342ea5ac9f
* Move getNodeIP logic to utils package Remove redundant ipset lookups utils.NewIPSet() does this for us. * Don't masquerade pod -> nodeAddrsIPSet traffic Previously with Pod egress enabled, this would get masqueraded. This change also adds cleanup for said ipset. * Enhanced cleanup of Pod egress, overlay networking - Delete old/bad pod egress iptables rule(s) from old versions - When pod egress or overlay are disabled, cleanup as needed * Update IPSet.Sets to map type * ipset enhancements - Avoid providing method that would delete all ipset sets on a system - New method DestroyAllWithin() destroys sets tracked by an IPSet - Create() now handles cases where Sets/System state are not in sync - Refresh() now handles leftover -temp set gracefully - Swap() now uses ipset swap - Delete() improved sync of Sets and system state - Get() now validates if map element exists before trying - etc * Update routes controller to reflect ipset changes
Kube-router is a distributed load balancer, firewall and router designed for Kubernetes networking with aim to provide operational simplicity and high performance.
Primary Features
kube-router does it all.
With all features enabled, kube-router is a lean yet powerful alternative to several network components used in typical Kubernetes clusters. All this from a single DaemonSet/Binary. It doesn't get any easier.
IPVS/LVS based service proxy | --run-service-proxy
kube-router uses the Linux kernel's IPVS features to implement its K8s Services Proxy. This feature has been requested for some time in kube-proxy, but you can have it right now with kube-router.
Read more about the advantages of IPVS for container load balancing:
- Kubernetes network services proxy with IPVS/LVS
- Kernel Load-Balancing for Docker Containers Using IPVS
Pod Networking | --run-router
kube-router handles Pod networking efficiently with direct routing thanks to the BGP protocol and the GoBGP Go library. It uses the native Kubernetes API to maintain distributed pod networking state. That means no dependency on a separate datastore to maintain in your cluster.
kube-router's elegant design also means there is no dependency on another CNI plugin. The official "bridge" plugin provided by the CNI project is all you need -- and chances are you already have it in your CNI binary directory!
Read more about the advantages and potential of BGP with Kubernetes:
Network Policy Controller | --run-firewall
Enabling Kubernetes Network Policies is easy with kube-router -- just add a flag to kube-router. It uses ipsets with iptables to ensure your firewall rules have as little performance impact on your cluster as possible.
Kube-router supports the networking.k8s.io/NetworkPolicy API or network policy V1/GA semantics and also network policy beta semantics.
Read more about kube-router's approach to Kubernetes Network Policies:
Advanced BGP Capabilities
If you have other networking devices or SDN systems that talk BGP, kube-router will fit in perfectly. From a simple full node-to-node mesh to per-node peering configurations, most routing needs can be attained. The configuration is Kubernetes native (annotations) just like the rest of kube-router, so use the tools you already know! Since kube-router uses GoBGP, you have access to a modern BGP API platform as well right out of the box.
For more details please refer to the BGP documentation.
Standard Linux Networking
A key design tenet of Kube-router is to use standard Linux networking stack and toolset. There is no overlays or SDN pixie dust, but just plain good old networking. You can use standard Linux networking tools like iptables, ipvsadm, ipset, iproute, traceroute, tcpdump etc. to troubleshoot or observe data path. When kube-router is ran as a daemonset, image also ships with these tools automatically configured for your cluster.
Small Footprint
Although it does the work of several of its peers in one binary, kube-router does it all with a relatively tiny codebase, partly because IPVS is already there on your Kuberneres nodes waiting to help you do amazing things. kube-router brings that and GoBGP's modern BGP interface to you in an elegant package designed from the ground up for Kubernetes.
High Performance
A primary motivation for kube-router is performance. The combination of BGP for inter-node Pod networking and IPVS for load balanced proxy Services is a perfect recipe for high-performance cluster networking at scale. BGP ensures that the data path is dynamic and efficient, and IPVS provides in-kernel load balancing that has been thouroughly tested and optimized.
Getting Started
Project status
Project is in alpha stage. We are working towards beta release milestone and are activley incorporating users feedback.
Contributing
We encourage all kinds of contributions, be they documentation, code, fixing typos, tests — anything at all. Please read the contribution guide.
Support & Feedback
If you experience any problems please reach us on our gitter community forum for quick help. Feel free to leave feedback or raise questions at any time by opening an issue here.
Acknowledgement
Kube-router build upon following libraries: