启用容器以使用 Azure 虚拟网络功能Enable containers to use Azure Virtual Network capabilities

利用增强虚拟机的同一软件定义网络堆栈,将一组丰富的 Azure 网络功能引入容器。Bring the rich set of Azure network capabilities to containers, by utilizing the same software defined networking stack that powers virtual machines. Azure 虚拟网络容器网络接口 (CNI) 插件安装在 Azure 虚拟机中。The Azure Virtual Network container network interface (CNI) plug-in installs in an Azure Virtual Machine. 该插件用于将虚拟网络中的 IP 地址分配到虚拟机中显示的容器,并将其附加到虚拟网络,使其直接连接到其他容器和虚拟网络资源。The plug-in assigns IP addresses from a virtual network to containers brought up in the virtual machine, attaching them to the virtual network, and connecting them directly to other containers and virtual network resources. 该插件不依赖于覆盖网络或多个路由即可实现连接,并提供与虚拟机相同的性能。The plug-in doesn't rely on overlay networks, or routes, for connectivity, and provides the same performance as virtual machines. 在高级别,该插件提供以下功能:At a high level, the plug-in provides the following capabilities:

  • 虚拟网络 IP 地址分配给每个可以包含一个或多个容器的 Pod。A virtual network IP address is assigned to every Pod, which could consist of one or more containers.
  • 这些 Pod 可以通过 ExpressRoute 或站点到站点 VPN 连接到对等虚拟网络和本地网络。Pods can connect to peered virtual networks and to on-premises over ExpressRoute or a site-to-site VPN. 也可从对等网络和本地网络访问这些 Pod。Pods are also reachable from peered and on-premises networks.
  • Pod 可以访问 Azure 存储和 Azure SQL 数据库等受到虚拟网络服务终结点保护的服务。Pods can access services such as Azure Storage and Azure SQL Database, that are protected by virtual network service endpoints.
  • 可以将网络安全组和路由直接应用到 Pod。Network security groups and routes can be applied directly to Pods.
  • 正如虚拟机一样,可直接将 Pod 放置在 Azure 内部或公共负载均衡器后面Pods can be placed directly behind an Azure internal or public Load Balancer, just like virtual machines
  • 可为 Pod 分配一个公共 IP 地址,以便通过 Internet 直接访问。Pods can be assigned a public IP address, which makes them directly accessible from the internet. Pod 还可访问 Internet 本身。Pods can also access the internet themselves.
  • 可与 Kubernetes 资源(如服务、入口控制器和 Kube DNS)无缝结合使用。Works seamlessly with Kubernetes resources such as Services, Ingress controllers, and Kube DNS. 通过 Azure 负载均衡器还可在外部或内部公开 Kubernetes 服务。A Kubernetes Service can also be exposed internally or externally through the Azure Load Balancer.

下图显示了该插件向 Pod 提供 Azure 虚拟网络功能的工作原理:The following picture shows how the plug-in provides Azure Virtual Network capabilities to Pods:

容器网络概述

该插件同时支持 Linux 和 Windows 平台。The plug-in supports both Linux and Windows platforms.

将 Pod 连接到虚拟网络Connecting Pods to a virtual network

Pod 将显示在属于虚拟网络一部分的虚拟机中。Pods are brought up in a virtual machine that is part of a virtual network. Pod 的 IP 地址池配置为虚拟机网络接口上的辅助地址。A pool of IP addresses for the Pods is configured as secondary addresses on a virtual machine's network interface. Azure CNI 为 Pod 设置基本的网络连接并管理池中 IP 地址的使用率。Azure CNI sets up the basic Network connectivity for Pods and manages the utilization of the IP addresses in the pool. 当 Pod 显示在虚拟机中后,Azure CNI 从池中分配可用的 IP 地址,并将 Pod 连接到虚拟机中的软件桥。When a Pod comes up in the virtual machine, Azure CNI assigns an available IP address from the pool and connects the Pod to a software bridge in the virtual machine. Pod 终止时,IP 地址会被添加回池。When the Pod terminates, the IP address is added back to the pool. 下图显示了 Pod 连接到虚拟网络的工作原理:The following picture shows how Pods connect to a virtual network:

