tencent cloud

Tencent Kubernetes Engine

Release Notes and Announcements
Release Notes
Announcements
Release Notes
Product Introduction
Overview
Strengths
Architecture
Scenarios
Features
Concepts
Native Kubernetes Terms
Common High-Risk Operations
Regions and Availability Zones
Service Regions and Service Providers
Open Source Components
Purchase Guide
Purchase Instructions
Purchase a TKE General Cluster
Purchasing Native Nodes
Purchasing a Super Node
Getting Started
Beginner’s Guide
Quickly Creating a Standard Cluster
Examples
Container Application Deployment Check List
Cluster Configuration
General Cluster Overview
Cluster Management
Network Management
Storage Management
Node Management
GPU Resource Management
Remote Terminals
Application Configuration
Workload Management
Service and Configuration Management
Component and Application Management
Auto Scaling
Container Login Methods
Observability Configuration
Ops Observability
Cost Insights and Optimization
Scheduler Configuration
Scheduling Component Overview
Resource Utilization Optimization Scheduling
Business Priority Assurance Scheduling
QoS Awareness Scheduling
Security and Stability
TKE Security Group Settings
Identity Authentication and Authorization
Application Security
Multi-cluster Management
Planned Upgrade
Backup Center
Cloud Native Service Guide
Cloud Service for etcd
TMP
TKE Serverless Cluster Guide
TKE Registered Cluster Guide
Use Cases
Cluster
Serverless Cluster
Scheduling
Security
Service Deployment
Network
Release
Logs
Monitoring
OPS
Terraform
DevOps
Auto Scaling
Containerization
Microservice
Cost Management
Hybrid Cloud
AI
Troubleshooting
Disk Full
High Workload
Memory Fragmentation
Cluster DNS Troubleshooting
Cluster kube-proxy Troubleshooting
Cluster API Server Inaccessibility Troubleshooting
Service and Ingress Inaccessibility Troubleshooting
Common Service & Ingress Errors and Solutions
Engel Ingres appears in Connechtin Reverside
CLB Ingress Creation Error
Troubleshooting for Pod Network Inaccessibility
Pod Status Exception and Handling
Authorizing Tencent Cloud OPS Team for Troubleshooting
CLB Loopback
API Documentation
History
Introduction
API Category
Making API Requests
Elastic Cluster APIs
Resource Reserved Coupon APIs
Cluster APIs
Third-party Node APIs
Relevant APIs for Addon
Network APIs
Node APIs
Node Pool APIs
TKE Edge Cluster APIs
Cloud Native Monitoring APIs
Scaling group APIs
Super Node APIs
Other APIs
Data Types
Error Codes
TKE API 2022-05-01
FAQs
TKE General Cluster
TKE Serverless Cluster
About OPS
Hidden Danger Handling
About Services
Image Repositories
About Remote Terminals
Event FAQs
Resource Management
Service Agreement
TKE Service Level Agreement
TKE Serverless Service Level Agreement
Contact Us
Glossary
DokumentasiTencent Kubernetes EngineCluster Configuration Network Management VPC-CNI ModeVPC-CNI Component Description

VPC-CNI Component Description

PDF
Mode fokus
Ukuran font
Terakhir diperbarui: 2024-02-01 10:04:17
VPC-CNI component contains three kubernetes cluster components: tke-eni-agent, tke-eni-ipamd and tke-eni-ip-scheduler.

tke-eni-agent

It is deployed on each node of the cluster in the form of daemonset. The responsibilities are described below.
Copy tke-route-eni, tke-eni-ipamc and other CNI plugins to the directory of CNI executive file of the node (it is set to /opt/cni/bin by default).
Generate CNI configuration file in CNI configuration directory (it is set to /etc/cni/net.d/ by default).
Configure policy-based routing and an ENI for the node.
It acts as the GRPC Server to be responsible for allocating/releasing Pod IPs.
Conduct IP garbage collection periodically, and reclaim IPs for which the Pods does not on the node.
Set expansion resources of ENIs and IPs through [Device Plugins] of kubernetes(https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/device-plugins/).

