WIP: K8s network model diagrams #39069

chrismetz09 · 2023-01-23T18:14:58Z

Initial incomplete diagrams addressing #32243.

This is incomplete but begins to follow an outline. Can be a broad topic so included comments inline.

netlify · 2023-01-23T18:31:18Z

✅ Pull request preview available for checking

Built without sensitive environment variables

Name	Link
🔨 Latest commit	`5d78673`
🔍 Latest deploy log	https://app.netlify.com/sites/kubernetes-io-main-staging/deploys/640642effb8eee00085888cc
😎 Deploy Preview	https://deploy-preview-39069--kubernetes-io-main-staging.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site settings.

sftim · 2023-01-23T20:50:35Z

content/en/docs/concepts/services-networking/_index.md

+without network address translation (NAT)
+* pods can communicate with other pods on same or separate nodes using L2 bridging, native L3 (IPv4, IPv6) networking, or a CNI-specific form of tunnel encapsulation. 
+
+[//]: # (Not sure the agent communications is part of the K8s network model)


We should show that a Pod running in host network mode can communicate with another Pod in normal cluster network mode, provided that they are both on the same Pod.

That might be something we save for a followup, but it's good to show it one day.

Also that some network architectures allow for this to happen even when the 2 Pods are on different modes, but that Kubernetes doesn't require or guarantee this.

sftim · 2023-01-23T20:52:16Z

content/en/docs/concepts/services-networking/_index.md

+Containers within a `Pod` can all reach each other's ports on
+`localhost`. 
+
+{{< figure src="/docs/images/k8net-localhost-PodSameHost.drawio.svg" alt="k8s net arch2" class="diagram-large" caption="Figure 2. Container localhost and L2 bridging" >}}


Watch out for assuming that the network plugin uses layer 2 techniques. A network plugin that works at the IP layer only (eg a Linux tun interface plus userland packet encapsulation and decapsulation) is a viable design.

https://www.researchgate.net/figure/Kubernetes-Network-routing-to-export-the-services_fig1_337362475 includes an example of a diagram that doesn't rely on OSI layer 2 (although, given it shows Flannel, this is partly down to eliding some detail)

Another option is with text, to highlight that this is one of several viable designs.

Understand re: L2-based and other network paradigms. Referenced paper is "researchy" but your point is valid.

Might call for Advanced Topics section later on that covers other paradigms like User-space networking (kernel bypass), Network Service Mesh, maybe eBPF, CNFs, ...

tengqm · 2023-01-26T09:39:44Z

Preview: https://deploy-preview-39069--kubernetes-io-main-staging.netlify.app/docs/concepts/services-networking/

chrismetz09 · 2023-01-26T19:38:44Z

https://deploy-preview-39069--kubernetes-io-main-staging.netlify.app/

sftim

Some more feedback. I hope this helps frame the explanation @chrismetz09

sftim · 2023-02-10T10:01:21Z

content/en/docs/concepts/services-networking/_index.md

+
+The Kubernetes network model introduces an architecture that allows you to support your cluster networking requirements.
+
+Figure 1 illustrates the general Kubernetes network architecture.


Suggested change

Figure 1 illustrates the general Kubernetes network architecture.

Figure 1 shows one example implementation of networking for Kubernetes.

layer 2 bridges aren't required

there doesn't need to be an overlay network

pod-to-pod traffic doesn't even need to go over the interface used for host networking

Perhaps it'll help to show more than one image with detailed examples. Once we have those, maybe it'll be more obvious which elements are common.

content/en/docs/concepts/services-networking/_index.md

sftim · 2023-02-10T10:02:29Z

content/en/docs/concepts/services-networking/_index.md

+
+The components of the architecture consist of the following:
+
+* Nodes that can be virtual (VM) or physical.


Suggested change

* Nodes that can be virtual (VM) or physical.

* Multiple servers (nodes); these can be physical hosts or virtual machines

sftim · 2023-02-10T10:03:02Z

content/en/docs/concepts/services-networking/_index.md

+
+* Nodes that can be virtual (VM) or physical.
+
+* Pods configured on each node with one or more containers.