容器网络概述

Internet 访问权限Internet access

为了使 Pod 能够访问 Internet,该插件将 iptables 规则配置为网络地址转换 (NAT),通过 Internet 绑定 Pod 流量。To enable Pods to access the internet, the plug-in configures iptables rules to network address translate (NAT) the internet bound traffic from Pods. 包的源 IP 地址被转换为虚拟机的网络接口上的主 IP 地址。The source IP address of the packet is translated to the primary IP address on the virtual machine's network interface. Windows 虚拟机自动为流往虚拟机所属子网范围之外的 IP 地址的流量进行源 NAT (SNAT)。Windows virtual machines automatically source NAT (SNAT) traffic destined to IP addresses outside the subnet the virtual machine is in. 通常会转换流往虚拟机 IP 范围之外的 IP 地址的所有流量。Typically, all traffic destined to an IP address outside of the IP range of the virtual network is translated.

限制Limits

该插件支持每台虚拟机最多 250 个 Pod,虚拟网络中最多 16,000 个 Pod。The plug-in supports up to 250 Pods per virtual machine and up to 16,000 Pods in a virtual network. 这些限制因 Azure Kubernetes 服务会有所不同。These limits are different for the Azure Kubernetes Service.

使用该插件Using the plug-in

可采用以下方式来使用该插件,以提供 Pod 或 Docker 容器的基本虚拟网络连接:The plug-in can be used in the following ways, to provide basic virtual network attach for Pods or Docker containers:

  • Azure Kubernetes 服务:该插件已集成到 Azure Kubernetes 服务 (AKS) 中,选择“高级网络” 选项即可使用该插件。Azure Kubernetes Service: The plug-in is integrated into the Azure Kubernetes Service (AKS), and can be used by choosing the Advanced Networking option. 使用高级网络,可在现有或新的虚拟网络中部署 Kubernetes 群集。Advanced Networking lets you deploy a Kubernetes cluster in an existing, or a new, virtual network. 如需深入了解高级网络及其设置步骤,请参阅 AKS 中的网络配置To learn more about Advanced Networking and the steps to set it up, see Network configuration in AKS.

  • AKS-Engine:AKS-Engine 是一项工具,用于生成 Azure 资源管理器模板,以便在 Azure 中部署 Kubernetes 群集。AKS-Engine: AKS-Engine is a tool that generates an Azure Resource Manager template for the deployment of a Kubernetes cluster in Azure. 如需详细说明,请参阅为 AKS-Engine Kubernetes 群集部署插件For detailed instructions, see Deploy the plug-in for AKS-Engine Kubernetes clusters.

  • 在 Azure 中创建自己的 Kubernetes 群集:该插件可用于为自行部署的 Kubernetes 群集中的 Pod 提供基本网络,无需依赖于 AKS 或 AKS-Engine 之类的工具。Creating your own Kubernetes cluster in Azure: The plug-in can be used to provide basic networking for Pods in Kubernetes clusters that you deploy yourself, without relying on AKS, or tools like the AKS-Engine. 在这种情况下,群集中的每个虚拟机上都已安装并启用该插件。In this case, the plug-in is installed and enabled on every virtual machine in a cluster. 如需详细说明,请参阅为自行部署的 Kubernetes 群集部署插件For detailed instructions, see Deploy the plug-in for a Kubernetes cluster that you deploy yourself.

  • Azure 中 Docker 容器的虚拟网络附加:不希望创建 Kubernetes 群集,而希望创建在虚拟机中附加虚拟网络的 Docker 容器时,可使用该插件。Virtual network attach for Docker containers in Azure: The plug-in can be used in cases where you don't want to create a Kubernetes cluster, and would like to create Docker containers with virtual network attach, in virtual machines. 如需详细说明,请参阅为容器部署插件For detailed instructions, see Deploy the plug-in for Docker.

后续步骤Next steps

为 Kubernetes 群集或 Docker 容器部署插件Deploy the plug-in for Kubernetes clusters or Docker containers