第二部分：Kubernetes 网络深度解析

#!/bin/bash
# CNI 插件对比实验环境搭建

# 1. 创建实验集群
kind create cluster --name cni-test --config - <<EOF
kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
nodes:
- role: control-plane
- role: worker
- role: worker
networking:
  podSubnet: "10.244.0.0/16"
  serviceSubnet: "10.96.0.0/12"
EOF

# 2. 安装测试工具
kubectl apply -f - <<EOF
apiVersion: apps/v1
kind: Deployment
metadata:
  name: test-pods
spec:
  replicas: 6
  selector:
    matchLabels:
      app: test-pod
  template:
    metadata:
      labels:
        app: test-pod
    spec:
      containers:
      - name: test
        image: nginx:alpine
        ports:
        - containerPort: 80
EOF

# 3. 等待 Pod 就绪
kubectl wait --for=condition=Ready pod -l app=test-pod --timeout=60s

# 1. 安装 Flannel
kubectl apply -f https://raw.githubusercontent.com/flannel-io/flannel/master/Documentation/kube-flannel.yml

# 2. 等待 Flannel 就绪
kubectl wait --for=condition=Ready pod -l app=flannel -n kube-system --timeout=60s

# 3. 查看网络配置
kubectl get nodes -o wide
kubectl get pods -o wide

# 4. 测试 Pod 间通信
kubectl exec -it $(kubectl get pod -l app=test-pod -o jsonpath='{.items[0].metadata.name}') -- ping -c 3 $(kubectl get pod -l app=test-pod -o jsonpath='{.items[1].metadata.name}')

# 5. 查看 VXLAN 接口
kubectl get nodes -o jsonpath='{.items[0].status.addresses[0].address}' | xargs -I {} ssh {} "ip link show flannel.1"

# 6. 性能测试
kubectl apply -f - <<EOF
apiVersion: apps/v1
kind: Deployment
metadata:
  name: iperf-server
spec:
  replicas: 1
  selector:
    matchLabels:
      app: iperf-server
  template:
    metadata:
      labels:
        app: iperf-server
    spec:
      containers:
      - name: iperf
        image: networkstatic/iperf3
        command: ["iperf3", "-s"]
        ports:
        - containerPort: 5201
EOF

kubectl apply -f - <<EOF
apiVersion: apps/v1
kind: Deployment
metadata:
  name: iperf-client
spec:
  replicas: 1
  selector:
    matchLabels:
      app: iperf-client
  template:
    metadata:
      labels:
        app: iperf-client
    spec:
      containers:
      - name: iperf
        image: networkstatic/iperf3
        command: ["sh", "-c", "sleep 10 && iperf3 -c iperf-server -t 30"]
EOF

# 1. 删除 Flannel
kubectl delete -f https://raw.githubusercontent.com/flannel-io/flannel/master/Documentation/kube-flannel.yml

# 2. 安装 Calico
kubectl apply -f https://docs.projectcalico.org/manifests/calico.yaml

# 3. 等待 Calico 就绪
kubectl wait --for=condition=Ready pod -l k8s-app=calico-node -n kube-system --timeout=60s

# 4. 查看 BGP 状态
kubectl get nodes -o jsonpath='{.items[0].status.addresses[0].address}' | xargs -I {} ssh {} "calicoctl node status"

# 5. 查看路由表
kubectl get nodes -o jsonpath='{.items[0].status.addresses[0].address}' | xargs -I {} ssh {} "ip route | grep calico"

# 6. 性能测试（同上）

# 1. 删除 Calico
kubectl delete -f https://docs.projectcalico.org/manifests/calico.yaml

# 2. 安装 Cilium
cilium install

# 3. 等待 Cilium 就绪
cilium status --wait

# 4. 查看 eBPF 状态
cilium status

# 5. 启用 Hubble 可视化
cilium hubble enable

# 6. 查看网络流量
cilium hubble observe

# 7. 性能测试

#!/bin/bash
# CNI 性能对比测试脚本

# 测试函数
test_cni_performance() {
    local cni_name=$1
    echo "测试 $cni_name 性能..."
    
    # 获取 Pod IP
    local server_pod=$(kubectl get pod -l app=iperf-server -o jsonpath='{.items[0].metadata.name}')
    local client_pod=$(kubectl get pod -l app=iperf-client -o jsonpath='{.items[0].metadata.name}')
    
