https://edgemesh.netlify.app/assets/js/v-73e43e09.c9d476a1.js

1"use strict";(self.webpackChunkedgemesh=self.webpackChunkedgemesh||[]).push([[571],{7162:(n,s,a)=>{a.r(s),a.d(s,{data:()=>e});const e={key:"v-73e43e09",path:"/zh/advanced/hybird-proxy.html",title:"混合代理",lang:"zh-CN",frontmatter:{},excerpt:"",headers:[{level:2,title:"原理",slug:"原理",children:[]},{level:2,title:"服务过滤",slug:"服务过滤",children:[]}],filePathRelative:"zh/advanced/hybird-proxy.md",git:{updatedTime:1663549505e3,contributors:[]}}},7687:(n,s,a)=>{a.r(s),a.d(s,{default:()=>p});const e=(0,a(6252).uE)('<h1 id="混合代理" tabindex="-1"><a class="header-anchor" href="#混合代理" aria-hidden="true">#</a> 混合代理</h1><p>K8s 集群同时部署了 kube-proxy 和 edgemesh 时，通过混合代理的方式保证了两者的兼容。</p><h2 id="原理" tabindex="-1"><a class="header-anchor" href="#原理" aria-hidden="true">#</a> 原理</h2><p>当 edgemesh-agent 后于 kube-proxy 启动的时候，会将 <code>KUBE-PORTALS-CONTAINER</code> 链插入到主机 iptables 的 nat 表中的 PREROUTING 和 OUTPUT 链上，并处于 <code>KUBE-SERVICES</code> 链的前面，因此可以优先于 kube-proxy 劫持服务的流量，实现云边通信的流量转发。</p><div class="language-bash ext-sh line-numbers-mode"><pre class="language-bash"><code>$ iptables -t nat -nvL\nChain PREROUTING <span class="token punctuation">(</span>policy ACCEPT 1379K packets, 395M bytes<span class="token punctuation">)</span>\n pkts bytes target     prot opt <span class="token keyword">in</span>  out     <span class="token builtin class-name">source</span>               destination\n   <span class="token number">52</span> <span class="token number">13980</span> KUBE-PORTALS-CONTAINER  all  --  *      *       <span class="token number">0.0</span>.0.0/0            <span class="token number">0.0</span>.0.0/0            /* handle ClusterIPs<span class="token punctuation">;</span> NOTE: this must be before the NodePort rules */\n1375K  394M KUBE-SERVICES  all  --  *      *       <span class="token number">0.0</span>.0.0/0            <span class="token number">0.0</span>.0.0/0            /* kubernetes <span class="token function">service</span> portals */\n<span class="token punctuation">..</span>.\n\nChain OUTPUT <span class="token punctuation">(</span>policy ACCEPT 1317K packets, 79M bytes<span class="token punctuation">)</span>\n pkts bytes target     prot opt <span class="token keyword">in</span>     out     <span class="token builtin class-name">source</span>               destination\n   <span class="token number">51</span>  <span class="token number">3086</span> KUBE-PORTALS-HOST  all  --  *      *       <span class="token number">0.0</span>.0.0/0            <span class="token number">0.0</span>.0.0/0            /* handle ClusterIPs<span class="token punctuation">;</span> NOTE: this must be before the NodePort rules */\n1314K   79M KUBE-SERVICES  all  --  *      *       <span class="token number">0.0</span>.0.0/0            <span class="token number">0.0</span>.0.0/0            /* kubernetes <span class="token function">service</span> portals */\n<span class="token punctuation">..</span>.\n</code></pre><div class="line-numbers"><span class="line-number">1</span><br><span class="line-number">2</span><br><span class="line-number">3</span><br><span class="line-number">4</span><br><span class="line-number">5</span><br><span class="line-number">6</span><br><span class="line-number">7</span><br><span class="line-number">8</span><br><span class="line-number">9</span><br><span class="line-number">10</span><br><span class="line-number">11</span><br><span class="line-number">12</span><br></div></div><div class="custom-container tip"><p class="custom-container-title">提示</p><p>如果访问服务出现如 <code>No route to host</code> 的错误，可能是因为 edgemesh-agent 的启动先于 kube-proxy 的启动，导致 <code>KUBE-PORTALS-CONTAINER</code> 链位于 <code>KUBE-SERVICES</code> 后面，进而无法优先于 kube-proxy 劫持服务的流量。可以通过重新部署 edgemesh 来重建链的顺序，以规避这个问题。</p></div><h2 id="服务过滤" tabindex="-1"><a class="header-anchor" href="#服务过滤" aria-hidden="true">

