Comments (8)
We're use AWS security groups. As part of the k8s deployment, we keep the control plane separate from the rest of the cluster, by keeping the pods on separate subnets w/ security groups. We don't have an immediate use case for implementing Kubernetes NetworkPolicy controls in our environment, but I'd be interested in adding support to cni-ipvlan-vpc-k8s.
from cni-ipvlan-vpc-k8s.
Thanks for the response. Can you clarify a bit on the subnet and security group management here? Are you grouping pods with the same security groups into one ENI? If so, how do you manage the schedule decision to avoid the case assigning a pod to a node which has max number of ENIs allocated but already set to different security groups?
from cni-ipvlan-vpc-k8s.
For a given Kubernetes cluster, all pods use the same security groups -- we don't make scheduling decisions with respect to which Pod an ENI will land on. We currently enforce network controls between Lyft services at layer 7, although we're likely to implement NetworkPolicy support in the near future.
from cni-ipvlan-vpc-k8s.
Thanks a lot for open sourcing this, just had a small question from your last comment @paulnivin on the feature addition of supporting NetworkPolicies. Was curious about the status of it :)
from cni-ipvlan-vpc-k8s.
@tasdikrahman NetworkPolicy support should land soon -- it's a requirement for some other work at Lyft that's shipping soon. Best current estimate is early May.
from cni-ipvlan-vpc-k8s.
@paulnivin That's a great plugin, thanks for open sourcing.
From the above I assume that there is no way to schedule pod in specific subnet atm? In our case we would like to have a few different networks "zones" (map them to subnets -> hence ENIs) and run specific workload in a specific "zone"/subnet.
And +1 for network policies. We want use calico as a network policy engine, have you had any progress on this?
from cni-ipvlan-vpc-k8s.
@xdrus for this use case you could create separate node pools with different CNI configuration (subnet tags in particular) and use kubernetes taints and labels to control which applications go to which pool.
An alternative would be to select the subnet based on pod annotations but the plugin does not support that today
from cni-ipvlan-vpc-k8s.
Thanks @lbernail that is exactly what we do now with amazon vpc cni plugin, but the alternative approach would allow us to increase density/utilization of nodes.
from cni-ipvlan-vpc-k8s.
Related Issues (20)
- Clarify configuration and setup instructions
- The CNI plugin only works on OS where interfaces are called ethX
- Additional interfaces could be in the same subnet HOT 8
- Plugin does not work with containerd runtime HOT 6
- missing routes on first pod for an interface HOT 3
- Nodeports not working properly HOT 8
- Incorrect handling of errors in IPAM HOT 1
- Inconsistency between ENI allocated IPs and OS configuration HOT 16
- CNI plugin: `portmap` when chained with cni-ipvlan-vpc-k8s does not work
- Listing VPC CIDRs to create routes in pods does not filter on association state
- New release HOT 1
- Disabling ipMasq
- Cannot connect to pod outside VPC HOT 4
- Pods loosing connection to each other on particular node from time to time HOT 13
- Build binaries for 0.5.0 release HOT 1
- aws-vpc-cni-k8s vs lyft cni HOT 3
- IP Batching changes the default behavior HOT 1
- Brother, I compile for a day. Compilation is unsuccessful. Please find a compiled package.
- Binary Release for 0.6.1 HOT 3
- support for containerd
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from cni-ipvlan-vpc-k8s.