tke-eni-ipamd

It is deployed on certain nodes or masters of the cluster in the form of deployment. The responsibilities are described below.
Create and manage CRD resources such as nec, vipc, vip and veni.
In non-static IP address mode, create/bind/unbind/delete an ENI and allocate/release an ENI IP based on node requirements and status.
In static IP address mode, create/bind/unbind/delete an ENI and allocate/release an ENI IP based on Pod requirements and status.
Manage the security groups of ENIs of the node.
Create/bind/unbind/delete an EIP based on Pod requirements.

tke-eni-ip-scheduler

It is deployed on certain nodes or masters of the cluster in the form of deployment only in static IP address mode to act as an extension plugin for scheduling. The responsibilities are described below.
If there are multiple subnets, it schedule the Pods with static IP addresses to the nodes of the specified subnet.
In static IP address mode, it judges whether the IPs in the subnets corresponding to the node to which the Pod is scheduled are sufficient.

Component Permission Description

Note:
The Permission Scenarios section only lists the permissions related to the core features of the components, for a complete permission list, please refer to the Permission Definition.

tke-eni-agent Permission

Permission Description

The permission of this component is the minimal dependency required for the current feature to operate.
To modify network-related kernel parameters, such as net.ipv4.ip_forward, net.ipv4.rp_filter, etc., thus the activation of a privileged-level container is required.

Permission Scenarios

Feature
Involved Object
Involved Operation Permission
In the process of IP allocation, obtaining information related to pods and nodes is required.
pods, namespaces, and nodes
get/list/watch
Obtaining the network configuration information
configmaps
get/list/watch
Managing the relevant network extended resources of the nodes, such as tke.cloud.tencent.com/eni-ip, etc.
nodes/status
get/list/watch/patch
Obtaining IP, Network Interface Card, and other network configuration details through a self-defined object, and collaborating with the eni-ipamd component
networking.tke.cloud.tencent.com groups
get/list/watch/delete/update
Exposing the working status of components through events and information related to changes in the node network
events
get/list/watch/create/update/patch

Permission Definition

kind: ClusterRole
metadata:
  name: tke-eni-agent
rules:
- apiGroups: [""]
  resources:
  - pods
  - namespaces
  - nodes
  - configmaps
  verbs: ["list", "watch", "get"]
- apiGroups: [""]
  resources:
  - nodes/status
  verbs: ["list", "watch", "get", "patch"]
- apiGroups: ["networking.tke.cloud.tencent.com"]
  resources:
    - underlayips
    - nodeeniconfigs
    - vpcipclaims
    - vpcips
    - vpcenis
  verbs: ["get", "list", "watch", "delete", "update"]
- apiGroups: [""]
  resources:
    - events
  verbs: ["list", "watch", "get", "update", "patch", "create"]

tke-eni-ipamd Permission

Permission Description

The permission of this component is the minimal dependency required for the current feature to operate.

Permission Scenarios

Feature
Involved Object
Involved Operation Permission
In the process of IP allocation, obtaining information related to pods and nodes is required.
pods, namespaces, nodes, and nodes/status
get/list/watch
In the process of allocating IP to the super node's Pod, it is required to update the allocation information to the Pod's annotation.
pods
update/patch
Under the global routing work pattern, it is required to write the podCIDR assigned to the node on the node's object. Simultaneously, when working in conjunction with the node's auto-scaling, it is required to update the node's conditions and taints.
nodes, and nodes/status
update/patch
The multi-replica operation feature is based on LeaderElection, which requires read and write permissions for associated configmaps or endpoints, with operational information exposed via events.
configmaps, endpoints, and events
get/list/watch/create/update/patch
When a Pod with a fixed IP is terminated, it is required to obtain its associated workload information to determine whether the fixed IP needs to be released.
statefulsets and deployments
get/list/watch
Using custom objects to manage relevant network resources (Elastic Network Interface, IP, Security Group, etc.).
customresourcedefinitions
create/update/get
networking.tke.cloud.tencent.com apiGroups
get/list/watch/create/update/patch/delete
It is required to obtain the native node-related information.
node.tke.cloud.tencent.com apiGroups
get/list/watch
Registration of node-related capabilities requires collaboration with the Cilium component.
cilium.io apiGroups
get/list/watch/create/update/patch/delete