Suggested change

* Pods configured on each node with one or more containers.

* Pods running on each node. Each Pod has one or more containers.

consider showing a node that doesn't have any workload Pods running?

content/en/docs/concepts/services-networking/_index.md

sftim · 2023-02-10T10:27:17Z

content/en/docs/concepts/services-networking/_index.md

+
+Some platforms, such as Linux, support pods running in the host network. Pods attached to the host network of a node can still communicate with all pods on all nodes without NAT.
+
+## Terminology


We could add these to the glossary and then use shortcodes to repeat (include) the definitions here.

sftim · 2023-02-10T10:27:56Z

content/en/docs/concepts/services-networking/_index.md

+* containers in same pod can communicate with each other.
+* pods can communicate with all other pods on the same or separate [nodes](/docs/concepts/architecture/nodes/)
+without network address translation (NAT).
+* pods can communicate with other pods on the same or separate nodes using L2 bridging, native L3 (IPv4, IPv6) networking, tunneling, or other techniques for conveying packets from one pod to another.  


Suggested change

* pods can communicate with other pods on the same or separate nodes using L2 bridging, native L3 (IPv4, IPv6) networking, tunneling, or other techniques for conveying packets from one pod to another.

* pods can communicate with other pods on the same or separate nodes using layer 2 bridging, native layer 3 (IPv4, IPv6) networking, tunneling, or other techniques for conveying packets from one pod to another.

content/en/docs/concepts/services-networking/_index.md

sftim · 2023-02-10T10:29:12Z

content/en/docs/concepts/services-networking/_index.md

+
+Figure 1 illustrates the general Kubernetes network architecture.
+
+{{< figure src="/docs/images/k8net-Pod-arch-template.drawio.svg" alt="k8s net arch" class="diagram-large" caption="Figure 1. K8s Network Architecture" >}}


Suggested change

{{< figure src="/docs/images/k8net-Pod-arch-template.drawio.svg" alt="k8s net arch" class="diagram-large" caption="Figure 1. K8s Network Architecture" >}}

{{< figure src="/docs/images/k8net-Pod-arch-template.drawio.svg" alt="k8s net arch" class="diagram-large" caption="Figure 1. Example network architecture for a cluster" >}}

Will add a two examples to this section so figure captions will change.

tengqm · 2023-02-16T00:46:10Z

content/en/docs/concepts/services-networking/_index.md

-* L2bridge is a virtual L2 bridge that allows attachment, configuration and communications between pods on the same node. Depending on your deployment of container runtimes and CNI, you might know this entity as a `linux bridge`, `docker0`, `cbr0` or `cni0`. 
-
-* CNI plugins supporting different techniques for pod networking that include virtual overlay networks and physical underlay networks. You can choose from any number of different CNI plugins to best meet your cluster networking requirements.
+* L2bridge is a virtual L2 bridge that allows attachment, configuration and communications between pods on the same node. Depending on your deployment of container runtimes and CNI, you might know this entity as a `linux bridge`, `docker0`, `cbr0` or `cni0`.


Wrap this long line as we do for line 89-95?

tengqm · 2023-02-16T00:47:16Z

content/en/docs/concepts/services-networking/_index.md

@@ -30,7 +30,7 @@ implementation (barring any intentional network segmentation policies):
 * Containers in same pod can communicate with each other.
 * Pods can communicate with all other pods on the same or separate [nodes](/docs/concepts/architecture/nodes/)
 without network address translation (NAT).
-* Pods can communicate with other pods on the same or separate nodes using L2 bridging, native L3 (IPv4, IPv6) networking, tunneling, or other techniques for conveying packets from one pod to another.  
+* Pods can communicate with other pods on the same or separate nodes using layer 2 bridging, native layer 3 (IPv4, IPv6) networking, tunneling, or other techniques for conveying packets from one pod to another.


