calico文档学习
1、calico概念
Every pod get its own IP address.每个POD都有自己的IP Pods on any node can communicate with all pods on all other nodes without NAT.任意节点上的POD互相通信不用NAT
查看calico版本
root@clusterb-master1:/# kubectl exec -it -n tigera-operator deployment/tigera-operator -- operator --version
Operator: v1.25.3
Calico: v3.22.1
Enterprise: v3.12.0
列出可用资源
root@master:/# kubectl get crd | grep projectcalico.org bgpconfigurations.crd.projectcalico.org 2026-04-30T08:37:43Z bgppeers.crd.projectcalico.org 2026-04-30T08:37:43Z blockaffinities.crd.projectcalico.org 2026-04-30T08:37:43Z caliconodestatuses.crd.projectcalico.org 2026-04-30T08:37:43Z clusterinformations.crd.projectcalico.org 2026-04-30T08:37:43Z felixconfigurations.crd.projectcalico.org 2026-04-30T08:37:43Z globalnetworkpolicies.crd.projectcalico.org 2026-04-30T08:37:43Z globalnetworksets.crd.projectcalico.org 2026-04-30T08:37:43Z hostendpoints.crd.projectcalico.org 2026-04-30T08:37:43Z ipamblocks.crd.projectcalico.org 2026-04-30T08:37:43Z ipamconfigs.crd.projectcalico.org 2026-04-30T08:37:43Z ipamhandles.crd.projectcalico.org 2026-04-30T08:37:43Z ippools.crd.projectcalico.org 2026-04-30T08:37:43Z ipreservations.crd.projectcalico.org 2026-04-30T08:37:43Z kubecontrollersconfigurations.crd.projectcalico.org 2026-04-30T08:37:44Z networkpolicies.crd.projectcalico.org 2026-04-30T08:37:44Z networksets.crd.projectcalico.org 2026-04-30T08:37:44Z
2、Configure a global BGP peer
配置所有NODE BGP PEER 192.20.30.40 AS 64567
方法一：全局配置（所有节点） apiVersion: projectcalico.org/v3 kind: BGPPeer metadata: name: my-global-peer spec: peerIP: 192.20.30.40 asNumber: 64567 方法二：特定节点（根据标签选择） apiVersion: projectcalico.org/v3 kind: BGPPeer metadata: name: rack1-tor spec: peerIP: 192.20.30.40 asNumber: 64567 nodeSelector: rack == 'rack-1'
检查命令：
#calicoctl apply -f bgprr.yaml #calicoctl delete -f bgprr.yaml #calicoctl get bgppeers -o yaml
root@clusterb-node1:~# calicoctl get bgppeers -o yaml
apiVersion: projectcalico.org/v3
items:
- apiVersion: projectcalico.org/v3
kind: BGPPeer
metadata:
creationTimestamp: "2026-07-01T03:28:18Z"
name: peer-with-route-reflectors
resourceVersion: "150925"
uid: 419d1760-cd32-435a-a348-62919b06ff4c
spec:
asNumber: 64512
nodeSelector: all()
peerIP: 10.10.1.254
kind: BGPPeerList
metadata:
resourceVersion: "173611"
3、配置节点成为BGP RR
kubectl API方式 kubectl annotate node my-node projectcalico.org/RouteReflectorClusterID=244.0.0.1 ETCD方式 calicoctl patch node my-node -p '{"spec": {"bgp": {"routeReflectorClusterID": "244.0.0.1"}}}' 为RR节点打上标签 kubectl label node my-node route-reflector=true kind: BGPPeer apiVersion: projectcalico.org/v3 metadata: name: peer-with-route-reflectors spec: nodeSelector: all() peerSelector: route-reflector == 'true'
4、禁用默认的full mesh,如果没有bgpconfiguration，需要手动创建
calicoctl patch bgpconfiguration default -p '{"spec": {"nodeToNodeMeshEnabled": false}}' #bgpconfiguration.yaml apiVersion: projectcalico.org/v3 kind: BGPConfiguration metadata: name: default spec: logSeverityScreen: Info nodeToNodeMeshEnabled: true 查看配置： calicoctl get bgpconfiguration -o yaml
