Kubernetesのネットワークの実装と課題及びContrail＋Kubernetesでの課題解決 Contrail enterprise Multicloudの概要について

1. © 2018 Juniper Networks
‘KUBERNETES’/’OPENSHIFT’
ON OPENSTACK
CONTRAIL/TUNGSTEN
FABRIC

2. © 2018 Juniper Networks
SPEAKER
• TungstenFabric Ambassador
• Juniper Networks
•

3. © 2018 Juniper Networks
AGENDA
3
•Kubernetes
•Kubernetes ” ”
•Contrail Enterprise Multicloud

4. © 2018 Juniper Networks
KUBERNETES
4

5. © 2018 Juniper Networks
SDN ECOSYSTEM IN CNCF

6. © 2018 Juniper Networks
Beyond cloud-native… Do you care about:
• High-performance forwarding
• Proven cloud-grade, carrier-grade scale
• Feature rich for Kubernetes and LB, beyond CNI
• Feature rich in general for net + sec
• Multi-tenancy
• Open source / community
• Open standards-based federation
• Multiple orchestrator support
• Solid vendor backing and optional services
• Collapsing stacked SDNs: e.g. K8s on OpenStack
• Ease of use
SDN ECOSYSTEM IN CNCF

7. © 2018 Juniper Networks
K8S
Kuberenetes Cluster
APIServer
Controller
Scheduler
etcd
OVS/Bridge
Docker network
pod
pod
kube-let
kube-proxy
Kubernetes
Kube Master
• API Sserver
• Controller
• Scheduler
• Etcd (DB)
Worker node.
• kube-let
• CNI
• kube-proxy
kube-let Callico
Flannel, Contrail SDN
OVS/Bridge
Docker network
pod
pod
kube-let
kube-proxy

8. © 2018 Juniper Networks
K8S
K8S
pod-network
service-network
external-network
Kubernetes Network 3
1) pod-network
POD
2) service network
Service
3) external-network
Service External−IP
pod pod pod
Service
ClusterIP
pod
Service
LoadBalancer
Internet
LAN

9. © 2018 Juniper Networks
K8S
POD(Service)
external-network
1) “192.168.0.1”
Web Loadbalancer .
2) Web LoadBalancer POD NAT
3) nginx pod
”172.16.0.11”
4) DB ClusterIP POD NAT
POD
NAT kube-proxy
db nginx
DB
ClusterIP
Web
LoadBalancer
Internet
LAN
192.168.0.0/24
172.16.0.0/24
192.168.0.0/24
nginxdb
.1
.21 .22 .23 .24
.11 .12
pod-network
service-network

10. © 2018 Juniper Networks
K8S
POD
APIServer
Controller
Scheduler
etcd
Physical Network
BMS
OVS/Bridge
Docker network
pod
pod
kube-let
kube-proxy
Internet
POD POD IP
Workder Node IP NAT
POD NAT
POD IP address is
translated to IP
address of node

11. © 2018 Juniper Networks
K8S
POD
mysql nginx nginxmysql
192.168.10.0/24
Tenant: A
mysql nginx nginxmysql
192.168.20.0/24
Tenant: B
POD Kubernetes setup 1 1
POD
Kubernetes cluster
Openstack VM Kubernetes cluster
POD VM
Kuberentes cluster POD
POD
External IP

12. © 2018 Juniper Networks
K8S
Openstack Virtual-machine for K8S setup
•NovaAPI
•Glance
•Keystone
•Neutron
OVS/Bridge
APIServer
Controller
Scheduler
APIServer
Controller
Scheduler
OVS/Bridge
mysql nginx nginxmysql
192.168.10.0/24
mysql nginx nginxmysql
192.168.20.0/24
Tenant: BTenant: A
mysql
nginx
mysql
nginx
OVS/BR OVS/BR
OVS/Bridge
mysql
nginx
mysql
nginx
OVS/BR OVS/BR

13. © 2018 Juniper Networks
K8S
K8S
Physical Network
DB
OVS/Bridge
Docker network
pod
pod
kube-let
kube-proxy
POD Worker node NAT
POD IP
POD Worker node
Worker node IP
IP
IP
OVS/Bridge
Docker network
pod
pod
kube-let
kube-proxy

14. © 2018 Juniper Networks
K8S
K8S
OVS/Bridge
Docker network
pod
pod
kube-let
kube-proxy
POD
POD Ingress/Egress
POD
OVS/Bridge
Docker network
pod
pod
kube-let
kube-proxy
A
B
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: test-network-policy
namespace: default
spec:
podSelector:
matchLabels:
service: wordpress
role: nginx
policyTypes:
- Ingress
ingress:
- from:
- ipBlock:
cidr: 192.168.20.0/24

15. © 2018 Juniper Networks
K8S
K8S
Web Web
API API
DB DB
192.168.10.0/24
192.168.20.0/24
192.168.30.0/24
172.16.0.0/24
SyslogMonitor
Service Network
Develop:A
Develop:B
FW
Service network Web TCP 80
Develop:A ”Web” TCP:22,80 .
Develop:B “API”and“DB”
Develop:A Develop:B
:
• POD
• FW
•
• POD

16. © 2018 Juniper Networks
KUBERNETES NETWORK “EXTENSION”
Contrail Networking
16

