················································.26
1.4 給用戶態一個機會：tun/tap 設備·················································.28
1.4.1 tun/tap 設備的工作原理···················································.28
1.4.2 利用 tun 設備部署一個 VPN··············································.29
1.4.3 tun 設備編程 ······························································.31
1.5 iptables·············································································.34
1.5.1 祖師爺 netfilter ····························································.34
1.5.2 iptables 的三板斧：table、chain 和 rule ··································.36
1.5.3 iptables 的常規武器 ·······················································.39
1.6 初識 Linux 隧道：ipip ····························································.45
1.6.1 測試 ipip 隧道 ·····························································.46
1.6.2 ipip 隧道測試結果復盤 ···················································.49
1.6.3 小結 ·······································································.50
1.7 Linux 隧道網絡的代表：VXLAN ················································.51
1.7.1 為什么需要 VXLAN ······················································.51
1.7.2 VXLAN 協議原理簡介 ···················································.52
1.7.3 VXLAN 組網必要信息 ···················································.54
1.7.4 VXLAN 基本配置命令 ···················································.55
1.7.5 VXLAN 網絡實踐·························································.56
1.7.6 分布式控制中心 ··························································.63
1.7.7 自維護 VTEP 組 ··························································.63
1.7.8 小結 ·······································································.68
1.8 物理網卡的分身術：Macvlan·····················································.68
1.8.1 Macvlan 五大工作模式解析 ··············································.68
1.8.2 測試使用 Macvlan 設備 ···················································.72
1.8.3 Macvlan 的跨機通信 ······················································.73
1.8.4 Macvlan 與 overlay 對比 ··················································.74
1.8.5 小結 ·······································································.75
1.9 Macvlan 的救護員：IPvlan························································.75
1.9.1 IPvlan 簡介 ································································.75
1.9.2 測試 IPvlan ································································.77
1.9.3 Docker IPvlan 網絡 ························································.78
1.9.4 小結 ·······································································.78
第 2 章 飲水思源：Docker 網絡模型簡介 79
2.1 主角登場：Linux 容器 ····························································.79
2.1.1 容器是什么································································.79
2.1.2 容器與虛擬機對比 ························································.80
2.1.3 小結 ·······································································.81
2.2 打開萬花筒：Docker 的四大網絡模式 ···········································.81
2.2.1 bridge 模式 ································································.82
2.2.2 host 模式 ··································································.83
2.2.3 container 模式 ·····························································.84
2.2.4 none 模式··································································.85
2.3 最常用的 Docker 網絡技巧 ·······················································.85
2.3.1 查看容器 IP ·······························································.85
2.3.2 端口映射 ··································································.86
2.3.3 訪問外網 ··································································.87
2.3.4 DNS 和主機名 ····························································.87
2.3.5 自定義網絡································································.88
2.3.6 發布服務 ··································································.90
2.3.7 docker link：兩兩互聯 ····················································.91
2.4 容器網絡的第一個標準：CNM···················································.93
2.4.1 CNM 標準 ·································································.93
2.4.2 體驗 CNM 接口 ···························································.94
2.4.3 Libnetwork·································································.95
2.4.4 Libnetwork 擴展···························································.97
2.4.5 小結 ·······································································.98
2.5 天生不易：容器組網的挑戰 ······················································.99
2.5.1 容器網絡挑戰綜述 ························································.99
2.5.2 Docker 的解決方案 ·······················································.101
2.5.3 第三方容器網絡插件 ·····················································.102
2.5.4 小結 ·······································································.103
2.6 如何做好技術選型：容器組網方案沙場點兵 ····································.103
2.6.1 隧道方案 ··································································.104
2.6.2 路由方案 ··································································.104
2.6.3 容器網絡組網類型 ························································.106
2.6.4 關于容器網絡標準接口···················································.107
2.6.5 小結 ·······································································.108
第 3 章 標準的勝利：Kubernetes 網絡原理與實踐 109
3.1 容器基礎設施的代言人：Kubernetes·············································.109
3.1.1 Kubernetes 簡介 ···························································.109
3.1.2 Kubernetes 能做什么 ······················································.111
3.1.3 如何用 Kubernetes ························································.113
3.1.4 Docker 在 Kubernetes 中的角色 ··········································.113
3.2 終于等到你：Kubernetes 網絡 ····················································.114
3.2.1 Kubernetes 網絡基礎 ······················································.114
3.2.2 Kubernetes 網絡架構綜述·················································.115
3.2.3 Kubernetes 主機內組網模型 ··············································.117
3.2.4 Kubernetes 跨節點組網模型 ··············································.118
3.2.5 Pod 的 hosts 文件··························································.120
3.2.6 Pod 的 hostname ···························································.121
3.3 Pod 的核心：pause 容器 ··························································.124
3.4 打通 CNI 與 Kubernetes：Kubernetes 網絡驅動··································.131
3.4.1 即將完成歷史使命：Kubenet·············································.131
3.4.2 網絡生態第一步：CNI ···················································.133
3.5 找到你并不容易：從集群內訪問服務············································.139
3.5.1 Kubernetes Service 詳解···················································.141
3.5.2 Service 的三個 port························································.145
3.5.3 你的服務適合哪種發布形式··············································.146
3.5.4 Kubernetes Service 發現···················································.150
3.5.5 特殊的無頭 Service ·······················································.151
3.5.6 怎么訪問本地服務 ························································.153
3.6 找到你并不容易：從集群外訪問服務············································.154
