Networking

# 인터페이스 확인
ip link
ip addr

# IP 주소 할당
ip addr add 192.168.1.10/24 dev eth0

# 라우팅 테이블 확인
ip route
route -n

# 라우트 추가
ip route add 192.168.2.0/24 via 192.168.1.1

# Default Gateway 설정
ip route add default via 192.168.1.1

# 임시 활성화
echo 1 > /proc/sys/net/ipv4/ip_forward

# 영구 활성화 (/etc/sysctl.conf)
net.ipv4.ip_forward = 1

# DNS 서버만 조회 (hosts 파일 무시)
nslookup google.com
dig google.com

# hosts 파일 + DNS 모두 확인
ping google.com

# Namespace 생성
ip netns add red
ip netns add blue

# Namespace 목록
ip netns

# Namespace 내 명령 실행
ip netns exec red ip link
ip -n red link  # 간단한 형식

# veth pair 생성
ip link add veth-red type veth peer name veth-blue

# 각 namespace에 할당
ip link set veth-red netns red
ip link set veth-blue netns blue

# IP 할당 및 활성화
ip -n red addr add 192.168.15.1/24 dev veth-red
ip -n red link set veth-red up

ip -n blue addr add 192.168.15.2/24 dev veth-blue
ip -n blue link set veth-blue up

# Bridge 생성
ip link add v-net-0 type bridge
ip link set v-net-0 up
ip addr add 192.168.15.5/24 dev v-net-0

# Namespace를 Bridge에 연결
ip link add veth-red type veth peer name veth-red-br
ip link set veth-red netns red
ip link set veth-red-br master v-net-0

# Default Gateway 설정 (namespace 내부)
ip -n red route add default via 192.168.15.5

# NAT 설정 (Host에서)
iptables -t nat -A POSTROUTING -s 192.168.15.0/24 -j MASQUERADE

# 외부에서 namespace로 포트 포워딩
iptables -t nat -A PREROUTING -p tcp --dport 80 \
  -j DNAT --to-destination 192.168.15.2:80

# 포트 매핑
docker run -p 8080:80 nginx

# 내부적으로 iptables NAT 규칙 생성
iptables -t nat -A DOCKER -p tcp --dport 8080 \
  -j DNAT --to-destination 172.17.0.3:80

{
  "cniVersion": "0.3.0",
  "name": "mynet",
  "type": "bridge",
  "bridge": "cni0",
  "isGateway": true,
  "ipMasq": true,
  "ipam": {
    "type": "host-local",
    "subnet": "10.244.0.0/16",
    "routes": [
      { "dst": "0.0.0.0/0" }
    ]
  }
}

# 기본 요구사항
- 각 노드: 고유한 IP, 호스트명, MAC 주소
- 노드 간 통신 가능
- 필수 포트 개방

# 진단 명령어
ip addr show          # 네트워크 인터페이스
netstat -plnt         # 포트 리스닝 상태
ss -tulpn             # 소켓 상태
iptables -L           # 방화벽 규칙

# DaemonSet으로 배포 (모든 노드에 자동 배포)
kubectl apply -f https://github.com/weaveworks/weave/releases/download/v2.8.1/weave-daemonset-k8s.yaml

# 확인
kubectl get pods -n kube-system | grep weave
kubectl logs -n kube-system weave-net-xxxxx

# kube-apiserver 설정
--service-cluster-ip-range=10.96.0.0/12   # Service IP
--cluster-cidr=10.244.0.0/16              # Pod IP

# 중요: 두 범위가 겹치면 안 됨

# Service: 10.103.132.104:3306 → Pod: 10.244.1.2:3306
iptables -t nat -A KUBE-SERVICES -d 10.103.132.104/32 -p tcp --dport 3306 \
  -j DNAT --to-destination 10.244.1.2:3306

# 규칙 확인
iptables -t nat -L -n | grep <service-name>

# 같은 네임스페이스
curl web-service

# 다른 네임스페이스
curl web-service.apps
curl web-service.apps.svc.cluster.local  # FQDN

# /etc/resolv.conf
nameserver 10.96.0.10
search default.svc.cluster.local svc.cluster.local cluster.local

# CoreDNS 확인
kubectl get pods -n kube-system | grep coredns
kubectl get svc -n kube-system kube-dns

# DNS 테스트
kubectl run test --image=busybox --rm -it -- nslookup web-service

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: app-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  ingressClassName: nginx
  rules:
  - host: myapp.example.com
    http:
      paths:
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 80
      - path: /web
        pathType: Prefix
        backend:
          service:
            name: web-service
            port:
              number: 80

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: multi-host-ingress
spec:
  ingressClassName: nginx
  rules:
  - host: api.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 80
  - host: web.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: web-service
            port:
              number: 80

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: tls-ingress
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - myapp.example.com
    secretName: tls-secret  # TLS 인증서 Secret
  rules:
  - host: myapp.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: app-service
            port:
              number: 80

# Nginx Ingress Controller 설치
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.2/deploy/static/provider/cloud/deploy.yaml

# 확인
kubectl get pods -n ingress-nginx
kubectl get svc -n ingress-nginx

apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: example-class
spec:
  controllerName: example.com/gateway-controller

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: example-gateway
spec:
  gatewayClassName: example-class
  listeners:
  - name: http
    protocol: HTTP
    port: 80
  - name: https
    protocol: HTTPS
    port: 443
    tls:
      certificateRefs:
      - name: tls-secret

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: example-route
spec:
  parentRefs:
  - name: example-gateway
  hostnames:
  - "www.example.com"
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /api
    backendRefs:
    - name: api-service
      port: 8080

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: canary-route
spec:
  parentRefs:
  - name: example-gateway
  rules:
  - backendRefs:
    - name: app-v1
      port: 80
      weight: 80
    - name: app-v2
      port: 80
      weight: 20

# Pod IP 확인
kubectl get pods -o wide

# Pod 내부에서 네트워크 확인
kubectl exec -it <pod> -- ip addr
kubectl exec -it <pod> -- ip route
kubectl exec -it <pod> -- cat /etc/resolv.conf

# Service 및 Endpoints 확인
kubectl get svc
kubectl get endpoints <service-name>

# Service 상세 정보
kubectl describe svc <service-name>

# DNS 조회 테스트
kubectl run test --image=busybox --rm -it -- nslookup <service-name>

# CoreDNS 로그 확인
kubectl logs -n kube-system -l k8s-app=kube-dns

# CNI 설정 확인
ls -la /etc/cni/net.d/
cat /etc/cni/net.d/*.conf

# CNI 플러그인 Pod 확인
kubectl get pods -n kube-system | grep -E 'calico|flannel|weave'

# kube-proxy 로그
kubectl logs -n kube-system -l k8s-app=kube-proxy

# iptables 규칙 확인 (노드에서)
iptables -t nat -L -n | grep <service-name>