kubernetes 网络

在同一pod内的container

In kubernetes, every pod gets assigned an IP address, and every container in the pod gets assigned that same IP address.

From kubernetes docs:

The applications in the pod all use the same network namespace/IP and port space, and can find and communicate with each other using localhost. Each pod has an IP address in a flat shared networking namespace that has full communication with other physical computers and containers across the network.

1. 如果要访问Kubernetes集群的其他服务，则需要经过宿主机的iptables的NAT规则，请求会发给kube-proxy，kube-proxy知道所有的服务的endpoints，并且知道服务请求是由哪些Pod来处理(而这通过Label Selector完成)。
2. kube-proxy选择出相应的Pod，并且把请求发送给他们处理，而这个Pod的地址是 172.16.x.x 也就是docker0网桥桥接的地址，也就是说这时候交给Flannel这一层进行处理(如果跨机器的话)或者直接交给本机处理

这个是k8s的文档

https://github.com/kubernetes/kubernetes/blob/master/docs/design/networking.md

关于openshift的，这一块实际上不是kube自带的

https://docs.openshift.com/enterprise/3.1/architecture/additional_concepts/sdn.html

https://access.redhat.com/documentation/en/openshift-enterprise/3.1/cluster-administration/chapter-17-troubleshooting-openshift-sdn