3.6.1 Kubernetes Ingress·························································.155
3.6.2 小結 ·······································································.157
3.7 你的名字：通過域名訪問服務 ···················································.158
3.7.1 DNS 服務基本框架 ·······················································.158
3.7.2 域名解析基本原理 ························································.159
3.7.3 DNS 使用··································································.161
3.7.4 調試 DNS··································································.166
3.8 Kubernetes 網絡策略：為你的應用保駕護航 ····································.167
3.8.1 網絡策略應用舉例 ························································.168
3.8.2 小結 ·······································································.172
3.9 前方高能：Kubernetes 網絡故障定位指南 ·······································.173
3.9.1 IP 轉發和橋接·····························································.173
3.9.2 Pod CIDR 沖突 ····························································.175
3.9.3 hairpin ·····································································.176
3.9.4 查看 Pod IP 地址 ··························································.176
3.9.5 故障排查工具 ·····························································.178
3.9.6 為什么不推薦使用 SNAT ·················································.180
第 4 章 刨根問底：Kubernetes 網絡實現機制 183
4.1 豈止 iptables：Kubernetes Service 官方實現細節探秘 ···························.183
4.1.1 userspace 模式·····························································.184
4.1.2 iptables 模式·······························································.186
4.1.3 IPVS 模式 ·································································.191
4.1.4 iptables VS. IPVS ··························································.198
4.1.5 conntrack ··································································.199
4.1.6 小結 ·······································································.200
4.2 Kubernetes 極客們的日常：DIY 一個 Ingress Controller·························.201
4.2.1 Ingress Controller 的通用框架 ············································.202
4.2.2 Nginx Ingress Controller 詳解 ·············································.202
4.2.3 小結 ·······································································.209
4.3 滄海桑田：Kubernetes DNS 架構演進之路 ······································.209
4.3.1 Kube-dns 的工作原理 ·····················································.209
4.3.2 上位的 CoreDNS ··························································.212
4.3.3 Kube-dns VS. CoreDNS ···················································.217
4.3.4 小結 ·······································································.220
4.4 你的安全我負責：使用 Calico 提供 Kubernetes 網絡策略·······················.220
4.4.1 部署一個帶 Calico 的 Kubernetes 集群 ···································.221
4.4.2 測試 Calico 網絡策略 ·····················································.225
第 5 章 百花齊放：Kubernetes 網絡插件生態 228
5.1 從入門到放棄：Docker 原生網絡的不足·········································.228
5.2 CNI 標準的勝出：從此江湖沒有 CNM ··········································.229
5.2.1 CNI 與 CNM 的轉換 ······················································.230
5.2.2 CNI 的工作原理···························································.231
5.2.3 為什么 Kubernetes 不使用 Libnetwork ···································.235
5.3 Kubernetes 網絡插件鼻祖 flannel ·················································.238
5.3.1 flannel 簡介································································.239
5.3.2 flannel 安裝配置 ··························································.241
5.3.3 flannel backend 詳解 ······················································.244
5.3.4 flannel 與 etcd ·····························································.256
5.3.5 小結 ·······································································.257
5.4 全能大三層網絡插件：Calico ····················································.257
5.4.1 Calico 簡介 ································································.258
5.4.2 Calico 的隧道模式 ························································.263
5.4.3 安裝 Calico ································································.263
5.4.4 Calico 報文路徑 ···························································.264
5.4.5 Calico 使用指南 ···························································.267
5.4.6 為什么 Calico 網絡選擇 BGP ·············································.272
5.4.7 小結 ·······································································.274
5.5 Weave：支持數據加密的網絡插件 ···············································.276
5.5.1 Weave 簡介································································.276
5.5.2 Weave 實現原理···························································.277
5.5.3 Weave 安裝································································.278
5.5.4 Weave 網絡通信模型 ·····················································.280
5.5.5 Weave 的應用示例 ························································.282
5.5.6 小結 ·······································································.288
5.6 Cilium：為微服務網絡連接安全而生 ············································.288
5.6.1 為什么使用 Cilium ························································.289
5.6.2 以 API 為中心的微服務安全 ·············································.294
5.6.3 BPF 優化的數據平面性能 ················································.295
5.6.4 試用 Cilium：網絡策略···················································.297
5.6.5 小結 ·······································································.299
5.7 Kubernetes 多網絡的先行者：CNI-Genie ········································.299
5.7.1 為什么需要 CNI-Genie····················································.300
5.7.2 CNI-Genie 功能速遞 ······················································.302
5.7.3 容器多 IP ··································································.303
第 6 章 Kubernetes 網絡下半場：Istio 305
6.1 微服務架構的大地震：sidecar 模式 ··············································.305
6.1.1 你真的需要 Service Mesh 嗎··············································.306
6.1.2 sidecar 模式 ·······························································.307
6.1.3 Service Mesh 與 sidecar ···················································.307
6.1.4 Kubernetes Service VS. Service Mesh ·····································.309
6.1.5 Service Mesh 典型實現之 Linkerd ········································.310
6.2 Istio：引領新一代微服務架構潮流···············································.312
6.2.1 Istio 簡介 ··································································.312
6.2.2 Istio 安裝 ··································································.313
6.2.3 Istio 路由規則的實現 ·····················································.317
6.3 一切盡在不言中：Istio sidecar 透明注入·········································.319
6.3.1 Init 容器 ···································································.319
6.3.2 sidecar 注入示例 ··························································.319
6.3.3 手工注入 sidecar ··························································.326
6.3.4 自動注入 sidecar ··························································.327
6.3.5 從應用容器到 sidecar 代理的通信········································.329
6.4 不再為 iptables 腳本所困：Istio CNI 插件 ·······································.330
6.5 除了微服務，Istio 還能做更多 ···················································.331
新書資訊