17. © 2018 Juniper Networks
Physical IP Fabric
(no changes)
TungstenFabric
CONTROLLER
ORCHESTRATOR
Host O/SvRouter
Network / Storage
orchestration
Gateway
…
Internet / WAN
or Legacy Env.
(Config, Control, Analytics, Svr Mgmt)
(Windows, Linux ….) on BMS
TOR
Compute
orchestration
Virtual Network
Blue
Virtual Network
Red
FW
Logical View
…
Centralized
PolicyDefinition
Distributed
PolicyEnforcement
BGP
BGP XMPPEVPN
TUNGSTEN FABRIC OVERVIEW

18. © 2018 Juniper Networks
KUBERNETES SETUP WITH CONTRAIL
Kuberenetes Cluster on BMS
APIServer
Contrail vRouter
pod
pod
Contrail CNI Kuberenetes
Kubernetes
Contrail BMS Nested 2
•KubeManager
•Controller
•Analytics
•Analytics-DB
kubelet
CNI
Agent
Contrail vRouter
pod
pod
kubelet
CNI
Agent

19. © 2018 Juniper Networks
KUBERNETES SETUP WITH CONTRAIL
Kuberenetes Cluster with Openstack
Openstack Kubernetes Controller
VM
•Controller
•Analytics
•Analytics-DB
•NovaAPI
•Glance
•Keystone
•Neutron
Contrail vRouter
pod
pod
kubelet
CNI
Agent
APIServer
kube-manager
Contrail
vRouter
Agent
VM

20. © 2018 Juniper Networks
KUBERNETES SETUP WITH CONTRAIL
Kuberenetes Cluster on Openstack
Contrail vRouter
Openstack VM Kubernetes
Contrail Openstack
VM
•Controller
•Analytics
•Analytics-DB
•NovaAPI
•Glance
•Keystone
•Neutron
Agent
APIServer
kube-manager
kubelet
CNI
bridge
pod
pod
vlan
vlan

21. © 2018 Juniper Networks
CONTRAIL WITH K8S
• POD Network
mysql nginx nginxmysql
192.168.10.0/24
Tenant: A
apiVersion: v1
kind: Pod
metadata:
name: mysql
annotations: {
"opencontrail.org/network" : '{"domain":"default-domain",
"project": ”user1", "name":”pod-vn1"}'
}
labels:
name: db
spec:
containers:
- name: mysql-gA
image: mysql
Contrail Annotation Contrail
POD
VNI/Route target
**

22. © 2018 Juniper Networks
CONTRAIL WITH K8S
• POD Network
mysql nginx nginxmysql
192.168.10.0/24
POD
Contrail FW
Kube-proxy HTTP/HTTPS
Contrail
5 Tuple POD
192.168.20.0/24

23. © 2018 Juniper Networks
CONTRAIL WITH K8S
• POD
POD
Contrail POD
Floating IP POD
POD
K8S
Contrail
nginx nginx
pod-network
external-network
Web
LoadBalancer
service-network
public-network
D:203.0.113.1
10.0.10.1
10.0.10.1

24. © 2018 Juniper Networks
CONTRAIL WITH K8S
• POD
Contrail HVTEP
POD
DB NAT
Contrail VNI
Route Target
APIServer
Contrail vRouter
pod
pod
•KubeManager
•Controller
•Analytics
•Analytics-DB
kubelet
CNI
Agent
Contrail vRouter
pod
pod
kubelet
CNI
Agent
DB VMSV VM
BGP L3VPN/EVPN

25. © 2018 Juniper Networks
CONTRAIL WITH K8S
• VNF POD
FW
NFV Chain
VNF
Contrail vRouter
pod
pod
kubelet
CNI
Agent
Contrail vRouter
Agent
Internet

26. © 2018 Juniper Networks
CONTRAIL WITH K8S
Contrail
Web Web
API API
DB DB
192.168.10.0/24
192.168.20.0/24
192.168.30.0/24
172.16.0.0/24
SyslogMonitor
Service Network
Develop:A
Develop:B
Contrail Kubernetes
POD
Contrail :
• POD network
• FW
•
• POD

27. © 2018 Juniper Networks
CONTRAIL ENTERPRISE MULTICLOUD
27

28. © 2018 Juniper Networks
JOINT SOLUTION – REDHAT / JUNIPER
Validated VNFs (VM)CONTAINER-BASED VNF
NETWORK FUNCTIONS VIRTUALIZATION INFRASTRUCTURE (NFVI)
CERTIFIED HARDWARE
Compute Storage Network
COMPUTE
KVM
STORAGE NETWORK
vSRXvMX
Certified VNFsOTHER VNF
Juniper
Contrail
Juniper
Contrail
OpenStack
Operations
• Red Hat OpenStack
+ Contrail Networking
• Replace default
Neutron networking
with Contrail SDN
• Enable high
performance,
scalability and
availability
• Focus on advanced
features with ease of
use
Container
Deployments
• Red Hat OpenShift
+ Contrail
Networking
• Augment OpenShift
deployments with
advanced
networking features
• Allow customers to
enable more use
cases than
standard
deployment of
OpenShift or
Kubernetes

29. © 2018 Juniper Networks
NETWORKING-AS-A-SERVICE ACROSS
MULTICLOUD INFRASTRUCTURE
Managed Private Cloud
Branch Office
Enterprise Private Cloud
DC
Low-latency Secure Interconnect
Private Backbone / Internet
Container
s
Front-End
Tier
Back-end
Tier
BMSVMs
E-W
FW
…
Tiers (i.e. collection of
workloads) extend
across different DC’s
and to the public Cloud
Contrail Portal
Userna
me
Passwor
d
Cloud Portal
Operator
…
SaaS Platform:
§ Connect Multiple Clouds
§ Define Security policies
§ Manage & Operate
LBN-S FW
End-user
Policy &
redirectio
n
Public Cloud