From 626e4a8e35cbdfe72ce458de0ec0d6690072c435 Mon Sep 17 00:00:00 2001 From: AJ Bowen Date: Mon, 17 Jun 2019 04:16:15 -0700 Subject: [PATCH] Tweaks (#482) Add Firewalling slide; alter some wording --- slides/k8s/cluster-backup.md | 2 +- slides/k8s/cni.md | 2 ++ slides/k8s/dmuc.md | 4 ++-- slides/k8s/multinode.md | 23 +++++++++++++++++++++-- 4 files changed, 26 insertions(+), 5 deletions(-) diff --git a/slides/k8s/cluster-backup.md b/slides/k8s/cluster-backup.md index c42a153d..048d09ee 100644 --- a/slides/k8s/cluster-backup.md +++ b/slides/k8s/cluster-backup.md @@ -18,7 +18,7 @@ (it gives us replication primitives) -- Kubernetes helps us to clone/replicate environments +- Kubernetes helps us clone / replicate environments (all resources can be described with manifests) diff --git a/slides/k8s/cni.md b/slides/k8s/cni.md index cd206ab1..26a736b9 100644 --- a/slides/k8s/cni.md +++ b/slides/k8s/cni.md @@ -66,6 +66,8 @@ Look in each plugin's directory for its documentation. --- +class: extra-details + ## Conf vs conflist - There are two slightly different configuration formats diff --git a/slides/k8s/dmuc.md b/slides/k8s/dmuc.md index d70972aa..17f60543 100644 --- a/slides/k8s/dmuc.md +++ b/slides/k8s/dmuc.md @@ -175,7 +175,7 @@ Success! ] -So far, so good. +We should get `No resources found.` and the `kubernetes` service, respectively. Note: the API server automatically created the `kubernetes` service entry. @@ -225,7 +225,7 @@ Success? ] -Our Deployment is in a bad shape: +Our Deployment is in bad shape: ``` NAME READY UP-TO-DATE AVAILABLE AGE deployment.apps/web 0/1 0 0 2m26s diff --git a/slides/k8s/multinode.md b/slides/k8s/multinode.md index 9a4b1313..af6b6194 100644 --- a/slides/k8s/multinode.md +++ b/slides/k8s/multinode.md @@ -195,7 +195,7 @@ class: extra-details ## Check our pods -- The pods will be scheduled to the nodes +- The pods will be scheduled on the nodes - The nodes will pull the `nginx` image, and start the pods @@ -325,7 +325,7 @@ class: extra-details - We will add the `--network-plugin` and `--pod-cidr` flags -- We all have a "cluster number" (let's call that `C`) +- We all have a "cluster number" (let's call that `C`) printed on your VM info card - We will use pod CIDR `10.C.N.0/24` (where `N` is the node number: 1, 2, 3) @@ -480,6 +480,23 @@ Sometimes it works, sometimes it doesn't. Why? ```bash kubectl get nodes -o wide ``` + +--- + +## Firewalling + +- By default, Docker prevents containers from using arbitrary IP addresses + + (by setting up iptables rules) + +- We need to allow our containers to use our pod CIDR + +- For simplicity, we will insert a blanket iptables rule allowing all traffic: + + `iptables -I FORWARD -j ACCEPT` + +- This has to be done on every node + --- ## Setting up routing @@ -488,6 +505,8 @@ Sometimes it works, sometimes it doesn't. Why? - Create all the routes on all the nodes +- Insert the iptables rule allowing traffic + - Check that you can ping all the pods from one of the nodes - Check that you can `curl` the ClusterIP of the Service successfully