or distribution Networking with NSX-T for publication Kubernetes Container 2018-09-05آ  #vmworld...

download or distribution Networking with NSX-T for publication Kubernetes Container 2018-09-05آ  #vmworld Kubernetes

of 42

  • date post

    20-May-2020
  • Category

    Documents

  • view

    0
  • download

    0

Embed Size (px)

Transcript of or distribution Networking with NSX-T for publication Kubernetes Container 2018-09-05آ  #vmworld...

  • #vmworld

    Kubernetes Container Networking with NSX-T Data Center Deep Dive

    Yasen Simeonov, VMware, Inc.

    NET1677BU

    #NET1677BU

    VMw orld

    201 8 Co

    nten t: No

    t for pub

    licat ion o

    r dis tribu

    tion

  • Disclaimer

    2©2018 VMware, Inc.

    This presentation may contain product features or functionality that are currently under development.

    This overview of new technology represents no commitment from VMware to deliver these features in any generally available product.

    Features are subject to change, and must not be included in contracts, purchase orders, or sales agreements of any kind.

    Technical feasibility and market demand will affect final delivery.

    Pricing and packaging for any new features/functionality/ technology discussed or presented, have not been determined.

    VMw orld

    201 8 Co

    nten t: No

    t for pub

    licat ion o

    r dis tribu

    tion

  • Agenda

    3©2018 VMware, Inc.

    NSX-T Intro Quick level set on NSX-T

    Kubernetes Overview Technical overview of Kubernetes, nomenclature & networking details

    NSX-T & Kubernetes Details of the NSX-T integration with Kubernetes

    Demo Seeing is believing

    VMw orld

    201 8 Co

    nten t: No

    t for pub

    licat ion o

    r dis tribu

    tion

  • 4©2018 VMware, Inc.

    NSX-T Data Center Intro Quick level set on NSX-T Data Center

    VMw orld

    201 8 Co

    nten t: No

    t for pub

    licat ion o

    r dis tribu

    tion

  • 5©2018 VMware, Inc.

    BRANCH

    BRANCH

    BRANCH

    BRANCH

    BRANCH

    BRANCH

    BRANCH

    BRANCH

    TELCO/NFV

    TELCO/NFV

    EDGE/IOT

    TELCO/NFV

    BRANCH

    BRANCH

    EDGE/IOT

    EDGE/IOT

    The Virtual Cloud Network Connect and protect your business

    VMw orld

    201 8 Co

    nten t: No

    t for pub

    licat ion o

    r dis tribu

    tion

  • 6©2018 VMware, Inc.

    Identity

    Apps and Data

    Policy ScalabilityAnalytics and Insights

    Secure Connectivity Availability

    Users

    Private Data Centers

    VMs, Containers, Microservices

    Branch Offices

    Public Clouds

    Telco Networks

    Things

    Virtual Cloud Networking Connect & Protect any workload across any environment

    Built-in

    Automated

    Programmable

    Application Centric

    VMw orld

    201 8 Co

    nten t: No

    t for pub

    licat ion o

    r dis tribu

    tion

  • 7©2018 VMware, Inc.

    NETWORKING AND SECURITY MANAGEMENT AND AUTOMATION

    vRealize Automation End-to-end workload automation

    Network Insight Network discovery and insights

    Cloud-Based Management Workflow Automation Blueprints / Templates Insights / Discovery Visibility

    NETWORK AND SECURITY VIRTUALIZATION

    AppDefense Modern application

    security

    NSX SD-WAN by VeloCloud

    WAN connectivity services

    NSX Hybrid Connect Data center and cloud

    workload migration

    NSX Data Center Networking and

    security for data center workloads

    NSX Cloud Networking and

    security for Public Cloud workloads

    Security Integration Extensibility Automation Elasticity

    VMware NSX Portfolio The foundation of the Virtual Cloud Network

    VMw orld

    201 8 Co

    nten t: No

    t for pub

    licat ion o

    r dis tribu

    tion

  • 8©2018 VMware, Inc.

    Central Control Cluster CCP

    Local Control Plane LCP

    NSX-T Data Center Architecture and Components

    Cloud Consumption

    Data Plane ESXi

    (+ kernel modules)

    Control Plane

    Management Plane

    NSX Edge VM or

    Bare Metal

    Layer 2 Bridge

    KVM (+ kernel modules)

    Highly available and scalable Built for consumption by

    developers

    Support for endpoint heterogeneity

    Improved performance and resiliency

    OpenStack, k8s or Custom

    VMw orld

    201 8 Co

    nten t: No

    t for pub

    licat ion o

    r dis tribu

    tion

  • 9©2018 VMware, Inc.