Wrap this long line?

sftim · 2023-02-16T09:44:47Z

Thanks again @chrismetz09

Overall, if you frame this as “here are some examples of valid cluster networking” (and not accidentally imply “this shows how it always is done”), I think we're actually close to being able to merge something. And then, we can iterate.

Add code blocks in page run-single-instance-stateful-application

[zh] sync blog: 2023-01-02-cross-namespace-data-sources-alpha.md

…it-phase [zh-cn] Resync kubeadm_init_phase_control-plane_scheduler.md

[zh] sync /storage/persistent-volumes.md

…iction.

…ects Tidy concepts pages within Label and Annotation

Co-authored-by: Shannon Kularathna <[email protected]>

Co-authored-by: divya-mohan0209 <[email protected]>

sftim · 2023-03-07T10:17:53Z

Hi @chrismetz09 - would you like help rebasing this PR to touch fewer files?

chrismetz09 · 2023-03-07T16:19:32Z

@sftim, is this the standard rebase to squash my multiple commits into one? Looks like this is something different? If so, yes guidance please.

sftim · 2023-03-07T17:12:04Z

This PR stands to change 697 files. Doesn't look right. Let's fix that.

chrismetz09 · 2023-03-07T17:20:00Z

It is not right for sure.

chrismetz09 · 2023-03-07T18:52:30Z

Probing for a solution. Would this work?

1. Sync fork repo with main
2. Get the new changes on main: git fetch && git checkout main && git pull origin main
3. Rebase your branch on main git checkout <name of your branch> && git rebase -i main
4. squash my commits into one.
5. git push the single squashed commit to my remote devBranch

chrismetz09 · 2023-03-10T18:52:13Z

Working new branch called net-model-diagrams in PR #39890

chrismetz09 · 2023-03-16T14:18:44Z

/close

k8s-ci-robot · 2023-03-16T14:18:54Z

@chrismetz09: Closed this PR.

In response to this:

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

jihoon-seo · 2023-12-04T07:39:17Z

/remove-area blog release-eng
/remove-language de es fr hi id it ja ko pl pt ru uk zh
/remove-sig release

k8s-ci-robot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. language/en Issues or PRs related to English language labels Jan 23, 2023

k8s-ci-robot requested review from kbhawkey and reylejano January 23, 2023 18:15

k8s-ci-robot added sig/docs Categorizes an issue or PR as relevant to SIG Docs. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Jan 23, 2023

sftim reviewed Jan 23, 2023

View reviewed changes

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Jan 24, 2023

sftim reviewed Feb 10, 2023

View reviewed changes

tengqm reviewed Feb 16, 2023

View reviewed changes

Mengjiao Liu and others added 13 commits February 20, 2023 15:26

[zh-cn] Resync kubeadm_init_phase_control-plane_scheduler.md

7aae1ad

Merge pull request kubernetes#39541 from Zhuzhenghao/scale-stateful-set

2483764

Add code blocks in page run-single-instance-stateful-application

Merge pull request kubernetes#38942 from windsonsea/0102cnd

f04dd84

[zh] sync blog: 2023-01-02-cross-namespace-data-sources-alpha.md

[zh] sync self-subject-review-v1alpha1.md

f416212

Merge pull request kubernetes#39560 from mengjiao-liu/sync-kubeadm-in…

b842660

…it-phase [zh-cn] Resync kubeadm_init_phase_control-plane_scheduler.md

Merge branch 'kubernetes:main' into patch-1

1bee739

Merge pull request kubernetes#38983 from windsonsea/labtai

516a23a

[zh] sync /storage/persistent-volumes.md

[ja] Update page weights under content/ja/docs/concepts/scheduling-ev…

9ae9f74

…iction.