5、改变默认的AS号
改变所有NODE： calicoctl patch bgpconfiguration default -p '{"spec": {"asNumber": "64513"}}' 改变特定NODE calicoctl patch node node-1 -p '{"spec": {"bgp": {"asNumber": "64514"}}}' 查看AS号 calicoctl get bgppeers -o yaml 为不同的对等体设置本地AS号 kubectl patch bgppeer [peer_name] -p '{"spec": {"localASNumber": 64577}}'
6、配置BGP过滤
过滤按顺序匹配，匹配到后按Action执行，如何时没有匹配到，默认为accept.过滤名称必须应用到BGPpeer资源。 kind: BGPFilter apiVersion: projectcalico.org/v3 metadata: name: first-bgp-filter spec: exportV4: - action: Accept matchOperator: In cidr: 77.0.0.0/16 source: RemotePeers importV4: - action: Reject matchOperator: NotIn cidr: 44.0.0.0/16 exportV6: - action: Reject interface: '*.calico' importV6: - action: Accept matchOperator: Equal cidr: 5000::0/64 --- kind: BGPFilter apiVersion: projectcalico.org/v3 metadata: name: second-bgp-filter spec: exportV4: - action: Accept matchOperator: In cidr: 77.0.0.0/16 interface: '*.calico' importV4: - action: Reject matchOperator: NotIn cidr: 44.0.0.0/16 exportV6: - action: Reject source: RemotePeers importV6: - action: Reject --- kind: BGPPeer apiVersion: projectcalico.org/v3 metadata: name: peer-with-filter spec: peerSelector: has(filter-bgp) filters: - first-bgp-filter - second-bgp-filter
7、配置overlay network
overlay network有三种方试，ip-ip/vxlan/cross-network 配置为VXLAN apiVersion: projectcalico.org/v3 kind: IPPool metadata: name: ippool-vxlan-1 spec: cidr: 192.168.0.0/16 vxlanMode: Always natOutgoing: true 配置为VXLAN-cross apiVersion: projectcalico.org/v3 kind: IPPool metadata: name: ippool-vxlan-cross-subnet-1 spec: cidr: 192.168.0.0/16 vxlanMode: CrossSubnet natOutgoing: true 配置为IP-ip-cross apiVersion: projectcalico.org/v3 kind: IPPool metadata: name: ippool-ipip-cross-subnet-1 spec: cidr: 192.168.0.0/16 ipipMode: CrossSubnet natOutgoing: true 配置为IP-ip apiVersion: projectcalico.org/v3 kind: IPPool metadata: name: ippool-ipip-1 spec: cidr: 192.168.0.0/16 ipipMode: Always natOutgoing: true
8、通告Kubernetes service IP
查看BGPconfiguration 1、calicoctl get bgpconfig default 通告service cluster IP 2、calicoctl patch bgpconfig default --patch \ '{"spec": {"serviceExternalIPs": [{"cidr": "x.x.x.x"}, {"cidr": "y.y.y.y"}]}}' 通告service external IP calicoctl patch bgpconfig default --patch \ '{"spec": {"serviceExternalIPs": [{"cidr": "x.x.x.x"}, {"cidr": "y.y.y.y"}]}}' 通告 service load balancer IP calicoctl patch bgpconfig default --patch '{"spec": {"serviceLoadBalancerIPs": [{"cidr": "x.x.x.x/16"}]}}' 3、排出通告的NODE kubectl label node control-plane-01 node.kubernetes.io/exclude-from-external-load-balancers=true
9、配置MTU
查看MTU：ip link show
10、禁用/启用NAT
apiVersion: projectcalico.org/v3 kind: IPPool metadata: name: default-ipv4-ippool spec: cidr: 192.168.0.0/16 natOutgoing: true
11、kube-proxy 使用IPVS
kube-proxy有三种方式：IPVS/iptables/namesapce
12、参考链接：
https://system51.github.io/2020/05/27/using-calico/ https://docs.tigera.io/calico/latest/about
浙公网安备 33010602011771号