Calico网络实践构建企业级Kubernetes网络方案一、Calico概述Calico是一个开源的网络和网络安全解决方案专为Kubernetes设计。它提供高性能的容器网络、网络策略和网络安全功能是生产环境中最受欢迎的CNI插件之一。Calico的核心特性高性能网络基于BGP协议的路由方案网络策略灵活的网络访问控制网络安全支持加密和认证可扩展性支持大规模集群多集群支持跨集群网络通信二、Calico安装与配置2.1 使用Operator安装# 创建命名空间 kubectl create namespace tigera-operator # 安装Calico operator kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.26.0/manifests/tigera-operator.yaml # 安装Calico自定义资源 kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.26.0/manifests/custom-resources.yaml2.2 使用Helm安装# 添加Calico Helm仓库 helm repo add projectcalico https://docs.tigera.io/calico/charts # 安装Calico helm install calico projectcalico/tigera-operator \ --namespace tigera-operator \ --version v3.26.02.3 验证安装# 检查Calico Pod状态 kubectl get pods -n calico-system # 检查节点状态 kubectl get nodes -o wide # 运行网络测试 kubectl run -it --rm --image busybox:1.28 dns-test -- nslookup kubernetes.default三、网络策略配置3.1 默认拒绝策略apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: default-deny-all namespace: default spec: podSelector: {} policyTypes: - Ingress - Egress3.2 允许特定服务访问apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: allow-frontend-to-backend namespace: default spec: podSelector: matchLabels: app: backend policyTypes: - Ingress ingress: - from: - podSelector: matchLabels: app: frontend ports: - protocol: TCP port: 80803.3 允许DNS访问apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: allow-dns namespace: default spec: podSelector: {} policyTypes: - Egress egress: - to: - namespaceSelector: matchLabels: name: kube-system podSelector: matchLabels: k8s-app: kube-dns ports: - protocol: UDP port: 53四、高级网络配置4.1 BGP配置apiVersion: projectcalico.org/v3 kind: BGPConfiguration metadata: name: default spec: logSeverityScreen: Info nodeToNodeMeshEnabled: true asNumber: 645124.2 服务外部访问apiVersion: projectcalico.org/v3 kind: FelixConfiguration metadata: name: default spec: serviceExternalIPs: - 10.0.0.0/84.3 网络加密WireGuardapiVersion: projectcalico.org/v3 kind: FelixConfiguration metadata: name: default spec: wireguardEnabled: true wireguardMTU: 1450五、网络监控与诊断5.1 查看网络状态# 查看节点网络状态 calicoctl get nodes -o wide # 查看BGP邻居 calicoctl get bgppeers -o wide # 查看网络策略 calicoctl get networkpolicies -o wide5.2 网络诊断工具# 安装calicoctl curl -L https://github.com/projectcalico/calico/releases/download/v3.26.0/calicoctl-darwin-amd64 -o calicoctl chmod x calicoctl sudo mv calicoctl /usr/local/bin/ # 诊断网络问题 calicoctl node status # 检查IP池 calicoctl get ippools -o wide5.3 流量监控apiVersion: v1 kind: Service metadata: name: calico-node-metrics namespace: calico-system spec: selector: k8s-app: calico-node ports: - name: metrics port: 9091 targetPort: 9091六、多集群网络6.1 集群互联apiVersion: projectcalico.org/v3 kind: BGPPeer metadata: name: remote-cluster spec: peerIP: 192.168.1.100 asNumber: 645136.2 跨集群服务访问apiVersion: projectcalico.org/v3 kind: GlobalNetworkPolicy metadata: name: allow-cross-cluster spec: selector: all() ingress: - action: Allow source: selector: projectcalico.org/cluster cluster-b七、安全最佳实践7.1 网络隔离apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: isolate-namespace namespace: sensitive-app spec: podSelector: {} policyTypes: - Ingress - Egress ingress: - from: - namespaceSelector: matchLabels: name: trusted-namespace egress: - to: - namespaceSelector: matchLabels: name: kube-system7.2 流量加密apiVersion: projectcalico.org/v3 kind: IPAMConfiguration metadata: name: default spec: autoAllocateBlocks: true maxBlocksPerHost: 17.3 日志审计apiVersion: projectcalico.org/v3 kind: FelixConfiguration metadata: name: default spec: flowLogsEnabled: true flowLogsDestination: calico八、性能优化8.1 调整MTUapiVersion: projectcalico.org/v3 kind: FelixConfiguration metadata: name: default spec: interfaceMTU: 90018.2 调整路由刷新间隔apiVersion: projectcalico.org/v3 kind: FelixConfiguration metadata: name: default spec: routeRefreshInterval: 30s8.3 优化BGP配置apiVersion: projectcalico.org/v3 kind: BGPConfiguration metadata: name: default spec: gracefulRestartEnabled: true gracefulRestartTime: 180s九、故障排除9.1 常见问题# 检查Calico节点状态 kubectl describe pods -n calico-system -l k8s-appcalico-node # 查看Felix日志 kubectl logs -n calico-system -l k8s-appcalico-node -c felix # 验证网络连通性 kubectl run -it --rm --image busybox:1.28 network-test -- ping -c 3 10.0.0.29.2 网络策略问题# 检查网络策略状态 calicoctl get networkpolicy -o yaml # 查看策略冲突 calicoctl apply -f - EOF apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: test-policy spec: podSelector: {} policyTypes: - Ingress EOF十、总结Calico为Kubernetes提供了企业级的网络解决方案支持高性能路由、灵活的网络策略和强大的安全功能。通过本文的实践指南您可以快速部署和配置Calico网络构建安全可靠的容器网络环境。参考资料Calico官方文档Calico GitHubKubernetes CNI文档