Merge pull request kubernetes#39535 from Zhuzhenghao/working-with-obj…

4bb80ef

…ects Tidy concepts pages within Label and Annotation

Reword further reading

5c775fc

Co-authored-by: Shannon Kularathna <[email protected]>

Wrap long lines in ConfigMap task

070831e

Revise Pod / ConfigMap task

67aa567

Co-authored-by: divya-mohan0209 <[email protected]>

Add cleanup steps

743df5f

k8s-ci-robot added language/uk Issues or PRs related to Ukrainian language language/zh Issues or PRs related to Chinese language sig/release Categorizes an issue or PR as relevant to SIG Release. labels Mar 3, 2023

update underlay figure, added overlay and underlay text

5d78673

k8s-ci-robot closed this Mar 16, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

WIP: K8s network model diagrams #39069

WIP: K8s network model diagrams #39069

chrismetz09 commented Jan 23, 2023

netlify bot commented Jan 23, 2023 •

edited

Loading

sftim Jan 23, 2023

sftim Jan 23, 2023

sftim Jan 23, 2023

chrismetz09 Jan 24, 2023

tengqm commented Jan 26, 2023

chrismetz09 commented Jan 26, 2023

sftim left a comment

sftim Feb 10, 2023

sftim Feb 10, 2023

sftim Feb 10, 2023

sftim Feb 10, 2023

chrismetz09 Feb 15, 2023

sftim Feb 10, 2023

sftim Feb 10, 2023

chrismetz09 Feb 15, 2023

tengqm Feb 16, 2023

tengqm Feb 16, 2023

sftim commented Feb 16, 2023

sftim commented Mar 7, 2023

chrismetz09 commented Mar 7, 2023

sftim commented Mar 7, 2023

chrismetz09 commented Mar 7, 2023

chrismetz09 commented Mar 7, 2023

chrismetz09 commented Mar 10, 2023

chrismetz09 commented Mar 16, 2023

k8s-ci-robot commented Mar 16, 2023

jihoon-seo commented Dec 4, 2023


		The Kubernetes network model introduces an architecture that allows you to support your cluster networking requirements.

		Figure 1 illustrates the general Kubernetes network architecture.

	Figure 1 illustrates the general Kubernetes network architecture.
	Figure 1 shows one example implementation of networking for Kubernetes.


		The components of the architecture consist of the following:

		* Nodes that can be virtual (VM) or physical.

	* Nodes that can be virtual (VM) or physical.
	* Multiple servers (nodes); these can be physical hosts or virtual machines


		* Nodes that can be virtual (VM) or physical.

		* Pods configured on each node with one or more containers.

	* Pods configured on each node with one or more containers.
	* Pods running on each node. Each Pod has one or more containers.


		Some platforms, such as Linux, support pods running in the host network. Pods attached to the host network of a node can still communicate with all pods on all nodes without NAT.

		## Terminology

	* pods can communicate with other pods on the same or separate nodes using L2 bridging, native L3 (IPv4, IPv6) networking, tunneling, or other techniques for conveying packets from one pod to another.
	* pods can communicate with other pods on the same or separate nodes using layer 2 bridging, native layer 3 (IPv4, IPv6) networking, tunneling, or other techniques for conveying packets from one pod to another.


		Figure 1 illustrates the general Kubernetes network architecture.

		{{< figure src="/docs/images/k8net-Pod-arch-template.drawio.svg" alt="k8s net arch" class="diagram-large" caption="Figure 1. K8s Network Architecture" >}}

WIP: K8s network model diagrams #39069

WIP: K8s network model diagrams #39069

Conversation

chrismetz09 commented Jan 23, 2023

netlify bot commented Jan 23, 2023 • edited Loading

✅ Pull request preview available for checking

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tengqm commented Jan 26, 2023

chrismetz09 commented Jan 26, 2023

sftim left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sftim commented Feb 16, 2023

sftim commented Mar 7, 2023

chrismetz09 commented Mar 7, 2023

sftim commented Mar 7, 2023

chrismetz09 commented Mar 7, 2023

chrismetz09 commented Mar 7, 2023

chrismetz09 commented Mar 10, 2023

chrismetz09 commented Mar 16, 2023

k8s-ci-robot commented Mar 16, 2023

jihoon-seo commented Dec 4, 2023

netlify bot commented Jan 23, 2023 •

edited

Loading