amazon-vpc-cni-k8s

amazon-vpc-cni-k8s

Networking plugin for pod networking in Kubernetes using Elastic Network Interfaces on AWS.

Setup

Download the latest version of the yaml and apply it the cluster.

kubectl apply -f aws-k8s-cni.yaml

Launch kubelet with network plugins set to cni (--network-plugin=cni), the cni directories configured (--cni-config-dir and --cni-bin-dir) and node ip set to the primary IPv4 address of the primary ENI for the instance (--node-ip=$(curl http://169.254.169.254/latest/meta-data/local-ipv4)). It is also recommended to set --max-pods equal to the number of ENIs for the instance type * (the number of IPs per ENI - 1) see to prevent scheduling that exceeds the IP resources available to the kubelet.

The default manifest expects --cni-conf-dir=/etc/cni/net.d and --cni-bin-dir=/opt/cni/bin.

L-IPAM requires following IAM policy:

{
    "Effect": "Allow",
    "Action": [
        "ec2:CreateNetworkInterface",
        "ec2:AttachNetworkInterface",
        "ec2:DeleteNetworkInterface",
        "ec2:DetachNetworkInterface",
        "ec2:DescribeNetworkInterfaces",
        "ec2:DescribeInstances",
        "ec2:ModifyNetworkInterfaceAttribute",
        "ec2:AssignPrivateIpAddresses"
    ],
    "Resource": [
        "*"
    ]
},
{
    "Effect": "Allow",
    "Action": "tag:TagResources",
    "Resource": "*"
},

Building

• make static builds the binary files
• make docker-build uses a docker container (golang:1.10) to build the binaries.
• make docker will create a docker container using the docker-build with the finished binaries, with a tag of amazon/amazon-k8s-cni:latest
• unit-test, lint and vet provide ways to run the respective tests/tools and should be run before submitting a PR.

Components

There are 2 components:

• CNI Plugin, which will wire up host's and pod's network stack when called.
• L-IPAM, which is a long running node-Local IP Address Management (IPAM) daemon, is responsible for:
  • maintaining a warm-pool of available IP addresses, and
  • assigning an IP address to a Pod.

The details can be found in Proposal: CNI plugin for Kubernetes networking over AWS VPC

Contributing

See CONTRIBUTING.md