Skip to content

Commit

Permalink
Merge pull request #1353 from spidernet-io/docs-stucture
Browse files Browse the repository at this point in the history
Move images to images folder
  • Loading branch information
weizhoublue authored May 8, 2024
2 parents 12d0d85 + 904466f commit d36cf29
Show file tree
Hide file tree
Showing 26 changed files with 20 additions and 29 deletions.
2 changes: 1 addition & 1 deletion docs/README.en.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ To solve this problem, EgressGateway has been introduced into the k8s cluster. I

## Architecture

![Architecture](./architecture02.png)
![Architecture](./images/architecture02.png)

## Why EgressGateway

Expand Down
2 changes: 1 addition & 1 deletion docs/README.zh.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@

## 架构

![Architecture](./architecture02.png)
![Architecture](./images/architecture02.png)

## 为什么选择 EgressGateway

Expand Down
9 changes: 0 additions & 9 deletions docs/backends.md

This file was deleted.

2 changes: 1 addition & 1 deletion docs/concepts/Architecture.en.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

EgressGateway consists of two parts: the control plane and the data plane. The control plane is composed of four control loops, and the data plane is composed of three. The control plane is deployed as a Deployment, supporting multiple replicas for high availability, and the data plane is deployed as a DaemonSet. The control loops are as follows in the diagram below:

![arch](../proposal/03-egress-ip/arch.png)
![arch](../images/arch.png)

## Controller

Expand Down
2 changes: 1 addition & 1 deletion docs/concepts/Architecture.zh.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
EgressGateway 由控制面和数据面 2 部分组成,控制面由 4 个控制循环组成,数据面由 3 个控制循环组成。控制面以 Deployment 方式部署,支持多副本高可用,数据面以 DaemonSet 的方式部署。控制循环具体如下图:

![arch](../proposal/03-egress-ip/arch.png)
![arch](../images/arch.png)


## 控制器
Expand Down
File renamed without changes
File renamed without changes
File renamed without changes
File renamed without changes
File renamed without changes
File renamed without changes
File renamed without changes
File renamed without changes
File renamed without changes
File renamed without changes
File renamed without changes
2 changes: 1 addition & 1 deletion docs/mkdocs.yml
Original file line number Diff line number Diff line change
Expand Up @@ -89,6 +89,7 @@ nav:
- Failover: usage/EgressGatewayFailover.md
- Move EgressIP: usage/MoveIP.md
- Run EgressGateway on Aliyun Cloud: usage/Aliyun.md
- Troubleshooting: usage/Troubleshooting.md
- Concepts:
- Architecture: concepts/Architecture.md
- Datapath: concepts/Datapath.md
Expand All @@ -102,7 +103,6 @@ nav:
- CRD EgressClusterInfo: reference/EgressClusterInfo.md
- egctl cli: reference/egctl.md
- metrics: reference/metrics.md
- Troubleshooting: Troubleshooting.md
- Development:
- DataFlow: develop/Dataflow.md
- Contribute: develop/Contribute.md
Expand Down
Binary file removed docs/proposal/01-egress-gateway/Egress-Gateway.png
Binary file not shown.
6 changes: 3 additions & 3 deletions docs/proposal/01-egress-gateway/EgressGateway.md
Original file line number Diff line number Diff line change
Expand Up @@ -90,7 +90,7 @@ spec:

### Datapath

<img src="Egress-Gateway-Datapath.png" width="70%"></img>
<img src="../../images/Egress-Gateway-Datapath.png" width="70%"></img>

A combination of vxlan tunnel, ipset, iptables, route is required to complete policy control.

Expand Down Expand Up @@ -162,12 +162,12 @@ iptables -t nat -I POSTROUTING 1 -m mark --mark 0x12000000 -j ACCEPT -m comment

Controller consists of Webhook Validator and Reconcile Flow.

<img src="Controller-Reconcile-Flow.png" width="70%"></img>
<img src="../../images/Controller-Reconcile-Flow.png" width="70%"></img>

Controller has 2 control processes, the first Watch cluster nodes, generate tunnel IP address and MAC address for Node, then `Create` or `Update` EgressTunnel CR Status. The second control flow watch `EgressTunnel` and `Egressgateway`, sync match node list from `labelSelector`, election egress gateway node.

### Agent

<img src="Agent-Reconcile-Flow.png" width="70%"></img>
<img src="../../images/Agent-Reconcile-Flow.png" width="70%"></img>

Agent has two control processes, the first Watch `EgressTunnel` CR, which manages node tunnel, and node tunnel is a pluggable interface that can be replaced by Geneve. The second control process manages datapath policy, which watches `EgressTunnel`, `EgressGateway` and `Egresspolicy`, and sends them to the host through the police interface. It is currently implemented by a combination of *ipset*, *iptables*, and *route*, and it can be replaced by *eBPF*.
2 changes: 1 addition & 1 deletion docs/proposal/03-egress-ip/README.en.md
Original file line number Diff line number Diff line change
Expand Up @@ -338,4 +338,4 @@ When an EIP is not used by a policy, it will be recycled, recycling means delete

#### Code Design

![arch](./arch.png)
![arch](../../images/arch.png)
2 changes: 1 addition & 1 deletion docs/proposal/03-egress-ip/README_zh-CN.md
Original file line number Diff line number Diff line change
Expand Up @@ -315,5 +315,5 @@ data:

#### 代码设计

![arch](./arch.png)
![arch](../../images/arch.png)

8 changes: 4 additions & 4 deletions docs/proposal/06-underlay-cni-supports/README.en.md
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ EgressGateway supports nanotube traffic in an Underlay CNI environment.