    # 运行 iperf3 测试
    kubectl exec $client_pod -- iperf3 -c $server_pod -t 30 -f M > ${cni_name}_iperf3.log 2>&1
    
    # 提取结果
    local bandwidth=$(grep "sender" ${cni_name}_iperf3.log | awk '{print $7}')
    echo "$cni_name 带宽: $bandwidth MB/s"
}

# 测试延迟
test_latency() {
    local cni_name=$1
    echo "测试 $cni_name 延迟..."
    
    local pod1=$(kubectl get pod -l app=test-pod -o jsonpath='{.items[0].metadata.name}')
    local pod2=$(kubectl get pod -l app=test-pod -o jsonpath='{.items[1].metadata.name}')
    
    kubectl exec $pod1 -- ping -c 100 $pod2 > ${cni_name}_ping.log 2>&1
    
    local avg_latency=$(grep "avg" ${cni_name}_ping.log | awk -F'/' '{print $5}')
    echo "$cni_name 平均延迟: $avg_latency ms"
}

# 运行所有测试
echo "开始 CNI 性能对比测试..."

# 测试 Flannel
test_cni_performance "flannel"
test_latency "flannel"

# 测试 Calico
test_cni_performance "calico"
test_latency "calico"

# 测试 Cilium
test_cni_performance "cilium"
test_latency "cilium"

echo "测试完成！查看日志文件获取详细结果。"

# 1. 创建测试 Service
kubectl apply -f - <<EOF
apiVersion: apps/v1
kind: Deployment
metadata:
  name: web
spec:
  replicas: 3
  selector:
    matchLabels:
      app: web
  template:
    metadata:
      labels:
        app: web
    spec:
      containers:
      - name: nginx
        image: nginx:alpine
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: web-service
spec:
  selector:
    app: web
  ports:
  - port: 80
    targetPort: 80
  type: ClusterIP
EOF

# 2. 查看 iptables 规则
sudo iptables -t nat -L KUBE-SERVICES -n -v

# 3. 查看具体 Service 规则
sudo iptables -t nat -L KUBE-SVC-$(kubectl get svc web-service -o jsonpath='{.metadata.uid}' | cut -d'-' -f1) -n -v

# 4. 测试 Service 访问
kubectl run test-pod --image=busybox --rm -it --restart=Never -- sh -c "wget -qO- web-service"

# 5. 查看连接跟踪
sudo conntrack -L | grep web-service

# 1. 修改 kube-proxy 配置
kubectl edit configmap kube-proxy -n kube-system

# 在 data 部分添加：
# mode: "ipvs"
# ipvs:
#   scheduler: "rr"

# 2. 重启 kube-proxy
kubectl rollout restart daemonset/kube-proxy -n kube-system

# 3. 等待重启完成
kubectl rollout status daemonset/kube-proxy -n kube-system

# 4. 查看 IPVS 规则
sudo ipvsadm -Ln

# 5. 查看 IPVS 统计
sudo ipvsadm -Ln --stats

# 6. 测试负载均衡
for i in {1..10}; do
  kubectl run test-pod-$i --image=busybox --rm -it --restart=Never -- sh -c "wget -qO- web-service && echo"
done

# 1. 启用 Cilium eBPF kube-proxy 替换
cilium config set kubeProxyReplacement strict

# 2. 重启 Cilium
kubectl rollout restart daemonset/cilium -n kube-system

# 3. 验证 eBPF 模式
cilium status

# 4. 查看 eBPF 映射
cilium bpf maps list | grep kube-proxy

# 5. 测试 Service 访问
kubectl run test-pod --image=busybox --rm -it --restart=Never -- sh -c "wget -qO- web-service"

# 6. 查看 eBPF 统计
cilium metrics list | grep kube-proxy

#!/bin/bash
# Pod 间不通排查脚本

POD_A="pod-a"
POD_B="pod-b"

echo "=== Pod 间不通排查 ==="

# 1. 检查 Pod 状态
echo "1. 检查 Pod 状态："
kubectl get pods -o wide

# 2. 检查 Pod IP
echo "2. 检查 Pod IP："
POD_A_IP=$(kubectl get pod $POD_A -o jsonpath='{.status.podIP}')
POD_B_IP=$(kubectl get pod $POD_B -o jsonpath='{.status.podIP}')
echo "Pod A IP: $POD_A_IP"
echo "Pod B IP: $POD_B_IP"

