calico Router reflection(RR) 模式介绍及部署

# calico默认使用的AS号是64512，可以修改：

# 查看
$ calicoctl config get asNumber

# 设置
$ calicoctl config set asNumber 64512

$ calicoctl config set nodeTonodeMesh off
$ calicoctl config set nodeTonodeMesh on

$ docker run --privileged --net=host -d \
             -e IP=<IPv4_RR> \
             [-e IP6=<IPv6_RR>] \
             -e ETCD_ENDPOINTS=<https://ETCD_IP:PORT> \
             -v <FULL_PATH_TO_CERT_DIR>:<MOUNT_DIR> \
             -e ETCD_CA_CERT_FILE=<MOUNT_DIR>/<CA_FILE> \
             -e ETCD_CERT_FILE=<MOUNT_DIR>/<CERT_FILE> \
             -e ETCD_KEY_FILE=<MOUNT_DIR>/<KEY_FILE> \
             calico/routereflector:v0.4.0

# <FULL_PATH_TO_CERT_DIR> 是你的宿主机的 etcd 证书和秘钥的存放目录

/calico/bgp/v1/rr_v4/<RR IPv4 address>

/calico/bgp/v1/rr_v6/<RR IPv6 address>

{
  "ip": "<IP address of Route Reflector>",
  "cluster_id": "<Cluster ID for this RR (see notes)>"
}

# IPv4 entries
$ curl --cacert <path_to_ca_cert> --cert <path_to_cert> --key <path_to_key> -L https://<ETCD_IP:PORT>:2379/v2/keys/calico/bgp/v1/rr_v4/<IPv4_RR> -XPUT -d value="{\"ip\":\"<IPv4_RR>\",\"cluster_id\":\"<CLUSTER_ID>\"}"
# IPv6 entries
$ curl --cacert <path_to_ca_cert> --cert <path_to_cert> --key <path_to_key> -L https://<ETCD_IP:PORT>:2379/v2/keys/calico/bgp/v1/rr_v6/<IPv6_RR> -XPUT -d value="{\"ip\":\"<IPv6_RR>\",\"cluster_id\":\"<CLUSTER_ID>\"}"

$ curl --cacert <path_to_ca_cert> --cert <path_to_cert> --key <path_to_key> -L https://10.10.31.190:2379/v2/keys/calico/bgp/v1/rr_v4/10.10.31.168 -XPUT -d value="{\"ip\":\"10.10.31.168\",\"cluster_id\":\"1.0.0.1\"}"

$ calicoctl config set nodeToNodeMesh off

$ calicoctl get nodes --output=wide

# 或者使用以下命令
$ calicoctl config get asNumber

$ calicoctl create -f - << EOF
apiVersion: v1
kind: bgpPeer
metadata:
  peerIP: <IP_RR>
  scope: global
spec:
  asNumber: <AS_NUM>
EOF

# <IP_RR>：反射路由的 ipv4 或 ipv6 地址
# <AS_NUM>：网络的 AS 号码

$ ss -tnp|grep 179
ESTAB      0      0      10.10.31.168:179                10.10.31.196:55967               users:(("bird",pid=10601,fd=8))
ESTAB      0      0      10.10.31.168:56393              10.10.31.193:179                 users:(("bird",pid=10601,fd=9))
ESTAB      0      0      10.10.31.168:41164              10.10.31.194:179                 users:(("bird",pid=10601,fd=10))

$ docker exec 52e584f5bcf3 cat /config/bird.cfg
# Generated by confd
router id 10.10.31.168;

# Watch interface up/down events.
protocol device {
  scan time 2;    # Scan interfaces every 2 seconds
}

# Template for all BGP clients
template bgp bgp_template {
  debug off;
  description "Connection to BGP peer";
  multihop;
  import all;        # Import all routes, since we don't know what the upstream
                     # topology is and therefore have to trust the ToR/RR.
  export all;        # Export all.
  source address 10.10.31.168;  # The local address we use for the TCP connection
  graceful restart;  # See comment in kernel section about graceful restart.
}



# ------------- RR-to-RR full mesh -------------



# For RR 10.10.31.168
# Skipping ourselves




# ------------- RR as a global peer -------------



# This RR is a global peer with *all* calico nodes.




# Peering with Calico node node1
protocol bgp Global_10_10_31_193 from bgp_template {
  local as 64512;
  neighbor 10.10.31.193 as 64512;
  rr client;
  rr cluster id 1.0.0.1;
}




# Peering with Calico node node2
protocol bgp Global_10_10_31_194 from bgp_template {
  local as 64512;
  neighbor 10.10.31.194 as 64512;
  rr client;
  rr cluster id 1.0.0.1;
}




# Peering with Calico node node3
protocol bgp Global_10_10_31_196 from bgp_template {
  local as 64512;
  neighbor 10.10.31.196 as 64512;
  rr client;
  rr cluster id 1.0.0.1;
}






# ------------- RR as a node-specific peer -------------

$ docker exec 7fcb072515d6 cat /etc/calico/confd/config/bird.cfg
# Generated by confd
include "bird_aggr.cfg";
include "custom_filters.cfg";
include "bird_ipam.cfg";


router id 10.10.31.193;



# Configure synchronization between routing tables and kernel.
protocol kernel {
  learn;             # Learn all alien routes from the kernel
  persist;           # Don't remove routes on bird shutdown
  scan time 2;       # Scan kernel routing table every 2 seconds
  import all;
  export filter calico_ipip; # Default is export none
  graceful restart;  # Turn on graceful restart to reduce potential flaps in
                     # routes when reloading BIRD configuration.  With a full
                     # automatic mesh, there is no way to prevent BGP from
                     # flapping since multiple nodes update their BGP
                     # configuration at the same time, GR is not guaranteed to

# Watch interface up/down events.
protocol device {
  

  debug { states };


  scan time 2;    # Scan interfaces every 2 seconds
}

protocol direct {
  

  debug { states };


  interface -"cali*", "*"; # Exclude cali* but include everything else.
}


# Template for all BGP clients
template bgp bgp_template {
  

  debug { states };


  description "Connection to BGP peer";
  local as 64512;
  multihop;
  gateway recursive; # This should be the default, but just in case.
  import all;        # Import all routes, since we don't know what the upstream
                     # topology is and therefore have to trust the ToR/RR.
  export filter calico_pools;  # Only want to export routes for workloads.
  next hop self;     # Disable next hop processing and always advertise our
                     # local address as nexthop
  source address 10.10.31.193;  # The local address we use for the TCP connection
  add paths on;
  graceful restart;  # See comment in kernel section about graceful restart.
}


# ------------- Global peers -------------



# For peer /global/peer_v4/10.10.31.168
protocol bgp Global_10_10_31_168 from bgp_template {
  neighbor 10.10.31.168 as 64512;
}




# ------------- Node-specific peers -------------