Azure Kubernetes 服务 (AKS) 中应用程序的网络概念Network concepts for applications in Azure Kubernetes Service (AKS)

在基于容器的微服务应用程序开发方法中,应用程序组件必须协同工作才能处理其任务。In a container-based microservices approach to application development, application components must work together to process their tasks. Kubernetes 提供支持此应用程序通信的各种资源。Kubernetes provides various resources that enable this application communication. 可以在内部或外部连接应用程序并将其公开。You can connect to and expose applications internally or externally. 要生成高可用性应用程序,可以对应用程序进行负载均衡。To build highly available applications, you can load balance your applications. 更复杂的应用程序可能需要配置 SSL/TLS 终止的入口流量或多个组件的路由。More complex applications may require configuration of ingress traffic for SSL/TLS termination or routing of multiple components. 出于安全考虑,可能还需要限制流量流入或 Pod 和节点之间的流量。For security reasons, you may also need to restrict the flow of network traffic into or between pods and nodes.

本文介绍了为 AKS 中的应用程序提供网络的核心概念:This article introduces the core concepts that provide networking to your applications in AKS:

Kubernetes 基础知识Kubernetes basics

为允许访问应用程序或让应用程序组件相互通信,Kubernetes 为虚拟网络提供了抽象层。To allow access to your applications, or for application components to communicate with each other, Kubernetes provides an abstraction layer to virtual networking. Kubernetes 节点连接到虚拟网络,可为 Pod 提供入站和出站连接。Kubernetes nodes are connected to a virtual network, and can provide inbound and outbound connectivity for pods. kube-proxy 组件在每个节点上运行,以提供这些网络功能 。The kube-proxy component runs on each node to provide these network features.

在 Kubernetes 中,服务以逻辑方式对 Pod 进行分组,以允许通过 IP 地址或 DNS 名称以及特定端口进行直接访问 。In Kubernetes, Services logically group pods to allow for direct access via an IP address or DNS name and on a specific port. 此外,还可使用负载均衡器分发流量 。You can also distribute traffic using a load balancer. 使用入口控制器也可实现更复杂的应用程序流量路由 。More complex routing of application traffic can also be achieved with Ingress Controllers. 使用 Kubernetes 网络策略可提供安全性,还可筛选 Pod 网络流量 。Security and filtering of the network traffic for pods is possible with Kubernetes network policies.

Azure 平台还有助于简化 AKS 群集的虚拟网络。The Azure platform also helps to simplify virtual networking for AKS clusters. 创建 Kubernetes 负载均衡器时,将创建和配置基础 Azure 负载均衡器资源。When you create a Kubernetes load balancer, the underlying Azure load balancer resource is created and configured. 打开 Pod 的网络端口时,会配置相应的 Azure 网络安全组规则。As you open network ports to pods, the corresponding Azure network security group rules are configured. 对于 HTTP 应用程序路由,Azure 还可以在配置新的入口路由时配置外部 DNS 。For HTTP application routing, Azure can also configure external DNS as new ingress routes are configured.

服务Services

为简化应用程序工作负载的网络配置,Kubernetes 使用服务以逻辑方式对一组 Pod 进行分组并提供网络连接 。To simplify the network configuration for application workloads, Kubernetes uses Services to logically group a set of pods together and provide network connectivity. 可用的服务类型如下:The following Service types are available:

  • 群集 IP - 创建在 AKS 群集中使用的内部 IP 地址。Cluster IP - Creates an internal IP address for use within the AKS cluster. 适用于支持群集中其他工作负载的仅限内部使用的应用程序。Good for internal-only applications that support other workloads within the cluster.

    显示 AKS 群集中群集 IP 流量的示意图

  • NodePort - 在基础节点上创建端口映射,该映射允许使用节点 IP 地址和端口直接访问应用程序。NodePort - Creates a port mapping on the underlying node that allows the application to be accessed directly with the node IP address and port.

    显示 AKS 群集中 NodePort 流量的示意图

  • LoadBalancer - 创建 Azure 负载均衡器资源、配置外部 IP 地址并将请求的 Pod 连接到负载均衡器后端池。LoadBalancer - Creates an Azure load balancer resource, configures an external IP address, and connects the requested pods to the load balancer backend pool. 为允许客户流量发送到应用程序,要在所需端口上创建负载均衡规则。To allow customers traffic to reach the application, load balancing rules are created on the desired ports.

    显示 AKS 群集中负载均衡器流量的示意图

    针对入站流量的其他控制和路由,可能要改用入口控制器For additional control and routing of the inbound traffic, you may instead use an Ingress controller.

  • ExternalName - 创建特定的 DNS 条目,便于访问应用程序。ExternalName - Creates a specific DNS entry for easier application access.

可以动态分配负载均衡器和服务的 IP 地址,也可以指定要使用的现有静态 IP 地址。The IP address for load balancers and services can be dynamically assigned, or you can specify an existing static IP address to use. 可以分配内部和外部静态 IP 地址。Both internal and external static IP addresses can be assigned. 这个现有静态 IP 地址通常与 DNS 条目绑定。This existing static IP address is often tied to a DNS entry.

可以创建内部和外部负载均衡器 。Both internal and external load balancers can be created. 内部负载均衡器仅分配有一个专用 IP 地址,因此无法从 Internet 对其进行访问。Internal load balancers are only assigned a private IP address, so they can't be accessed from the Internet.

Azure 虚拟网络Azure virtual networks

在 AKS 中,可以部署使用以下两种网络模型之一的群集:In AKS, you can deploy a cluster that uses one of the following two network models:

  • Kubenet 网络 - 通常在部署 AKS 群集时创建和配置网络资源 。Kubenet networking - The network resources are typically created and configured as the AKS cluster is deployed.
  • Azure 容器网络接口 (CNI) 网络 - AKS 群集连接到现有的虚拟网络资源和配置 。Azure Container Networking Interface (CNI) networking - The AKS cluster is connected to existing virtual network resources and configurations.

Kubenet(基本)网络Kubenet (basic) networking

kubenet 网络选项是用于创建 AKS 群集的默认配置 。The kubenet networking option is the default configuration for AKS cluster creation. 使用 kubenet,节点从 Azure 虚拟网络子网获取 IP 地址 。With kubenet, nodes get an IP address from the Azure virtual network subnet. Pod 接收从逻辑上不同的地址空间到节点的 Azure 虚拟网络子网的 IP 地址。Pods receive an IP address from a logically different address space to the Azure virtual network subnet of the nodes. 然后配置网络地址转换 (NAT),以便 Pod 可以访问 Azure 虚拟网络上的资源。Network address translation (NAT) is then configured so that the pods can reach resources on the Azure virtual network. 流量的源 IP 地址通过 NAT 转换为节点的主 IP 地址。The source IP address of the traffic is NAT'd to the node's primary IP address.

节点使用 kubenet Kubernetes 插件。Nodes use the kubenet Kubernetes plugin. 可以让 Azure 平台创建和配置虚拟网络,或选择将 AKS 群集部署到现有虚拟网络子网中。You can let the Azure platform create and configure the virtual networks for you, or choose to deploy your AKS cluster into an existing virtual network subnet. 同样,只有 Pod 和接收可路由 IP 地址的节点才能使用 NAT 与 AKS 群集外的其他资源进行通信。Again, only the nodes receive a routable IP address, and the pods use NAT to communicate with other resources outside the AKS cluster. 这种方法大大减少了需要在网络空间中保留供 Pod 使用的 IP 地址数量。This approach greatly reduces the number of IP addresses that you need to reserve in your network space for pods to use.

有关详细信息,请参阅为 AKS 群集配置 kubenet 网络For more information, see Configure kubenet networking for an AKS cluster.

Azure CNI(高级)网络Azure CNI (advanced) networking

借助 Azure CNI,每个 pod 都可以从子网获取 IP 地址,并且可以直接访问。With Azure CNI, every pod gets an IP address from the subnet and can be accessed directly. 这些 IP 地址在网络空间必须是唯一的,并且必须事先计划。These IP addresses must be unique across your network space, and must be planned in advance. 每个节点都有一个配置参数来表示它支持的最大 Pod 数。Each node has a configuration parameter for the maximum number of pods that it supports. 这样,就会为每个节点预留相应的 IP 地址数。The equivalent number of IP addresses per node are then reserved up front for that node. 使用此方法需要经过更详细的规划,否则可能会耗尽 IP 地址,或者在应用程序需求增长时需要在更大的子网中重建群集。This approach requires more planning, as can otherwise lead to IP address exhaustion or the need to rebuild clusters in a larger subnet as your application demands grow.

节点使用 Azure 容器网络接口 (CNI) Kubernetes 插件。Nodes use the Azure Container Networking Interface (CNI) Kubernetes plugin.

显示两个节点的示意图,其中的网桥将每个节点连接到单个 Azure VNet

有关详细信息,请参阅为 AKS 群集配置 Azure CNIFor more information, see Configure Azure CNI for an AKS cluster.

网络模型的比较Compare network models

Kubenet 和 Azure CNI 都为 AKS 群集提供网络连接。Both kubenet and Azure CNI provide network connectivity for your AKS clusters. 不过,这两个模型各有优缺点。However, there are advantages and disadvantages to each. 从较高层面讲,需要考虑以下因素:At a high level, the following considerations apply:

  • kubenetkubenet
    • 节省 IP 地址空间。Conserves IP address space.
    • 使用 Kubernetes 内部或外部负载均衡器可从群集外部访问 Pod。Uses Kubernetes internal or external load balancer to reach pods from outside of the cluster.
    • 必须手动管理和维护用户定义的路由 (UDR)。You must manually manage and maintain user-defined routes (UDRs).
    • 每个群集最多可包含 400 个节点。Maximum of 400 nodes per cluster.
  • Azure CNIAzure CNI
    • Pod 建立全面的虚拟网络连接,可以直接从群集外部进行访问。Pods get full virtual network connectivity and can be directly reached from outside of the cluster.
    • 需要更多的 IP 地址空间。Requires more IP address space.

Kubenet 和 Azure CNI 之间存在以下行为差异:The following behavior differences exist between kubenet and Azure CNI:

功能Capability KubenetKubenet Azure CNIAzure CNI
在现有或新的虚拟网络中部署群集Deploy cluster in existing or new virtual network 支持 - 手动应用 UDRSupported - UDRs manually applied 支持Supported
Pod-Pod 连接Pod-pod connectivity 支持Supported 支持Supported
Pod-VM 连接;VM 位于同一虚拟网络中Pod-VM connectivity; VM in the same virtual network 由 Pod 发起时可正常工作Works when initiated by pod 采用两种工作方式Works both ways
Pod-VM 连接;VM 位于对等互连的虚拟网络中Pod-VM connectivity; VM in peered virtual network 由 Pod 发起时可正常工作Works when initiated by pod 采用两种工作方式Works both ways
使用 VPN 或 Express Route 进行本地访问On-premises access using VPN or Express Route 由 Pod 发起时可正常工作Works when initiated by pod 采用两种工作方式Works both ways
访问服务终结点保护的资源Access to resources secured by service endpoints 支持Supported 支持Supported
使用负载均衡器服务、应用程序网关或入口控制器公开 Kubernetes 服务Expose Kubernetes services using a load balancer service, App Gateway, or ingress controller 支持Supported 支持Supported
默认的 Azure DNS 和专用区域Default Azure DNS and Private Zones 支持Supported 支持Supported

网络模型之间的支持范围Support scope between network models

无论使用何种网络模型,都可通过以下方式之一部署 kubenet 和 Azure CNI:Regardless of the network model you use, both kubenet and Azure CNI can be deployed in one of the following ways:

  • 当你创建 AKS 群集时,Azure 平台可自动创建和配置虚拟网络资源。The Azure platform can automatically create and configure the virtual network resources when you create an AKS cluster.
  • 当你创建 AKS 群集时,可以手动创建和配置虚拟网络资源并附加到这些资源。You can manually create and configure the virtual network resources and attach to those resources when you create your AKS cluster.