# 3. 检查网络接口
echo "3. 检查网络接口："
kubectl exec $POD_A -- ip addr show
kubectl exec $POD_B -- ip addr show

# 4. 检查路由表
echo "4. 检查路由表："
kubectl exec $POD_A -- ip route show
kubectl exec $POD_B -- ip route show

# 5. 检查 ARP 表
echo "5. 检查 ARP 表："
kubectl exec $POD_A -- arp -a
kubectl exec $POD_B -- arp -a

# 6. 测试连通性
echo "6. 测试连通性："
kubectl exec $POD_A -- ping -c 3 $POD_B_IP

# 7. 检查 CNI 插件状态
echo "7. 检查 CNI 插件状态："
kubectl get pods -n kube-system | grep -E "(flannel|calico|cilium)"

# 8. 检查节点网络
echo "8. 检查节点网络："
NODE_A=$(kubectl get pod $POD_A -o jsonpath='{.spec.nodeName}')
NODE_B=$(kubectl get pod $POD_B -o jsonpath='{.spec.nodeName}')
echo "Pod A 节点: $NODE_A"
echo "Pod B 节点: $NODE_B"

# 9. 检查网桥状态
echo "9. 检查网桥状态："
kubectl get nodes -o jsonpath='{.items[0].status.addresses[0].address}' | xargs -I {} ssh {} "brctl show"

# 10. 检查 iptables 规则
echo "10. 检查 iptables 规则："
kubectl get nodes -o jsonpath='{.items[0].status.addresses[0].address}' | xargs -I {} ssh {} "iptables -t nat -L -n -v | grep -A 5 -B 5 $POD_A_IP"

#!/bin/bash
# DNS 解析失败排查脚本

echo "=== DNS 解析失败排查 ==="

# 1. 检查 CoreDNS 状态
echo "1. 检查 CoreDNS 状态："
kubectl get pods -n kube-system -l k8s-app=kube-dns
kubectl get svc -n kube-system kube-dns

# 2. 检查 CoreDNS 日志
echo "2. 检查 CoreDNS 日志："
kubectl logs -n kube-system -l k8s-app=kube-dns --tail=50

# 3. 检查 Pod DNS 配置
echo "3. 检查 Pod DNS 配置："
kubectl run test-dns --image=busybox --rm -it --restart=Never -- sh -c "cat /etc/resolv.conf"

# 4. 测试 DNS 解析
echo "4. 测试 DNS 解析："
kubectl run test-dns --image=busybox --rm -it --restart=Never -- sh -c "nslookup kubernetes.default.svc.cluster.local"

# 5. 检查 Service 端点
echo "5. 检查 Service 端点："
kubectl get endpoints kubernetes

# 6. 测试外部 DNS
echo "6. 测试外部 DNS："
kubectl run test-dns --image=busybox --rm -it --restart=Never -- sh -c "nslookup google.com"

# 7. 检查网络策略
echo "7. 检查网络策略："
kubectl get networkpolicies --all-namespaces

# 8. 检查 CoreDNS 配置
echo "8. 检查 CoreDNS 配置："
kubectl get configmap coredns -n kube-system -o yaml

#!/bin/bash
# 跨节点网络延迟排查脚本

echo "=== 跨节点网络延迟排查 ==="

# 1. 创建跨节点测试 Pod
kubectl apply -f - <<EOF
apiVersion: apps/v1
kind: Deployment
metadata:
  name: latency-test
spec:
  replicas: 2
  selector:
    matchLabels:
      app: latency-test
  template:
    metadata:
      labels:
        app: latency-test
    spec:
      containers:
      - name: test
        image: nginx:alpine
        ports:
        - containerPort: 80
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchExpressions:
              - key: app
                operator: In
                values:
                - latency-test
            topologyKey: kubernetes.io/hostname
EOF

# 2. 等待 Pod 就绪
kubectl wait --for=condition=Ready pod -l app=latency-test --timeout=60s

# 3. 获取 Pod 信息
POD1=$(kubectl get pod -l app=latency-test -o jsonpath='{.items[0].metadata.name}')
POD2=$(kubectl get pod -l app=latency-test -o jsonpath='{.items[1].metadata.name}')
POD1_IP=$(kubectl get pod $POD1 -o jsonpath='{.status.podIP}')
POD2_IP=$(kubectl get pod $POD2 -o jsonpath='{.status.podIP}')
NODE1=$(kubectl get pod $POD1 -o jsonpath='{.spec.nodeName}')
NODE2=$(kubectl get pod $POD2 -o jsonpath='{.spec.nodeName}')

echo "Pod 1: $POD1 ($POD1_IP) on $NODE1"
echo "Pod 2: $POD2 ($POD2_IP) on $NODE2"