Permission Definition

apiVersion: rbac.authorization.k8s.io/v1
# kubernetes versions before 1.8.0 should use rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: tke-eni-ipamd
rules:
- apiGroups: [""]
  resources:
  - pods
  - namespaces
  - nodes
  - nodes/status
  verbs: ["list", "watch", "get", "patch", "update"]
- apiGroups: [""]
  resources:
  - configmaps
  - endpoints
  - events
  verbs: ["get", "list", "watch", "update", "create", "patch"]
- apiGroups: ["apps", "extensions"]
  resources:
  - statefulsets
  - deployments
  verbs: ["list", "watch", "get"]
- apiGroups: ["apiextensions.k8s.io"]
  resources:
  - customresourcedefinitions
  verbs: ["create", "update", "get"]
- apiGroups: ["networking.tke.cloud.tencent.com"]
  resources:
  - staticipconfigs
  - underlayips
  - nodeeniconfigs
  - vpcipclaims
  - vpcips
  - eipclaims
  - vpcenis
  verbs: ["create", "update", "delete", "get", "list", "watch", "patch"]
- apiGroups: ["node.tke.cloud.tencent.com"]
  resources:
  - machines
  verbs: ["get", "list", "watch"]
- apiGroups: [ "cilium.io" ]
  resources:
  - ciliumnodes
  - ciliumnodes/status
  - ciliumnodes/finalizers
  verbs: [ "create", "update", "delete", "get", "list", "watch", "patch" ]


tke-eni-ip-scheduler Permission

Permission Description

The permission of this component is the minimal dependency required for the current feature to operate.
The related directory /var/lib/kubelet on the host machine needs to be mounted to the container to accomplish volume mount/unmount, hence the activation of the privileged-level container is required.

Permission Scenarios

Feature
Involved Object
Involved Operation Permission
An expansion of bindVerb is required, to address the issue of IP allocation conflicts when binding the Pod concurrency.
pods/binding
get/list/watch/create/update/patch
The multi-replica operation feature is based on LeaderElection, which requires read and write permissions for associated configmaps or endpoints, with operational information exposed via events.
configmaps,endpoints,events
get/list/watch/create/update/patch
During scheduling expansion, it is required to obtain relevant information about pods and nodes.
pods,namespaces,nodes,nodes/status
get/list/watch
During scheduling expansion, it is required to interact with the custom object of the component, thus ensuring the complete allocation of IPs and resolving the conflicts of IP allocation.
networking.tke.cloud.tencent.com groups
get/list/watch/update

Permission Definition

apiVersion: rbac.authorization.k8s.io/v1
# kubernetes versions before 1.8.0 should use rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: tke-eni-ip-scheduler
rules:
  - apiGroups: [""]
    resources:
      - pods/binding
    verbs: ["get", "list", "watch", "update", "create", "patch"]
  - apiGroups: [""]
    resources:
      - ["configmaps", "endpoints", "events"]
    verbs: ["get", "list", "watch", "update", "create", "patch"]
  - apiGroups: [""]
    resources:
      - ["pods", "namespaces", "nodes", "nodes/status"]
    verbs: ["list", "watch", "get"]
  - apiGroups: ["networking.tke.cloud.tencent.com"]
    resources:
      - ["nodeeniconfigs", "vpcipclaims", "vpcips"]
    verbs: ["get", "list", "watch", "update"]



Topik sebelumnya: Instructions on Binding an EIP to a PodTopik selanjutnya: Limits on the Number of Pods in VPC-CNI Mode

Bantuan dan Dukungan

Apakah halaman ini membantu?

masukan