    Data Plane

    Improved performance and resiliency

    Admin

    Tenants/CMP

    Designed for multi-tenancy and scale

    New distributed edge architecture with increased

    performance with DPDK

    p1 p2

    HV TN1vSwitch1 TEP

    Overlay Transport Zone

    TEP: Overlay Tunnel End Point

    (with its own IP address)

    GENEVE Tunnel

    p1 p2

    HV TN1 vSwitch2 TEP

    Next gen overlay maintaining

    performance with increased flexibility

    Edge Node

    Edge Cluster

    Edge Node

    Edge Node

    Edge Node

    VMw orld

    201 8 Co

    nten t: No

    t for pub

    licat ion o

    r dis tribu

    tion

  • 10©2018 VMware, Inc.

    Kubernetes Overview Technical overview of Kubernetes, nomenclature & networking details

    VMw orld

    201 8 Co

    nten t: No

    t for pub

    licat ion o

    r dis tribu

    tion

  • 11©2018 VMware, Inc.

    Kubernetes is an open-source platform for automating deployment, scaling, and operations of application containers across clusters of hosts, providing container-centric infrastructure.

    What is Kubernetes?

    VMw orld

    201 8 Co

    nten t: No

    t for pub

    licat ion o

    r dis tribu

    tion

  • 12©2018 VMware, Inc.

    Kubernetes Components

    K8s Cluster Consists of Master(s) and Nodes

    K8s Master Components • API Server • Scheduler • Controller Manager • Dashboard

    K8s Node Components • Kubelet • Kube-Proxy • Containers Runtime

    (Docker or Rocket)

    K8s master K8s master

    K8s Master

    Controller Manager

    K8s API Server

    Key-Value Store

    dashboard

    Scheduler

    K8s nodeK8s nodeK8s nodeK8s node

    K8s Nodes

    kubelet c runtime

    Kube-proxy

    > _ Kubectl

    CLI

    K8s Master(s)

    VMw orld

    201 8 Co

    nten t: No

    t for pub

    licat ion o

    r dis tribu

    tion

  • 13©2018 VMware, Inc.

    Kubernetes Pod

    A Pod is a group of one or more containers that shares an IP address and a Data Volume Pod

    pause container (‘owns’ the IP stack)

    10.24.0.0/16

    10.24.0.2

    nginx tcp/80

    mgmt tcp/22

    logging udp/514

    IPC

    External IP Traffic

    VMw orld

    201 8 Co

    nten t: No

    t for pub

    licat ion o

    r dis tribu

    tion

  • 14©2018 VMware, Inc.

    Kubernetes Namespace

    Namespaces are a way to divide cluster resources amongst users and groups

    They can be thought of as Tenants

    They are a way to provide Resources Quotas, RBAC, Networking Multitenancy, and Name uniqueness

    Namespace: foo Base URI: /api/v1/namespaces/foo

    ‚redis-master‘ Pod: /api/v1/namespaces/foo/pods/redis-master

    ‚redis‘ service: /api/v1/namespaces/foo/services/redis-master

    Namespace: bar Base URI: /api/v1/namespaces/bar

    ‚redis-master‘ Pod: /api/v1/namespaces/bar/pods/redis-master

    ‚redis‘ service: /api/v1/namespaces/bar/services/redis-master

    VMw orld

    201 8 Co

    nten t: No

    t for pub

    licat ion o

    r dis tribu

    tion

  • 15©2018 VMware, Inc.

    Kubernetes Service

    A Kubernetes Service defines a logical set of Pods, selected with matching labels

    Serves multiple functions: • Service Discovery / DNS • East/West load balancing

    in the Cluster (Type: ClusterIP) • External load balancing for

    L4 TCP/UDP (Type: LoadBalancer)

    • External access to the service through the nodes IPs (Type: NodePort)

    Redis Slave Pods

    redis-slave svc

    10.24.0.5

    ClusterIP 172.30.0.24

    Web Front-End Pods

    10.24.2.7

    ▶ kubectl describe svc redis-slave Name: redis-slave Namespace: default Labels: name=redis-slave Selector: name=redis-slave Type: LoadBalancer IP: 172.30.0.24 LoadBalancer Ingress: 134.247.200.20 Port: 6379/TCP Endpoints: 10.24.0.5:6379,

    10.24.2.7:6379

    DNS:

    redis-slave..cluster.local 172.30.0.24

    ExternalIP 134.247.200.20

    DNS:

    redis-slave.external.com 134.247.200.20

    VMw orld

    201 8 Co

    nten t: No

    t for pub

    licat ion o

    r dis tribu

    tion

  • 16©2018 VMware, Inc.

    Kubernetes Ingress

    A Kubernetes Ingress Object is a L7 LoadBalancing rule that binds a hostname and url to a Service

    The LoadBalancer Datapath can be implemented as an external Load Balancer or as a K8s Pod

    Web Front-End Pods (shop svc)

    http://www.bikeshop.com/shop

    Web Front-End Pods (special-offers svc)

    http://www.bikeshop.com/special-offers

    LoadBalancer Datapath

    (External or K8s Pods)

    ▶ kubectl describe ingress bikeshop-ingress-shop Name: bikeshop-shop Namespace: