Antrea, with Antonin Bas

大家好，欢迎收听谷歌出品的Kubernetes播客。

Hi, and welcome to the Kubernetes Podcast from Google.

我是克雷格·博克斯。

I'm Craig Box.

我是亚当·格利克。

And I'm Adam Glick.

你今年过万圣节的时候，有保持社交距离吗？

Did you enjoy a socially distanced Halloween?

当然有。

Oh, yes.

我们确实过了。

I did.

我们给小孩子打扮了一下，然后在 neighborhood 里转了转，主要是看看周围的装饰，也留意了大家为了保持社交距离想出的各种办法。

We got a chance to dress the little one up and walk around, mostly just enjoy the decorations in the area and also take a look at all the things that people had done to be socially distanced.

有人在屋檐下拉了长长的滑道，把糖果滑下来；有人在门口摆了袋子，或者放了张桌子，上面堆满糖果，确保大家即使和往年不一样，也能好好过个万圣节。

So people had set up long gutters up on a top that they'd slide candy down or put bags out in front or a table with things on to really make sure that people could enjoy the Halloween even if was a little different than normal.

有没有什么灯光

Any light

秀？

shows?

虽然没什么特别像网上看到的那些，但节目简介里有个链接，展示了一个真正非常棒的灯光秀，是一位有很多时间和材料的人做的，他为金属乐队的《Enter Sandman》打造了一场令人惊叹的表演。

Nothing quite what we've seen online, but there's a link in the show notes to one that is truly, truly impressive from someone who has a lot of time and materials on their hands and created an incredible show for Enter Sandman from Metallica.

大家可以去看看。

So check that one out.

挺有意思的。

It's a good watch.

上周是万圣节周，这周呢，当然是选举周了。

Now it was Halloween week last week, and then this week, of course, it is election week.

我们不确定大家什么时候听到这期节目，但重要的是要意识到，现在是投票的时候了。

And we're not sure when you are listening to this, but it is important to realize that it is time to go vote for bird of

今年的选举。

the year.

没错。

That's right.

你选好你的鸟了吗？

Have you chosen your bird?

我还没选，不过还有几周时间可以慢慢考虑。

I haven't, but I have a couple weeks to think about it.

‘年度之鸟’是新西兰森林与鸟类协会每年举办的一项活动，介绍一些新西兰本土鸟类，其中有些濒临灭绝，鼓励大家挑一只心仪的鸟，然后为它拉票。

Bird of the year is an annual event run by the Forest and Bird Association on New Zealand looking at some of New Zealand's native birds, some more endangered than others, and encouraging you to pick one and then go out and campaign for it.

虽然这没其他选举那么严肃，但我真心推荐你参与一下，支持你选中的那只鸟。

And it's a little bit lower stakes than some other elections that have been happening around this time, but I thoroughly encourage you to check it out and get behind one.

我们大概下周就能定下选择，到时候再看看最终谁能胜出。

We will probably have made our picks by next week, and we'll have to see who ends up victorious.

再次感谢所有已经填写了我们听众调查的朋友们，调查地址是 kubernetespodcast.com/survey。

Thanks again to all of you who have already filled out our audience survey at kubernetespodcast.com/survey.

还没填的朋友们，你们只剩最后一周时间了。

For those who haven't yet, you've got one week left.

调查会持续到11月10日，请花点时间访问 kubernetespodcast.com/survey，花三分钟填一下问卷，告诉我们你对这个播客的看法，以及我们怎样才能更好地服务云原生社区。

We're keeping the survey open until November 10, so please take a moment and go to kubernetespodcast.com/survey and take the three minutes it should take you to fill out the survey to let us know what you think of the podcast and how we can continue to make this the best podcast for the cloud native community.

谢谢。

Thanks.

我们来说说最新动态。

Let's get to the news.

D2IQ（原Mesosphere）本周宣布，公司将停止开发基于Mesos的DCOS平台。

D2IQ, formerly Mesosphere, announced this week that the company will stop development of their Mesos based DCOS platform.

联合首席执行官兼联合创始人托比·克瑙普表示，公司将不再继续运营DCOS，而是把全部精力转向基于Kubernetes的DKP平台。

Co CEO and co founder Toby Knaupp announced they will no longer be a co company, instead transitioning all of their efforts to their Kubernetes based platform DKP.

在帮助现有客户完成过渡期间，公司仍会为他们提供支持。

Support will still be available for existing customers of DCOS as the company works to transition them.

公告中提到一句意味深长的话：公司已‘调整规模，变得更灵活高效’，这已被证实意味着裁员。

The announcement contains the ominous statement that they have quote, resized the company to become more nimble and streamlined, which has been confirmed to mean layoffs.

自从Docker宣布转型为专注于支持Kubernetes生态的开发者工具公司，已经过去一年了。

It's been a year since Docker announced their pivot to a developer tools company supporting the Kubernetes ecosystem.

上周，他们公布了第二年的规划，包括提供更明确的开发环境配置、更多集成自动化流水线的镜像管理工具，以及更多官方容器镜像。

Last week, they outlined their expectations for year two, including prescriptive development environments, more image management tools with automation pipeline integration, and more official container images.

Docker 为实现盈利所采取的措施之一，就是对容器镜像的拉取数量设限，这项规定现在已经生效了。

Part of Docker's plan to become profitable was to implement limits on pools of container images, which has now come into effect.

不少服务商已经提出了应对方案或建议。

A number of providers have offered workarounds or suggestions.

默认情况下，GKE 会从 Google 容器镜像仓库（GCR）中缓存的最常用 Docker Hub 镜像里拉取。

By default, GKE will pull from a cache of the most common Docker Hub images that is hosted on Google Container Registry or GCR.

谷歌本周发布了一篇文章，指导用户如何识别依赖 Docker Hub 的组件，并直接把这些镜像迁移到 GCR。

A post from Google this week outlines how you can identify dependencies that are hosted on Docker Hub and move those images to GCR directly.

红帽和 VMware 也分别发布了文章，介绍如何使用 Quay 和 Harbor 来运行不受拉取限制的镜像仓库。

Red Hat and VMware also posted about how you can use Quay and Harbor respectively to run registries without pull limits.

安全公司 StackRox 推出了 KubeLinter，这是一个开源的静态分析工具，用于检查 Kubernetes 的 YAML 文件和 Helm 图表，确保其中的应用符合最佳实践。

Security vendor StackRox has released KubeLinter, an open source static analysis tool that checks Kubernetes YAML files and Helm charts to ensure the applications represented in them adhere to best practices.

这个工具用 Go 语言开发，可以通过命令行运行。

The tool is written in Go and runs at the command line.

官方公告提到，这还是一个 alpha 版本，后续在正式发布前还可能有不兼容的改动。

The release calls out that it's an alpha release and that breaking changes could still come to the product as it moves through its release stages.

HashiCorp 发布了 Nomad 1.0 的测试版，这可能是目前最后一个支持在云端和本地部署容器及非容器应用的非 Kubernetes 编排系统。

Hashicorp announced the one point zero beta of Nomad, possibly the final remaining non Kubernetes orchestrator to deploy containerized and non containerized applications across cloud and on premises environments.

这次更新主要聚焦稳定性，为产品迈向正式版做准备，企业版还新增了动态调整应用规模的功能。

This release is largely about stability as the product moves towards GA, but includes a new dynamic application sizing feature in the enterprise version.

命名空间功能已从企业版移至开源版，同时新增了可视化集群拓扑结构的界面功能。

Namespaces have been moved from enterprise to open source, and a new UI feature allows you to visualize the topology of your cluster.

Vitess 推出了第 8 版的正式发布，展现了它的成熟度。

Vitess is showing off its fitness with general availability of version eight.

作为一套用于水平扩展 MySQL 的集群系统，Vitess 现在支持更多主流编程语言和框架，还兼容 MySQL Workbench 等工具。

Vitess, a clustering system for horizontally scaling MySQL, has increased its MySQL client compatibility with support for a host of popular languages and frameworks, as well as tooling like MySQL Workbench.

v 复制流程增加了更多日志和监控指标，同时实验性地加入了在线修改表结构和故障自动切换功能。

More logging and metrics were added to the v replication workflow and new capabilities for online schema changes and work failover support were added as experimental.

需要注意的是，这次更新有一些不兼容的改动，部署前请务必查阅发布说明。

Of note, there are some breaking changes when it comes to compatibility, so check with the release notes before you deploy.

最近，Cog Art Tech 的鲍勃·卢塞尔曼在《可编程网络》上发表了一系列文章，深入探讨了 gRPC 的起源、工作原理以及如何使用它。

In a recent blog series on programmable web, Bob Russelman from Cog Art Tech has been looking at gRPC, where it came from, how it works, and how you use it.

最新几篇文章聚焦于实际应用场景，比如介绍了 Kubernetes 容器运行时接口的具体实现方式。

The latest posts talk about real world applications, including an overview of how the Kubernetes container runtime interface is implemented.

这九篇文章非常值得一读，能帮你深入了解 RPC 和 API 设计。

The nine article series is a good read to learn about RPC and API design.

最后，我们想花一点时间，纪念我们社区一位非常重要、却在本周离世的成员。

Finally, we wanna take a moment and acknowledge a very important member of our community who passed away this week.

丹·科恩是云原生社区的奠基人之一，他作为 CNCF 的创始执行董事，亲手推动了这个组织的成长。

Dan Kohn helped build the cloud native community and specifically the CNCF as its founding executive director.

他是一位富有远见的领导者，真正把 CNCF 打造成了今天这个改变整个计算行业的中坚力量。

He was a visionary leader who truly built the organization to make it the force in computing that we are all benefiting from today.

我们会深深怀念你。

You'll be missed,

以上就是今天的全部新闻。

And that's the news.

安东宁·巴是VMware的高级工程师，也是Project Entrea的维护者。这个项目是一个基于Open vSwitch的Kubernetes网络插件，他努力让它尽可能简单地部署和排错。

Antonin Bas is a staff engineer at VMware and a maintainer for Project Entrea, a Kubernetes network plugin based on Open vSwitch, which he tries to make as simple as possible to deploy and troubleshoot.

安东宁还是P4语言的核心贡献者，这是Linux基金会的一个项目，用于实现网络基础设施的可编程性。

Antonin is also a core contributor to the p four language, a Linux foundation project which enables programmability in the network infrastructure.

欢迎来到节目，安东宁。

Welcome to the show, Antonin.

谢谢。

Thanks.

这是我第一次参加播客，能来我真的很开心。

I'm very happy to be here for my first podcast ever.

完全不用紧张。

Nothing to worry about at all.

你是在法国长大的。

You grew up in France.

你在那里读完了本科，之后去了斯坦福。

You got your undergraduate degree there, but then you went to Stanford.

这事儿是怎么发生的？

How did that happen?

我觉得我这代人大多都差不多，最早是通过电子游戏接触到电脑的。

I think I got a pretty typical story from my generation where I got into computers through video games.

90年代末我玩了很多游戏，到现在我可能还是玩得有点太多。

I played a lot of video games in the late 90s, and I still play video games today probably more than I should.

但正是这些游戏让我对电脑产生了兴趣。

But that's how I got into computers.

后来我爸爸给了我一些启发，他大学时有点零星的编程记忆。

And then I got into programming through my dad who had some distant memories from his college days.

他本人并不是程序员。

He's not a programmer himself.

也不在软件行业工作。

He's not in the software industry.

但他跟我说：‘你不是挺喜欢电脑的吗？’

But he told me, Oh, you like computers.

你应该试着写个程序。

You should try writing a program.

他建议我从BASIC语言开始，这在当时真是挺出人意料的。

And he recommended me to try the BASIC language, which is a very surprising recommendation for the time.

大概是2003年或者2004年吧。

Think it was like 2003, 2004.

那时候早没人用BASIC了，对吧？

Nobody was using BASIC anymore, right?

那会是Visual Basic吗？

So was that Visual Basic then?

应该是Visual Basic，没错。

I think it was Visual Basic, yes.

但就算Visual Basic，那时候也过时了。

But even Visual Basic was dated at the time.

我不想惹谁不高兴，不过

Don't want to make anyone mad, but

我觉得

I think

确实是这样。

it was the case.

我写了一些简单的程序，很快就转去学C++，还上网看了些教程。

I wrote some simple programs, and then I quickly graduated to C plus plus and took some tutorials online.

那时候大家都是这么学的，看这些教程。

That's how you did things at the time, took those tutorials.

那时候YouTube还没火起来。

It was before YouTube was a big thing.

我做过一点网页编程，不算太复杂。

I did a little bit of web programming, nothing too complicated.

很快我就意识到，我想在科技行业干一辈子。

Basically, I realized pretty quickly I wanted to do a career in tech.

我去法国上了大学。

I went to college in France.

那时候我就想，如果真想在科技行业干一番事业，斯坦福应该是绝佳的选择。

Then I was like, if I want to do a career in tech, I think Stanford would be a great place to go.

于是我申请了几所大学，美国和英国的都报了。

And so I applied to several universities, both in The US and in The UK.

最后我选了斯坦福，就这样去了那里。

Eventually, I chose Stanford and that's how I got there.

你后来做了计算机网络，这跟我印象里一般人专注的方向不太一样，尤其是搞游戏的人，通常都盯着图形渲染。

You've gone into computer networking, which isn't the area I normally think of people focusing on, especially if you're into video games where graphics are such a big thing in it.

那为什么偏偏是网络吸引了你呢？

Why was networking the thing that attracted you?

这行现在真不算酷了，至少好多年都没人觉得它时髦了。

It's not really the sexy field of computer science, at least not anymore and not for a long time right now.

以前大家追捧的是图形技术。

It used to be graphics, guess.

现在人人都在追机器学习和大数据。

Now everyone is into machine learning and big data.

但我特别想弄明白互联网到底是怎么运行的，对分布式应用也很感兴趣。

But I really wanted to understand how the Internet worked and I was interested in distributed applications.

这种系统该怎么搭建呢？

How would you build them?

它们之间又是怎么通信的？

How do they communicate with each other?

怎么才能做出既可扩展又稳定的系统？

How would you build scalable and resilient systems?

正因如此，我才走上了计算机网络这条路。

That's how I got into computer networking.

其实，到了斯坦福之后，我认识了一位叫尼克·麦基翁的教授，他是电气工程和计算机科学系的教授。

Really, it's when I got to Stanford, I met a professor there called Nick McKeown, who is a professor of electrical engineering and computer science.

他被认为是软件定义网络的奠基人之一。

And he's considered one of the founders of software defined networking.

我刚到斯坦福那会儿，他正好刚经历完Nicira被VMware收购的事。

At the time I met him, just after getting to Stanford, he had just gone through Nicira acquisition by VMware.

他是Nicira的联合创始人之一。

He's one of the co founders of Nicira.

我跟他见了面。

I met with him.

我成了他讲的计算机网络导论课的助教。

I became a teaching assistant for his Intro to Computer Networking class.

我做了他支持的一些研究，也是通过他，我才得到了第一份工作。

I did some research that he sponsored, and he's also how I got my first job.

他对我的影响很大。

It's been a big influence on me.

你觉得，要教别人技术，非得自己真正理解不可吗？

Do you find that you really have to understand the technology to be able to teach it to other people?

是的，毫无疑问。

Yes, definitely.

不然的话，我根本没法安心跟别人解释这些内容。

Otherwise, I just don't feel comfortable explaining things to people.

我的意思是，如果你根本不懂，你该怎么给别人讲呢？

I mean, how would you even explain things to people if you

不明白它的本质，我就不敢开口解释。

don't know what it's about?

有时候我学东西特别慢，就是因为我没搞透之前，心里总不踏实，一定要弄明白才行。

Sometimes it takes me a long time to learn things just because I don't feel comfortable until I get to the bottom of it and I fully understand it.

等我真的搞懂了，才觉得有底气去教别人。

Once I've learned something, I usually feel comfortable teaching it.

那时候，开源在斯坦福这样的地方已经特别火了。

Now around that time, open source was obviously a big thing at places like Stanford.

你在学校的时候，有参与过开源项目吗？

Was that something you were involved with while you were at school?

没有。

No.

其实我毕业离开斯坦福之后，才接触到开源的。

Actually, I didn't get to open source until after I graduated from Stanford.

也许我做过一些小贡献，但具体什么都想不起来了。

Maybe I did some minor contributions, but actually I can't remember anything.

我真正接触开源是在我第一份工作开始的时候。

I really got into open source when I started my first job.

是你的兴趣、你做的事，还是公司做的方向影响了你？

Was that factor a of what you were doing, what you were interested in, or what the company was doing?

肯定是公司做的方向影响了我。

Definitely what the company was doing.

说来有趣，我原本打算硕士毕业后去纽约一家高频交易公司上班。

Funny story, I was originally going to join an high frequency trading firm in New York at the end of my master's.

我跟尼克——就是我刚才提到的尼克·麦基温——聊了聊，跟他说：‘尼克，我跟你做过一段时间项目，能给我写封推荐信吗？’

I talked to Nick, Nick McKeown that I just mentioned, and I was like, Nick, I'd like a recommendation letter to go there because I've been working with you for a bit now.

行啊，推荐信我给你写。

Okay, I'll give you your recommendation letter.

但在这之前，你得帮我个忙，去帕洛阿尔托见见那群人，他们正在搞一个要彻底改变网络技术的初创公司。

But first, you have to do me a favor and you have to go meet those guys in Palo Alto who are building a startup which is going to revolutionize networking.

当然，他是那家初创公司的联合创始人之一。

Of course, he was one of the co founders of that startup.

所以我去跟他们聊了聊

So I went to talk to

最后我决定留下来。

them and eventually I decided to stay.

就这样我加入了那家公司，所以现在我不在金融行业工作了。

That's how I joined that company and I'm not in finance today.

回到刚才的问题，我加入的那家公司叫Barefoot Networks，他们推出了一种全新的网络设备和编程范式，可以说是软件定义网络革命的下一步。

Going back to the question, the company that I joined, Barefoot Networks, was introducing a new paradigm for designing network devices and programming them, like the next step in the software defined networking revolution.

这个新范式是围绕一种叫P4的编程语言建立的，它是一种领域特定语言，用来给网络设备编程，并定义单个网络数据包该如何处理。

This whole paradigm was built around a programming language called P4, which is like a domain specific language to program network devices and define how individual network packets should be processed.

公司战略的一大块，就是围绕P4语言构建一个强大的开源生态系统，包括一整套工具链，这些工具链都采用Apache许可证授权。

A big part of the company's strategy was to build a strong open source ecosystem around that P4 programming language with an entire tool chain that was to be licensed under Apache.

比如，有P4的编译器、用来模拟P4程序的软件交换机、面向P4的SDN API等等。

You had a compiler for P4, a software switch to emulate P4 programs, SDN APIs for P4 and so on.

我在Barefoot的工作主要就是维护和参与这个生态系统。

Pretty much my only job at Barefoot was to maintain this ecosystem and contribute to this ecosystem.

这正是公司战略的核心，所以我花了大量时间做开源。

So that was really a big part of the company strategy, that's how I spent so much time doing open source.

所以你为P4语言做了很多贡献，它现在也是Linux基金会的一部分。

So you're contributing a lot to the p four language, is also part of the Linux foundation.

为什么不用现有的语言，反而要开发一门新语言呢？

Why a new language rather than using one of the existing languages?

就像Visual Basic那样。

Like Visual Basic.

就像Visual Basic那样。

Like Visual Basic.

P4是一门领域特定语言。

P four is a domain specific language.

这门语言内置了专为网络和数据包处理设计的语法结构。

You have constructs built into the language which are specific to networking and packet processing.

那时候虽然已经有几篇论文探讨过类似的概念，但还没有一个成熟的编程语言来定义数据包处理流程。

So you had a few papers at the time around similar concepts, but you didn't have a well established programming language to define packet processing pipelines.

不过如果你看P4，它的某些部分确实像C语言。

But if you look at P4, in a way some parts of it are C like.

你可以用标准的运算符进行算术运算。

You can do arithmetic using standard operators.

至少有一部分语法是命令式的。

Some parts of it at least are imperative.

如果你看一些P4的代码片段，它会让你想起C语言。

If you look at some selected snippets of P4, it can remind you of C.

很多人在早期都经历过网络布线、插电缆的时代。

A lot of people will have gone through networking back when it was plugging cables into switches and so on.

但到了云时代，有些人可能根本没接触过软件定义网络，因为现在根本不用操心电缆怎么插了。

If you move on to cloud, some people may have missed the whole software defined networking space because we don't really need to have to worry about how cables are plugged in anymore.

这些事有人专门负责。

We have someone do that.

如果你要向一个对这个领域完全不了解的人解释什么是软件定义网络，你会怎么说？

How would you define software defined networking for someone who's not familiar with the space?

我觉得这个领域有两大变革：虚拟网络和软件定义网络。

I think there are two big revolutions that happen in that space: virtual networking and software defined networking.

我认为这两者有关联，但本质上是不同的。

I would say the two are related, but they're distinct from each other.

虚拟网络指的是为你的虚拟化工作负载创建独立的虚拟网络。

Virtual networking is the ability to create virtual networks for your virtualized workloads.

就像多台虚拟机可以共享同一台物理服务器一样，你也可以定义多个虚拟网络，让它们共用同一套物理网络基础设施。

Just like you can have multiple virtual machines sharing the same physical servers and running on the same physical servers, you can define multiple virtual networks which are going to share the same network physical infrastructure.

同一台服务器上的虚拟机可以属于不同的租户。

Virtual machines on the same server can have different tenants.

虚拟网络还能支持多租户，把各个工作负载隔离开来。

Virtual networking can also support multi tenancy and isolate your workloads.

通常的做法是，为每个租户搭建一种叫覆盖网络的结构，比如用VXLAN这样的技术。

The way you would typically do that, for example, is for each tenant, you can build what we call an overlay network using a technology like VXLAN.

在这种情况下，虚拟交换机就变得非常重要，因为它们要作为覆盖网络的终止点。

And in that case, virtual switches are very important because they're going to act as termination endpoints for your overlay network.

至于下面的物理网络，也就是基础网络架构，其实一点都没变。

As far as the physical network underneath what we can call the underlying network, the underlying network fabric is concerned, nothing has changed.

它根本不知道正在使用VXLAN。

It's not aware that VXLAN is being used.

这些技术都是通过VXLAN之类的覆盖技术来构建虚拟网络的。

Those are building virtual networks using overlay technologies like VXLAN.

所以虚拟交换机变得至关重要，因为那时候还没有任何物理网络设备能支持VXLAN这类新技术，也无法充当它们的终止点。

So virtual switches became very important for that because at the time you didn't have any physical network device that was able to support those new technologies like VXLAN and act as termination endpoints for them.

以前我们可以通过配置交换机的端口来划分VLAN，这就相当于在上面构建了一个虚拟网络。

We used to be able to take a switch and configure certain ports to be on a VLAN, which would mean that effectively it was like, you say, a virtualized network on top.

VXLAN里的这个X是从哪儿来的？

Where does the X come from in VXLAN?

其实虚拟网络这个概念并不是什么新东西。

Actually virtual networking, it's not like a new concept.

就像VLAN里的V，你说了，代表的是虚拟。

Like the V in VLAN, as you say, it stands for virtual.

所以这是一种方法，让你在一个二层网络上做分割，划分给多个租户，每个租户分配一个VLAN ID，彼此网络完全隔离。

So it was a way to say, I have one L2 network and I'm going to splice it, shard it or whatever between multiple tenants and they're all going to receive a VLAN ID and those networks are going to be independent.

但这么做会遇到不少问题。

But then you run into quite a few issues.

首先，VLAN标签的位数太小了。

First, the VLAN tag is quite small.

最多只能支持四千个不同的VLAN。

You can only support four ks different VLANs.

它本质上还是个二层网络。

It's still like an L2 network.

扩展性不太好。

It doesn't scale that well.

而VXLAN则定义了一套新的协议头部。

With VXLAN, you define some new protocol headers.

这些头部字段里，你可以自由填入任何内容。

You can basically put whatever you want in those headers.

VXLAN里的网络标识符有24位长。

The network identifier in VXLAN, it's 24 bits.

这样一来，支持的租户数量远不止四千个了。

So you get way more than just four ks different tenants.

而且因为用了封装技术——这正是VLAN和VXLAN最大的区别——底层网络可以是任何类型。

And then because you are using encapsulation, which is like the big difference between VLAN and VXLAN, your underlay network can be anything.

底层网络也可以是路由型的L3网络架构，VLAN也能做到这一点。

It can be a routed L3 network fabric, which you can do with VLAN.

使用VXLAN，你能获得多得多的灵活性。

You get many more possibilities using VXLAN.

它让你能构建虚拟的L2网络，而底层用什么网络都行，只要服务器之间能互通就行。

It lets you build those virtual L2 networks, but underneath you can have any network as long as you have connectivity between your servers.

对搭建这些网络的人来说，最主要的好处是什么？

What's the main benefit for the people that are setting these up?

为什么要把这些独立的VLAN或者这些分开的模块整合在一起呢？

Why would you want all these separate VLANs or these separate pieces together?

这样能实现隔离。

You get isolation.

每个租户都能拥有自己独立的二层网络。

Each tenant gets basically its own L2 network.

这些二层网络可以完全独立运行。

Those L2 networks can work completely independently.

我觉得在虚拟化环境中，一个重要优势是能够迁移虚拟工作负载。

And I think a big part of it is in the virtual world is the ability to migrate your virtual workloads.

当你在同一个VXLAN内把虚拟机从一台物理服务器迁移到另一台时，完全不用操心底层的物理网络。

When you move a VM from one physical server to another physical server within the same VXLAN, you don't have to worry about the underlay physical network at all.

你根本不需要去修改网络交换机、物理设备、路由器这些的配置。

You actually don't have to go in and change the configuration for your network switches, your physical devices or your routers or whatever.

这些设备都不用动。

You don't have to touch them.

你只需要更新源服务器和目标服务器上的虚拟交换机即可。

You just need to update the virtual switch at the source physical server and at the destination physical server.

basically 就是告诉这两个虚拟交换机 VM 要迁移到哪儿，其他都不用改。

Basically, have to tell those virtual switches where the VM is going, and that's all that needs to change.

物理网络根本察觉不到这次迁移。

The physical network is not aware of the migration at all.

多亏了软件定义网络（SDN），它提供了对交换机——尤其是虚拟交换机——的开放 API，做这种配置变得特别简单，根本不用等什么网络收敛之类的操作。

And thanks to SDN, Software Defined Networking, which gives you open APIs to switches, in particular virtual switches, doing this programming becomes very easy and you don't have to wait for some convergence event or anything.

虚拟工作负载的迁移，这点优势非常明显。

Migration of virtual workloads is a very big advantage there.

我们可以把这个跟 Kubernetes 的网络机制联系起来看。

We can relate this back to how Kubernetes does networking.

运行节点的机器，不管是通过网线连到物理设备上，还是云上的实例，通常都只有一个 IP 地址。

The machines that nodes are run on tend to have a single IP address, whether they be plugged in by a cable on the physical hardware or whether they be a cloud instance.

Kubernetes 很早就提出了一个概念：每个 Pod 都有自己的 IP 地址。

Kubernetes very early on introduced the idea that each pod has its own IP address.

所以我们需要一种方法，让一台机器拥有多个 IP 地址。

So now we need a way of getting multiple IP addresses to a machine.

早期都是通过覆盖网络来实现的。

In the early days that would be achieved by way of an overlay network.

早期的覆盖网络，像 Flannel 和 WeaveNet，是同一个思路的不同实现，还是各有不同？

Are the early overlay networks things like Flannel and WeaveNet are they implementations of the same idea or were they somehow different?

Flannel 使用的是 VXLAN 覆盖网络，基本遵循了我刚才说的那些原则。

Flannel uses a VXLAN overlay network which actually follows the same principles I've described pretty much.

我参与的 Project Antrea 项目，也构建了一个覆盖网络。

The project I'm working on, Project Antrea, also builds an overlay network.

你可以选择不同的覆盖技术，我们也支持不需要覆盖、不需要封装的模式。

You can choose between different overlay technologies and we support modes which do not require overlays and do not require encapsulation.

但在我看来，根据 Kubernetes 的网络模型，为 Pod 构建覆盖网络，仍然是最简单、最通用的方案，适用于各种完全不同的 Kubernetes 集群。

But in my mind, based on how the Kubernetes network model is, building an overlay for pods remain one of the easiest solutions and most portable solutions for completely different types of Kubernetes clusters.

你提到的另一种方案，是路由网络，也就是不使用覆盖网络。

The alternative, as you mentioned, was a routed network where you didn't have an overlay.

Calico 项目早期就具备这个功能，他们用的是 BGP，基本上把每个节点当成交换机来处理。

And that was one of the early features of the Calico project, where I believe they used BGP and basically treated each node like it was a physical switch I guess.

当时宣传说这样性能更好。

That was touted as being better performance.

现在这还是必须的吗？还是说-overlay 网络的性能已经和路由网络差不多了？

Is that still a requirement or are overlay networks now as performant as routed networks?

如果不使用 overlay 网络，也不用封装，就能去掉一些开销，因为封装会带来额外的处理负担。

When you don't use an overlay network and you don't use encapsulation, you eliminate some of the overhead because encapsulation requires additional errors, maybe a bit of additional processing.

实际上，你的有效 MTU（最大传输单元）会变小。

You actually reduce your effective MTU, maximum transmission unit.

每个数据包能传输的数据量就少了一点。

The amount of data you can send in each packet becomes a bit smaller.

但如果 MTU 很大，比如 9K，那这点影响就微不足道了。

It's not going to matter for large MTUs, nine ks MTU, of course, because then the offset becomes small.

你刚才提到，你现在正在做 Project Antrea。

As you mentioned, you're working on Project Antrea right now.

那是什么？

What is that?

我们一直在聊 Kubernetes 网络和现有的项目，但还没真正说清楚 Kubernetes 网络到底指的是什么。

We've been talking about Kubernetes networking and existing projects, but we haven't really defined what Kubernetes networking is about.

如果你去看 Kubernetes 的官方文档，它的网络模型其实非常简单。

If you look at the Kubernetes documentation, the Kubernetes network model, it's very simple.

文档里说，同一个节点上的 Pod 要能跟其他所有节点上的 Pod 直接通信，不能做任何网络地址转换。

What it says is that pods on the node should be able to communicate with pods on all the other nodes without any network address translation.

当目标 Pod 收到源 Pod 的流量时，它能直接通过源 Pod 的 IP 地址识别出对方，而且这个 IP 没有被修改过。

When the destination pod receives traffic from a source pod, it can identify that source pod using the source pod IP which has not been rewritten.

第二点是，节点上的进程，尤其是每个节点上的 Kubelet 组件，必须能跟本节点上的所有 Pod 通信。

And the second thing is that processes on the node and especially the KubeLET Kubernetes agent on each node should be able to communicate with all the pods on that node.

Project Antrea 是一个网络插件，它的任务就是实现并保障这个 Kubernetes 网络模型。

Project Antrea is a network plugin, so it's going to enforce and implement this Kubernetes network model.

不过如果你看看 CNI 生态系统里的网络插件，会发现像 Calico、Cilium 这些主流项目，都不只是满足这些基本要求，它们还提供了更多额外的功能。

But if you look at the CNI ecosystem, the network plugin ecosystem, you can see that all the popular projects like Calico, Cilium and so on, they go beyond just those very simple requirements and they provide you with additional features.

Antrea 就是这样一个 Kubernetes 网络插件。

Project Antrea is one such Kubernetes network plug in.

它不仅实现 Pod 之间的网络互通，还提供了一些在运行集群和部署工作负载时非常实用的额外功能。

It provides networking across pods and it provides some extra features which are useful when running clusters and deploying workloads on clusters.

这个名字挺有意思的。

It has a very interesting name.

是希腊语的吗？

Is it Greek?

这名字是从哪儿来的？

Where did it come from?

你肯定听过计算机领域那句老话：世上最难的事就两件，一是缓存失效，二是给东西起名字。

You know that quote in like computer science which says that there are only two hard things in computer science and it's cache invalidation and naming things.

我觉得，Antrea 这个名字确实是整个项目里最难搞定的部分。

I think it's fair to say that the naming in Antrea was one of the hardest part of the project.

我们当时想延续 Kubernetes 的航海主题，对吧？

We wanted to stay in the Kubernetes naval theme, right?

你有 Kubernetes，有 Helm，有 Prow，这些东西都挺常见的。

You have Kubernetes, you have Helm, you have Prow, all those things.

但如果你看看 Kubernetes 网络领域现有的项目，会发现另一个主题，就是跟网络和网状结构有关。

But at the same time, if you look at existing projects in the Kubernetes networking space, you can see that there is another theme which is around nets and around fabrics.

比如服务网格、Flannel、Weave，等等。

So you have service mesh, you have flannel, you have Weave and so on.

在开源这个项目之前，我们想了很多可能的名字，都是试图把这两个方向结合起来。

We came up with a lot of potential candidates before we open sourced the project, which were kind of at the intersection of those two fields.

然后我们把这些名字发给 VMware 的法务团队，他们因为知识产权的问题，否掉了其中 95 个。

And then we sent them to the VMware legal team, and they cut 95 of them for intellectual property rights concerns or something like this.

那些被否掉的名字，他们现在一个都记不起来了。

They don't remember any of the other candidates.

最后剩下来的，几乎就只有 Antrea 这一个，其实也没啥别的选择了。

But at the end, pretty much Antrea was the only one left, so not much of a choice left there.

这个名字来自一种最古老的渔网，是在芬兰一个叫 Antrea 的小镇发现的。

It's named after one of the oldest fishing nets that was discovered, and it was discovered in a Finnish town called Antrea.

这个名字就是来自那个小镇，项目也是以那张网命名的。

That is named after the town and the project is named after that net.

我觉得那个小镇现在应该已经不存在了。

I think the town doesn't exist anymore.

现在那儿属于俄罗斯，名字也改了。

I think it's a Russian town now with a different name.

名字的由来就是这么回事。

That's the origin of the name.

一开始我们有个内部名称，是个缩写。

Originally we had an internal name which was an acronym.

当时叫OKN，意思是Open Container Networking或者Open Kubernetes Networking。

It was OKN for open container networking or open Kubernetes networking.

VMware的法务团队不太喜欢用缩写，所以……

The VMware legal team doesn't like acronyms much, so

我觉得K可以同时代表Container或者Kubernetes，看当时怎么理解，还挺巧妙的。

I like how the k could stand for both container or Kubernetes depending on this presently.

是的。

Yes.

我们也觉得这样挺好。

We like that.

我正想说，可能还有另一个项目也用了类似的命名方式。

I was about to say, I think there's another project that may also followed that same naming convention.

不止一个项目呢。

More than one project.

Antrea 是一个容器网络接口，也就是 CNI 插件。

Antrea is a container network interface or CNI plugin.

在 Kubernetes 的语境里，CNI 是一个相对较新的网络配置机制。

CNI is a relatively recent in Kubernetes terms system for configuring networking.

CNI 是怎么工作的？为什么它最适合解决你的问题？

How does CNI work and why is it the right thing to implement to solve your problem?

对于不太了解 CNI 的人，我们从头到尾讲一遍。

For people who are not familiar with CNI, want a top to bottom approach.

创建一个 Pod 时会发生什么？

What happens when you create a pod?

用户会通过向 Kubernetes API 提供配置信息，来请求调度一个 Pod。

So the user is going to request for a pod to be scheduled by providing specification to the Kubernetes API.

可以直接这么做。

It can be directly.

也可以通过 Deployment 之类的工具来实现。

It can be through a deployment or something like this.

然后 Kubernetes 的控制平面会把这个 Pod 调度到集群中的某个节点上。

And then the Kubernetes control plane is going to schedule that pod on one of the Kubernetes nodes in your cluster.

调度完成后，它会通知该节点上运行的 Kubelet 组件：好了，你得在这台工作节点上启动这个 Pod，也就是里面的容器。

Once it has done that, it's going to let the KubeLET agent running on the node know about this pod and say, Okay, you need to run that pod, that container essentially on your worker node.

Kubelet 收到这个指令后，就会和容器运行时进行交互。

And once KubeLET gets this information, it's going to interact with the container runtime.

这个交互是通过一个叫 CRI（容器运行时接口）的标准接口完成的。

That's done through a standard interface called CRI, container runtime interface.

然后，容器运行时需要通过另一个标准接口与 Kubernetes 网络插件交互，这个接口叫 CNI，也就是容器网络接口。

And then the container runtime needs to interact with the Kubernetes network plugin through another standard interface which is called CNI or container network interface.

CNI 其实是独立于 Kubernetes 存在的。

And CNI is something that exists outside of Kubernetes really.

它是 CNCF 的项目，定义了规范，维护着一些实现了这个接口的标准插件。

It's a CNCF project, defines the MPI and maintains it and maintains some standard plugins which implement this interface.

这是 Kubernetes 网络功能的关键部分。

It's a key part of Kubernetes networking.

因为 Kubelet 正是通过这种方式通知网络插件如何为特定的 Pod 配置网络，所以所有的 Kubernetes 网络插件都必须实现这个接口。

And because that's how KubeLET eventually interacts with the Kubernetes network plugin to inform it on how to provision networking for a specific pod, all the Kubernetes network plugins have to implement this interface.

这个接口其实非常简单。

It's a very simple interface.

你只需要实现三个方法就行了。

You actually have three different methods.

CNI add，也就是当创建了一个 Pod，就为它配置网络。

CNI add, which is I've created this pod, configures the networking for that pod.

然后是 CNI 删除，意思是我要删除这个容器了，你来做清理工作。

And then you have CNI delete, which is I'm deleting this pod, do your cleanup.

还有 CNI 检查，可以定期调用，确认一切正常。

And then you have CNI check, which can be called periodically to make sure that everything is good.

如果你看容器创建时发生了什么，在 Linux 上通常是创建一个 Veth 对，就像一根虚拟的网线。

If you look at what happens when the pod is created, typically on Linux what that would involve is you create a VSPare, which is like a virtual Ethernet cable.

从一端进去的数据，会从另一端出来。

Everything that goes through one end exits through the other end.

你会创建这个 Veth 对——它由两个互相连接的接口组成，然后把一端放进容器的网络命名空间，另一端连到某个虚拟交换机上。

You're going to create that VSP, which is two interfaces which are pipelined together, and then you're going to put one end of this in the pod's network namespace and attach the other end of it to some kind of virtual switch.

这就是为容器配置网络的方式。

And that's how you provision networking for a pod.

接着给它分配 IP 地址，设置路由，等等。

Then you assign an IP address to it, configure routes, and so on.

剩下的就看你用的网络插件具体怎么实现了。

The rest really depends on your network plug in implementation.

所以现在你需要把这根虚拟网线的另一端连到交换机上。

So now you need to connect the other end of that virtual Ethernet cable to a switch.

你之前提到过一些技术，特别是 Open vSwitch。

You've mentioned before some of the technologies here, and in particular Open vSwitch.

为什么 Antrea 选了 Open vSwitch 这个技术呢？

Why is that the technology that you chose for Antrea?

不同的插件实现方式不一样。

Plug ins work differently.

对吧？

Right?

比如 Calico 就不用网桥，因为它是个基于路由的网络插件。

Calico, for example, doesn't use like a bridge because it's a routed network plug in.

在 Antrea 里，我们确实用了网桥，而且通过 Open vSwitch 这个虚拟交换机来构建 Pod 之间的整体网络。

In Antrea, we do use a bridge, and we use Open vSwitch, a virtual switch, to build that overall network between pods.

我们选择 Open vSwitch 有好几个原因。

And there are multiple reasons why we chose to go with Open vSwitch.

首先，最明显的一点，我们不妨直说，Open vSwitch 得到了 VMware 的大力推动。

One, the obvious one, maybe we should get it out there, that Open vSwitch is very actively promoted by VMware.

它最初由 Nicira 设计，后来被 VMware 收购了。

It was designed by Nicira and then VMware acquired Nicira.

所以很多 Open vSwitch 的贡献者和维护者本身就是 VMware 的员工，用在 Antrea 项目上，我们可以直接依赖他们的专业能力。

So a lot of the Open vSwitch contributors and maintainers or also VMware employees, we can rely on that expertise when we use Open vSwitch for project Antrea.

当然还有其他很多原因，对吧？

There are many other reasons, right?

它是 Linux 基金会旗下的项目。

So it's a Linux Foundation project.

拥有一个非常活跃的开发社区，而且不只限于 VMware 内部。

It has a very strong development community, including outside of VMware.

比如红帽公司就有不少人专门在做 Open vSwitch 的开发。

You have a lot of people at Red Hat, for example, working on Open vSwitch.

它几乎内置在所有主流 Linux 发行版里，包括为云和容器优化的系统。

It's available out of the box in pretty much any Linux distribution, and that's going to include cloud optimized container distributions.

AWS 有一个叫 Bottle Rocket 的系统。

AWS has one called Bottle Rocket.

我觉得 Google 那边叫 Google Container OS。

I think in Google it's Google Container OS.

我没专门查过那个，但一般来说，Open vSwitch 的数据平面在 Linux 上是开箱即用的。

I didn't check that one specifically, but typically Open vSwitch Data Pass is going to be available out of the box in Linux.

所以它在可移植性方面非常关键。

So it's very important for portability.

还有其他原因，对我们来说特别重要的一点是，Open vSwitch 同时支持 Linux 和 Windows。

Other reasons, and this one's very important for us, is that Open vSwitch works both across Linux and Windows.

它的可移植性很强。

It's very portable.

对我们来说这很重要，因为 Windows 上的 Kubernetes 还是落后一些，不过最近几个版本已经慢慢跟上来了。

For us, it's very important because Kubernetes on Windows is still lagging behind, but it's been picking up some momentum in the latest Kubernetes releases.

我们特别需要一种数据平面技术，能让我们在 Linux 和 Windows 工作节点上都支持，而不用把两套实现完全重复做一遍。

We really wanted a data pass technology that enables us to support both Linux worker nodes and Windows worker nodes without completely duplicating efforts across both implementations.

如果你看看其他网络插件，比如用 eBPF 做数据层实现，那 eBPF 在 Windows 上根本用不了。

If you look at other network plug ins, maybe using things like eBPF for their database implementation, well eBPF is not something you can use on Windows.

这是 Linux 专属的技术。

It's a Linux specific technology.

对我们来说，能有一套在 Linux 和 Windows 上几乎完全一致的可移植数据包处理流程，至关重要。

Being able to have that portability, defined packet processing pipeline for Kubernetes that we can use pretty much identically on both Linux and Windows was very important for us.

最后，还有一个很有趣的地方，就是很多硬件厂商都在积极支持 Open vSwitch。

I think finally, very interesting aspect is the fact that you have a lot of hardware vendors which support Open vSwitch actively.

我的意思是，有些厂商生产的物理网卡，本身就内置了对 Open vSwitch 硬件卸载的支持。

By support, I mean that vendors which provide physical network interface cards with support for Open vSwitch offload.

所以在一些对吞吐量和延迟要求很高的裸机场景里，你可以直接把数据包处理任务卸载到网卡上，利用这种硬件加速。

So for some bare metal use cases that require a lot of throughput and low latency between your workloads, you can leverage that hardware offload support and actually offload your packet processing to the network interface cards.

而这一切，正是 Open vSwitch 带来的便利。

And that's something that's really facilitated by Open vSwitch.

网络连接后，Pod 是怎么获取 IP 地址的？

When the network is connected, how does the pod get its IP address?

是通过DHCP分配的吗？

Is it DHCP?

还是别的机制？

Something else?

Kubernetes网络插件里有个叫IP地址管理（IPAM）的概念，每个插件的实现都不一样。

There is that whole notion of IPAM, IP address management around Kubernetes network plugins, and every plugin is going to be different.

在Antrea里，我们现在依赖Kubernetes控制平面里的一个组件，叫节点IPAM控制器。

What we do in Antrea is right now we rely on a part of the Kubernetes control plane called the node IPAM controller.

当你用KubeAdm创建Kubernetes集群时，会指定一个Pod的CIDR地址段。

So when you create your Kubernetes cluster, for example with KubeLmin, you provide what we call a pod CIDR, which is a range of IP addresses.

比如10.0.0.0/16。

For example, 10.0sixteen.

这样就能得到六万多个IP地址。

Then you get 65,000 IP addresses there.

节点IPAM控制器的作用是，每当有新节点加入集群，它就会从这个大地址段里划出一个小子网，分配给这个节点，告诉它：这个节点上创建的Pod，可以从这个子网里选IP地址。

And what the node IPAM controller is going to do is every time a new node joins a cluster, it's going to carve out a smaller subnet, a smaller range of IP addresses out of that bigger range, and it's going to allocate it to that node and say, Okay, for the pods created on that specific node, you can pick an IP address from that range.