Kubernetes Multus を Calico 構成の既存クラスタへ導入する – release tag 固定、delegate、疎通確認

ctx=k8s-mgmt.example.local
src=https://raw.githubusercontent.com/k8snetworkplumbingwg/multus-cni/v4.2.4/deployments/multus-daemonset.yml
manifest=/tmp/multus-daemonset-thin-v4.2.4.yaml

curl -fsSL "$src"   | sed 's#ghcr.io/k8snetworkplumbingwg/multus-cni:snapshot#ghcr.io/k8snetworkplumbingwg/multus-cni:v4.2.4#g'   > "$manifest"

kubectl --context "$ctx" apply --dry-run=server -f "$manifest"

kubectl --context "$ctx" apply -f "$manifest"

kubectl --context "$ctx" -n kube-system set resources ds/kube-multus-ds   -c kube-multus   --requests=cpu=100m,memory=50Mi   --limits=cpu=200m,memory=200Mi

kubectl --context "$ctx" -n kube-system rollout restart ds/kube-multus-ds
kubectl --context "$ctx" -n kube-system rollout status ds/kube-multus-ds --timeout=180s

kubectl --context "$ctx" -n kube-system get ds,pod -l app=multus -o wide
kubectl --context "$ctx" get crd network-attachment-definitions.k8s.cni.cncf.io

sudo ls -la /etc/cni/net.d
sudo sed -n '1,220p' /etc/cni/net.d/00-multus.conf
sudo find /opt/cni/bin -maxdepth 1 \( -name '*multus*' -o -name '*passthru*' \) -print

cat >/tmp/multus-nettest.yaml <<EOF
apiVersion: v1
kind: Pod
metadata:
  name: multus-nettest-cp
  namespace: default
  labels:
    app: multus-nettest
spec:
  nodeName: k8s-cp-01.example.local
  containers:
  - name: netshoot
    image: nicolaka/netshoot:latest
    command: ["sleep", "3600"]
---
apiVersion: v1
kind: Pod
metadata:
  name: multus-nettest-worker
  namespace: default
  labels:
    app: multus-nettest
spec:
  nodeName: k8s-worker-01.example.local
  containers:
  - name: netshoot
    image: nicolaka/netshoot:latest
    command: ["sleep", "3600"]
EOF

kubectl --context "$ctx" apply -f /tmp/multus-nettest.yaml
kubectl --context "$ctx" -n default wait pod/multus-nettest-cp pod/multus-nettest-worker   --for=condition=Ready   --timeout=180s

kubectl --context "$ctx" -n default get pod -l app=multus-nettest -o wide

kubectl --context "$ctx" -n default get pod -l app=multus-nettest -o json   | jq -r '.items[] | [.metadata.name,.status.podIP,([.status.podIPs[].ip]|join(",")),.metadata.annotations["k8s.v1.cni.cncf.io/network-status"]] | @tsv'

kubectl --context "$ctx" -n default exec multus-nettest-cp -- ip -brief address
kubectl --context "$ctx" -n default exec multus-nettest-worker -- ip -brief address

kubectl --context "$ctx" -n default exec multus-nettest-cp -- ping -c 3 -W 2 <worker-pod-ipv4>
kubectl --context "$ctx" -n default exec multus-nettest-worker -- ping -c 3 -W 2 <cp-pod-ipv4>

kubectl --context "$ctx" -n default exec multus-nettest-cp -- ping -6 -c 3 -W 2 <worker-pod-ipv6>
kubectl --context "$ctx" -n default exec multus-nettest-worker -- ping -6 -c 3 -W 2 <cp-pod-ipv6>

kubectl --context "$ctx" -n default exec multus-nettest-cp --   dig +short kubernetes.default.svc.cluster.local A

kubectl --context "$ctx" -n default exec multus-nettest-worker --   dig +short kube-dns.kube-system.svc.cluster.local A

kubectl --context "$ctx" -n default exec multus-nettest-cp --   nc -vz -w 3 10.201.0.1 443

kubectl --context "$ctx" -n default exec multus-nettest-worker --   nc -vz -w 3 10.201.0.1 443

kubectl --context "$ctx" -n default exec multus-nettest-cp --   curl -sk --max-time 5 https://kubernetes.default.svc/readyz

kubectl --context "$ctx" -n default exec multus-nettest-worker --   curl -sk --max-time 5 https://kubernetes.default.svc/readyz

kubectl --context "$ctx" -n default delete pod multus-nettest-cp multus-nettest-worker --wait=true

for n in   k8s-cp-01.example.local   k8s-worker-01.example.local
do
  ssh "$n" 'sudo find /var/lib/cni/multus -maxdepth 3 -type f -print 2>/dev/null'
done

kubectl --context "$ctx" -n kube-system get pod -l app=multus -o wide
kubectl --context "$ctx" get pods -A --field-selector=status.phase!=Running,status.phase!=Succeeded --no-headers