尽管 Kubenet 和 Azure CNI 都支持服务终结点或 UDR 之类的功能,但你可以根据 AKS 的支持策略中的说明进行更改。Although capabilities like service endpoints or UDRs are supported with both kubenet and Azure CNI, the support policies for AKS define what changes you can make. 例如:For example:

  • 如果你为 AKS 群集手动创建虚拟网络资源,则在配置自己的 UDR 或服务终结点时将会获得支持。If you manually create the virtual network resources for an AKS cluster, you are supported when configuring your own UDRs or service endpoints.
  • 如果 Azure 平台为 AKS 群集自动创建虚拟网络资源,则不支持手动更改 AKS 管理的这些资源来配置你自己的 UDR 或服务终结点。If the Azure platform automatically creates the virtual network resources for your AKS cluster, it is not supported to manually change those AKS-managed resources to configure your own UDRs or service endpoints.

入口控制器Ingress controllers

创建 LoadBalancer 类型服务时,系统会创建基础 Azure 负载均衡器资源。When you create a LoadBalancer type Service, an underlying Azure load balancer resource is created. 负载均衡器配置为在给定端口上将流量分发到服务中的 Pod。The load balancer is configured to distribute traffic to the pods in your Service on a given port. LoadBalancer 仅在第 4 层工作 - 服务不知道实际的应用程序,不会考虑任何其他路由。The LoadBalancer only works at layer 4 - the Service is unaware of the actual applications, and can't make any additional routing considerations.

入口控制器在第 7 层工作,可使用更智能的规则来分发应用程序流量 。Ingress controllers work at layer 7, and can use more intelligent rules to distribute application traffic. 入口控制器的一个常见用途是基于入站 URL 将 HTTP 流量路由到不同的应用程序。A common use of an Ingress controller is to route HTTP traffic to different applications based on the inbound URL.

显示 AKS 群集中入口流量的示意图

在 AKS 中,可以使用 NGINX 之类的服务器创建入口资源,或使用 AKS HTTP 应用程序路由功能。In AKS, you can create an Ingress resource using something like NGINX, or use the AKS HTTP application routing feature. 为 AKS 群集启用 HTTP 应用程序路由时,Azure 平台会创建入口控制器和 External-DNS 控制器 。When you enable HTTP application routing for an AKS cluster, the Azure platform creates the Ingress controller and an External-DNS controller. 在 Kubernetes 中创建新的入口资源时,系统会在特定于群集的 DNS 区域中创建所需的 DNS A 记录。As new Ingress resources are created in Kubernetes, the required DNS A records are created in a cluster-specific DNS zone. 有关详细信息,请参阅[部署 HTTP 应用程序路由][aks-http-routing]。For more information, see [deploy HTTP application routing][aks-http-routing].

入口的另一个常见功能是 SSL/TLS 终止。Another common feature of Ingress is SSL/TLS termination. 在通过 HTTPS 访问的大型 Web 应用程序上,TLS 终止可以由入口资源处理,而不是在应用程序自身内部处理。On large web applications accessed via HTTPS, the TLS termination can be handled by the Ingress resource rather than within the application itself. 要提供自动 TLS 认证生成和配置,可以将入口资源配置为使用 Let's Encrypt 之类的提供程序。To provide automatic TLS certification generation and configuration, you can configure the Ingress resource to use providers such as Let's Encrypt. 有关使用 Let's Encrypt 配置 NGINX 入口控制器的详细信息,请参阅 Ingress 和 TLSFor more information on configuring an NGINX Ingress controller with Let's Encrypt, see Ingress and TLS.