# 4. 测试延迟
echo "4. 测试延迟："
kubectl exec $POD1 -- ping -c 10 $POD2_IP

# 5. 测试带宽
echo "5. 测试带宽："
kubectl exec $POD1 -- iperf3 -c $POD2_IP -t 10

# 6. 检查网络路径
echo "6. 检查网络路径："
kubectl exec $POD1 -- traceroute $POD2_IP

# 7. 检查 MTU
echo "7. 检查 MTU："
kubectl exec $POD1 -- ip link show | grep mtu
kubectl exec $POD2 -- ip link show | grep mtu

# 8. 检查网络统计
echo "8. 检查网络统计："
kubectl exec $POD1 -- ss -s
kubectl exec $POD2 -- ss -s

# 9. 检查节点网络
echo "9. 检查节点网络："
kubectl get nodes -o jsonpath='{.items[0].status.addresses[0].address}' | xargs -I {} ssh {} "ethtool eth0"

# 10. 检查 CNI 配置
echo "10. 检查 CNI 配置："
kubectl get nodes -o jsonpath='{.items[0].status.addresses[0].address}' | xargs -I {} ssh {} "ip route show | grep -E '(flannel|calico|cilium)'"

#!/bin/bash
# Kubernetes 网络实验环境搭建脚本

set -e

echo "开始搭建 Kubernetes 网络实验环境..."

# 1. 安装依赖
sudo apt-get update
sudo apt-get install -y curl wget git

# 2. 安装 Docker
curl -fsSL https://get.docker.com -o get-docker.sh
sudo sh get-docker.sh
sudo usermod -aG docker $USER

# 3. 安装 kubectl
curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
sudo install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl

# 4. 安装 kind
curl -Lo ./kind https://kind.sigs.k8s.io/dl/v0.20.0/kind-linux-amd64
chmod +x ./kind
sudo mv ./kind /usr/local/bin/kind

# 5. 安装 Cilium CLI
curl -L --remote-name-all https://github.com/cilium/cilium-cli/releases/latest/download/cilium-linux-amd64.tar.gz
tar xzvfC cilium-linux-amd64.tar.gz /usr/local/bin
rm cilium-linux-amd64.tar.gz

# 6. 创建实验集群
kind create cluster --name network-test --config - <<EOF
kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
nodes:
- role: control-plane
- role: worker
- role: worker
networking:
  podSubnet: "10.244.0.0/16"
  serviceSubnet: "10.96.0.0/12"
EOF

# 7. 等待集群就绪
kubectl wait --for=condition=Ready node --all --timeout=60s

# 8. 安装测试工具
kubectl apply -f - <<EOF
apiVersion: apps/v1
kind: Deployment
metadata:
  name: network-tools
spec:
  replicas: 1
  selector:
    matchLabels:
      app: network-tools
  template:
    metadata:
      labels:
        app: network-tools
    spec:
      containers:
      - name: tools
        image: nicolaka/netshoot
        command: ["sleep", "3600"]
EOF

echo "Kubernetes 网络实验环境搭建完成！"
echo "运行 'kubectl get nodes' 查看集群状态"
echo "运行 'kubectl get pods' 查看 Pod 状态"

# 部署网络测试工具集
kubectl apply -f - <<EOF
apiVersion: apps/v1
kind: Deployment
metadata:
  name: iperf3-server
spec:
  replicas: 1
  selector:
    matchLabels:
      app: iperf3-server
  template:
    metadata:
      labels:
        app: iperf3-server
    spec:
      containers:
      - name: iperf3
        image: networkstatic/iperf3
        command: ["iperf3", "-s"]
        ports:
        - containerPort: 5201
---
apiVersion: v1
kind: Service
metadata:
  name: iperf3-server
spec:
  selector:
    app: iperf3-server
  ports:
  - port: 5201
    targetPort: 5201
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: wrk-client
spec:
  replicas: 1
  selector:
    matchLabels:
      app: wrk-client
  template:
    metadata:
      labels:
        app: wrk-client
    spec:
      containers:
      - name: wrk
        image: williamyeh/wrk
        command: ["sleep", "3600"]
EOF