1#</a> 服务过滤</h2><p>edgemesh-agent 默认拦截并转发所有通过 Cluster IP 访问的服务，不过 edgemesh-agent 的流量转发过程在用户态中，会带来些许的性能损耗。因此，你可能会有一些服务不想被 edgemesh-agent 代理，我们为服务过滤提供了一个标签: <code>service.edgemesh.kubeedge.io/service-proxy-name</code>。</p><p>举个例子：比如你想在云端部署 prometheus + grafana 监控服务，这些服务不需要边缘端的访问，所以你并不希望它们被 edgemesh-agent 代理，那么你可以这么做：</p><div class="language-yaml ext-yml line-numbers-mode"><pre class="language-yaml"><code><span class="token key atrule">apiVersion</span><span class="token punctuation">:</span> v1\n<span class="token key atrule">kind</span><span class="token punctuation">:</span> Service\n<span class="token key atrule">metadata</span><span class="token punctuation">:</span>\n  <span class="token key atrule">labels</span><span class="token punctuation">:</span>\n    <span class="token key atrule">service.edgemesh.kubeedge.io/service-proxy-name</span><span class="token punctuation">:</span> <span class="token string">&quot;&quot;</span>  <span class="token comment">#&lt;---- 添加此 label 以让 edgemesh-agent 忽略代理</span>\n    <span class="token key atrule">app.kubernetes.io/name</span><span class="token punctuation">:</span> node<span class="token punctuation">-</span>exporter\n    <span class="token key atrule">app.kubernetes.io/version</span><span class="token punctuation">:</span> v1.0.1\n  <span class="token key atrule">name</span><span class="token punctuation">:</span> node<span class="token punctuation">-</span>exporter\n  <span class="token key atrule">namespace</span><span class="token punctuation">:</span> monitoring\n<span class="token key atrule">spec</span><span class="token punctuation">:</span>\n  <span class="token key atrule">clusterIP</span><span class="token punctuation">:</span> None\n  <span class="token key atrule">ports</span><span class="token punctuation">:</span>\n  <span class="token punctuation">-</span> <span class="token key atrule">name</span><span class="token punctuation">:</span> https\n    <span class="token key atrule">port</span><span class="token punctuation">:</span> <span class="token number">9100</span>\n    <span class="token key atrule">targetPort</span><span class="token punctuation">:</span> https\n  <span class="token key atrule">selector</span><span class="token punctuation">:</span>\n    <span class="token key atrule">app.kubernetes.io/name</span><span class="token punctuation">:</span> node<span class="token punctuation">-</span>exporter\n</code></pre><div class="line-numbers"><span class="line-number">1</span><br><span class="line-number">2</span><br><span class="line-number">3</span><br><span class="line-number">4</span><br><span class="line-number">5</span><br><span class="line-number">6</span><br><span class="line-number">7</span><br><span class="line-number">8</span><br><span class="line-number">9</span><br><span class="line-number">10</span><br><span class="line-number">11</span><br><span class="line-number">12</span><br><span class="line-number">13</span><br><span class="line-number">14</span><br><span class="line-number">15</span><br><span class="line-number">16</span><br><span class="line-number">17</span><br></div></div><p>保存配置后，你将不会在 <code>KUBE-PORTALS-CONTAINER</code> 链里看到这个服务的 iptables 规则，意味着 edgemesh 不会对此服务进行处理。</p>',11),p={render:function(n,s){return e}}}}]);