还可以配置入口控制器,以便在对 AKS 群集中的容器发出请求时保留客户端源 IP。You can also configure your ingress controller to preserve the client source IP on requests to containers in your AKS cluster. 如果客户端的请求通过入口控制器路由到 AKS 群集中的容器,则该请求的原始源 IP 将不可用于目标容器。When a client's request is routed to a container in your AKS cluster via your ingress controller, the original source ip of that request will not be available to the target container. 如果启用客户端源 IP 保留,则可以在请求标头中的 X-Forwarded-For 下使用客户端的源 IP。 When you enable client source IP preservation, the source IP for the client is available in the request header under X-Forwarded-For. 如果在入口控制器上使用客户端源 IP 保留,则无法使用 SSL 直通。If you are using client source IP preservation on your ingress controller, you cannot use SSL pass-through. 可对其他服务(例如 LoadBalancer 类型的服务)使用客户端源 IP 保留和 SSL 直通。Client source IP preservation and SSL pass-through can be used with other services, such as the LoadBalancer type.

网络安全组Network security groups

网络安全组筛选 VM(例如 AKS 节点)的流量。A network security group filters traffic for VMs, such as the AKS nodes. 创建服务(如 LoadBalancer)时,Azure 平台会自动配置所需的任何网络安全组规则。As you create Services, such as a LoadBalancer, the Azure platform automatically configures any network security group rules that are needed. 请勿手动配置网络安全组规则,以筛选 AKS 群集中 Pod 的流量。Don't manually configure network security group rules to filter traffic for pods in an AKS cluster. 定义任何所需端口并作为 Kubernetes 服务清单的一部分转发,让 Azure 平台创建或更新相应的规则。Define any required ports and forwarding as part of your Kubernetes Service manifests, and let the Azure platform create or update the appropriate rules. 还可以使用网络策略(如下一部分中所述)来自动向 Pod 应用流量筛选器规则。You can also use network policies, as discussed in the next section, to automatically apply traffic filter rules to pods.

网络策略Network policies

默认情况下,AKS 群集中的所有 Pod 都可以无限制地发送和接收流量。By default, all pods in an AKS cluster can send and receive traffic without limitations. 为了提高安全性,你可能想要定义用来控制流量流的规则。For improved security, you may want to define rules that control the flow of traffic. 后端应用程序通常只向所需的前端服务公开,或者数据库组件仅可由连接到它们的应用程序层访问。Backend applications are often only exposed to required frontend services, or database components are only accessible to the application tiers that connect to them.

网络策略是 AKS 中提供的一项 Kubernetes 功能,允许你控制 Pod 之间的流量流。Network policy is a Kubernetes feature available in AKS that lets you control the traffic flow between pods. 可选择基于分配的标签、命名空间或流量端口等设置来允许或拒绝流量。You can choose to allow or deny traffic based on settings such as assigned labels, namespace, or traffic port. 网络安全组更多是针对 AKS 节点,而不是针对 Pod。Network security groups are more for the AKS nodes, not pods. 使用网络策略是一种更合适的用来控制流量流的云本机方式。The use of network policies is a more suitable, cloud-native way to control the flow of traffic. 因为 Pod 是在 AKS 群集中动态创建的,则可以动态应用所需的网络策略。As pods are dynamically created in an AKS cluster, the required network policies can be automatically applied.

有关详细信息,请参阅在 Azure Kubernetes 服务 (AKS) 中使用网络策略保护 Pod 之间的流量For more information, see Secure traffic between pods using network policies in Azure Kubernetes Service (AKS).

后续步骤Next steps

若要开始使用 AKS 网络,请通过 kubenetAzure CNI 创建并配置采用你自己的 IP 地址范围的 AKS 群集。To get started with AKS networking, create and configure an AKS cluster with your own IP address ranges using kubenet or Azure CNI.

如需相关的最佳做法,请参阅 AKS 中的网络连接和安全性的最佳做法For associated best practices, see Best practices for network connectivity and security in AKS.

有关核心 Kubernetes 和 AKS 概念的详细信息,请参阅以下文章:For additional information on core Kubernetes and AKS concepts, see the following articles: