Kubernetes Service/Ingress/CNI 体系

apiVersion: v1
kind: Service
metadata:
  name: my-service
spec:
  type: ClusterIP
  selector:
    app: nginx
  ports:
  - port: 80          # Service 端口
    targetPort: 8080  # 容器端口
    protocol: TCP

apiVersion: v1
kind: Endpoints
metadata:
  name: my-service
subsets:
- addresses:
  - ip: 10.244.1.5
    nodeName: node-1
    targetRef:
      kind: Pod
      name: nginx-1
  - ip: 10.244.2.3
    nodeName: node-2
    targetRef:
      kind: Pod
      name: nginx-2
  ports:
  - port: 8080
    protocol: TCP

apiVersion: discovery.k8s.io/v1
kind: EndpointSlice
metadata:
  name: my-service-abc123
  labels:
    kubernetes.io/service-name: my-service
addressType: IPv4
endpoints:
- addresses: ["10.244.1.5"]
  nodeName: node-1
  conditions:
    ready: true
- addresses: ["10.244.2.3"]
  nodeName: node-2
  conditions:
    ready: true
ports:
- port: 8080
  protocol: TCP

// pkg/controller/endpointslice/endpointslice_controller.go
func (c *Controller) syncService(logger klog.Logger, key string) error {
    service, err := c.serviceLister.Services(namespace).Get(name)

    // 1. 获取 Service 选择的所有 Pod
    pods, err := c.podLister.Pods(namespace).List(labels.SelectorFromSet(service.Spec.Selector))

    // 2. 按 kubernetes.io/service-name + endpointslice.kubernetes.io/managed-by
    //    标签列出现有的 EndpointSlices
    endpointSlices, err := c.endpointSliceLister.EndpointSlices(namespace).List(esLabelSelector)

    // 3. 计算期望的 Slice，对比现有 Slice，执行增删改
    //    （计算逻辑封装在 staging/src/k8s.io/endpointslice/reconciler.go 的 Reconciler 中）
    err = c.reconciler.Reconcile(logger, service, pods, endpointSlices, lastChangeTriggerTime)
    return nil
}

// pkg/proxy/iptables/proxier.go
func (proxier *Proxier) syncProxyRules() {
    // 1. 为每个 Service 创建 KUBE-SVC-XXXX 链及跳转规则
    for svcName, svcInfo := range proxier.serviceMap {
        // ...（KUBE-SERVICES → KUBE-SVC-XXXX 跳转）

        // 2. 为该 Service 的所有 Endpoint 生成 KUBE-SEP-XXXX 链与 DNAT 规则
        proxier.writeServiceToEndpointRules(natRules, svcPortNameString, svcInfo, svcChain, endpoints, args)
    }
}

// pkg/proxy/ipvs/proxier.go
func (proxier *Proxier) syncProxyRules() {
    // 1. 为每个 Service 创建 IPVS 虚拟服务
    for svcName, svcInfo := range proxier.serviceMap {
        vs := &utilipvs.VirtualServer{Address: svcInfo.ClusterIP, Port: svcInfo.Port /* ... */}
        err = proxier.ipvs.AddVirtualServer(vs)

        // 2. 为每个 Endpoint 添加真实服务器
        for _, ep := range svcInfo.Endpoints {
            rs := &utilipvs.RealServer{Address: ep.IP, Port: ep.Port}
            err = proxier.ipvs.AddRealServer(vs, rs)
        }
    }
}

// pkg/proxy/nftables/proxier.go
func (proxier *Proxier) syncProxyRules() {
    // 使用 nftables 替代 iptables
    // 优势：原子更新、性能更好、规则更简洁
}

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  ingressClassName: nginx
  rules:
  - host: foo.example.com
    http:
      paths:
      - path: /bar
        pathType: Prefix
        backend:
          service:
            name: service1
            port:
              number: 80
      - path: /baz
        pathType: Prefix
        backend:
          service:
            name: service2
            port:
              number: 80
  tls:
  - hosts:
    - foo.example.com
    secretName: tls-secret

apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: example-class
spec:
  controllerName: example.com/gateway-controller
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: example-gateway
spec:
  gatewayClassName: example-class
  listeners:
  - name: http
    protocol: HTTP
    port: 80
    allowedRoutes:
      namespaces:
        from: All
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: example-route
spec:
  parentRefs:
  - name: example-gateway
  hostnames:
  - "foo.example.com"
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /bar
    backendRefs:
    - name: service1
      port: 80

// github.com/containernetworking/cni/libcni/api.go
type CNI interface {
    AddNetworkList(ctx context.Context, net *NetworkConfigList, rt *RuntimeConf) (types.Result, error)
    CheckNetworkList(ctx context.Context, net *NetworkConfigList, rt *RuntimeConf) error
    DelNetworkList(ctx context.Context, net *NetworkConfigList, rt *RuntimeConf) error
    GetNetworkListCachedResult(net *NetworkConfigList, rt *RuntimeConf) (types.Result, error)
    GetNetworkListCachedConfig(net *NetworkConfigList, rt *RuntimeConf) ([]byte, *RuntimeConf, error)

    // 单个网络的 Add/Del/Check，以及
    // ValidateNetworkList、GCNetworkList、GetStatusNetworkList 等
    AddNetwork(ctx context.Context, net *NetworkConfig, rt *RuntimeConf) (types.Result, error)
    CheckNetwork(ctx context.Context, net *NetworkConfig, rt *RuntimeConf) error
    DelNetwork(ctx context.Context, net *NetworkConfig, rt *RuntimeConf) error
    // ...
}

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all-except-same-namespace
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: my-namespace
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          name: my-namespace

apiVersion: v1
kind: ConfigMap
metadata:
  name: coredns
  namespace: kube-system
data:
  Corefile: |
    .:53 {
        errors
        health
        kubernetes cluster.local in-addr.arpa ip6.arpa {
            pods insecure
            fallthrough in-addr.arpa ip6.arpa
        }
        prometheus :9153
        forward . /etc/resolv.conf
        cache 30
        loop
        reload
        loadbalance
    }

apiVersion: kubeproxy.config.k8s.io/v1alpha1
kind: KubeProxyConfiguration
mode: ipvs
ipvs:
  scheduler: lc  # 最少连接

# 默认已启用，检查状态
kubectl get endpointslices -A

# 默认拒绝所有 ingress
kubectl apply -f deny-all.yaml

# 按需开放
kubectl apply -f allow-specific.yaml

# 安装 Gateway API CRD（standard channel，版本以最新发布为准）
kubectl apply --server-side -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.6.1/standard-install.yaml