As shown in the diagram, the datapath for the round-trip Underlay access to the external Server is: "Process <-> A <-> B <-> Server".

![datapath](underlay_datapath.png)
![datapath](../../images/underlay_datapath.png)

The EgressGateway's rules don't work at all, and in order to pipe the Underlay traffic, two things need to be addressed, hijacking the traffic to the Pod's host and avoiding routing asymmetric messages from being dropped when the answering traffic arrives at the Pod's host

Expand All @@ -30,13 +30,13 @@ Thing 2, you can route, iptables, etc. to forward the matched traffic to the hos

As shown in the figure, by adding a new veth pair and routing the traffic through the veth to the host, the datapath is actually the same as the overlay.

![send-datapath](underlay_send_datapath.png)
![send-datapath](../../images/underlay_send_datapath.png)

### Reply datapath

As shown in the figure, the datapath returned is "Server->D->C->B->E->Process"

![reply](underlay_error_reply_datapath.png)
![reply](../../images/underlay_error_reply_datapath.png)

- The srcIP=ServerIP, dstIP=EIP of the message as it passes through the D-segment datapath to the EgressGateway.
- The C datapath looks up the connection tracking table and NATs the message, srcIP=ServerIP, dstIP=PodIP.
Expand Down Expand Up @@ -80,7 +80,7 @@ iptables -t mangle -A POSTROUTING -m mark --mark 0x27 -j MARK --set-mark 0x00

As shown in the figure, after the above rule, the new answer datapath is "Server->D->C->B->A->Process"

![reply](underlay_reply_datapath.png)
![reply](../../images/underlay_reply_datapath.png)

The biggest difference is that from the gateway node to the node where the Pod is located, it is through the EgressGateway tunnel, and after the message arrives at the node where the Pod is located, it is forwarded to the Pod from the veth pair through the route, and the spiderpool will send out the corresponding route when it creates the veth pair for the Pod, or it can send out the corresponding route through the agent. The spiderpool will issue the corresponding route while creating the veth pair for the Pod, or it can issue the corresponding routing rules through the agent. Because it passes through the host's network stack. This avoids the routing asymmetry problem.

Expand Down
8 changes: 4 additions & 4 deletions docs/proposal/06-underlay-cni-supports/README_zh-CN.md
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ EgressGateway 支持纳管 Underlay CNI 环境下的流量
## 需要解决的问题
如图所示,Underlay 访问外部 Server 来回的 datapath 为:"Process <-> A <-> B <-> Server"。

<img src="./underlay_datapath.png" width="70%"></img>
<img src="../../images/underlay_datapath.png" width="70%"></img>

EgressGateway 的规则根本不生效,要想将 Underlay 的流量进行纳管,则需要解决两件事,将流量劫持到 Pod 的所在的主机上,及当应答的流量到达 Pod 所在主机时,避免路由不对称报文被丢弃

Expand All @@ -30,13 +30,13 @@ EgressGateway 的规则根本不生效,要想将 Underlay 的流量进行纳

如图所示,通过新增 veth pair,并通过路由将流量通过 veth 转发到主机上,此时的 datapath 与 overlay 其实是一样的。

<img src="./underlay_send_datapath.png" width="70%"></img>
<img src="../../images/underlay_send_datapath.png" width="70%"></img>

### 应答 datapath

如图所示,返回的 datapath 为 "Server->D->C->B->E->Process"

<img src="./underlay_error_reply_datapath.png" width="70%"></img>
<img src="../../images/underlay_error_reply_datapath.png" width="70%"></img>

- 报文经过 D 段 datapath 到达 EgressGateway 时的 srcIP=ServerIP、dstIP=EIP
- C 段 datapath 会查询连接跟踪表,会将报文进行 NAT,srcIP=ServerIP、dstIP=PodIP
Expand Down Expand Up @@ -80,7 +80,7 @@ iptables -t mangle -A POSTROUTING -m mark --mark 0x27 -j MARK --set-mark 0x00

如图所示,经过上面的规则,新的应答 datapath 为 "Server->D->C->B->A->Process"

<img src="./underlay_reply_datapath.png" width="70%"></img>
<img src="../../images/underlay_reply_datapath.png" width="70%"></img>

最大的不同就是,从网关节点到 Pod 所在节点,是通过 EgressGateway 隧道,报文到达 Pod 所在节点后,通过路由指定从 veth pair 转发给 Pod,spiderpool 在前面给 Pod 创建 veth pair 的同时,会下发对应的路由,或者可以通过 agent 下发相应的路由规则。因为经过了主机的网络协议栈。从而规避了路由不对称问题

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ The following are the data from our stress tests using bare metal servers.
| case2 | egress vxlan -> egress vxlan | `9.11 Gbits/sec sender - 9.09 Gbits/sec receiver` |
| case3 | pod -> egress node -> target | `9.01 Gbits/sec sender - 8.98 Gbits/sec receiver` |

![egress-check](./speed.svg)
![egress-check](../images/speed.svg)

#### Virtual machine

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ EgressGateway 使用了 vxlan 隧道,经过测试 vxlan 损耗在 10% 左右
| case2 | egress vxlan -> egress vxlan | `9.11 Gbits/sec sender - 9.09 Gbits/sec receiver` |
| case3 | pod -> egress node -> target | `9.01 Gbits/sec sender - 8.98 Gbits/sec receiver` |

![egress-check](./speed.svg)
![egress-check](../images/speed.svg)

#### 虚拟机

Expand Down

1 comment on commit d36cf29

@weizhoublue
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please sign in to comment.