amshinde

The netfilter hooks in the kernel and where they hook in the packet flow

The figure below calls out

• The netfilter hooks
• The order of table traversal

amshinde

Setting up a overlay network using point to multi-point GRE tunnels

Multi-Point GRE Tunnels

Typically VxLAN is used to setup a point to multi-point overlay networks. However GRE also offers a similar capability which is often not heavily used. This document calls out how to setup an effient overlay mesh network to link up multiples sits together using multi point GRE tunnels.

Setup

The setup used in this case assumes there is a need to link three sites hosting three different subnets together using a simple overlay mesh network.

amshinde

#side by side terminal diff
git difftool -y -x "sdiff -w $COLUMNS" | less

amshinde

curl -O https://storage.googleapis.com/golang/go1.11.2.linux-amd64.tar.gz
tar -xvf go1.11.2.linux-amd64.tar.gz
sudo mv go /usr/local
sudo ln -sf /usr/local/go/bin/go /usr/bin/go

vim ~/.bashrc
export GOPATH=$HOME/go
export PATH=$PATH:/usr/local/go/bin:$GOPATH/bin

amshinde

sudo -E qemu-lite-system-x86_64 -machine pc,accel=kvm,kernel_irqchip -cpu host      -m 2G,slots=3,maxmem=16G -object memory-backend-file,id=mem,size=2G,mem-path=/dev/shm,share=on -numa node,memdev=mem        -device virtio-serial-pci,id=serial0 -device virtio-blk-pci,drive=image -drive if=none,id=image,file=kata-containers.img,format=raw   -kernel vmlinuz.container -append 'console=ttyS0 console=hvc0 iommu=false root=/dev/vda1 rw rootfstype=ext4 data=ordered rcupdate.rcu_expedited=1 tsc=reliable no_timer_check loglevel=7 apic=verbose noapic noapictimer virtio_mmio.device=0x200@0x540000000:14' -smp 2,maxcpus=4 -device virtconsole,chardev=charconsole0,id=console0 -chardev stdio,id=charconsole0 -monitor telnet:127.0.0.1:55555,server,nowait -device isa-debugcon,iobase=0x402,chardev=debugcon -chardev file,path=/tmp/debug-log,id=debugcon -device isa-debugcon,iobase=0x3f8,chardev=serialcon -chardev file,path=/tmp/serial-log,id=serialcon
[sudo] password for amshinde: 
[    0.223920] brd: module loaded
[    0.226454] 

amshinde

Beta support for raw block volumes is available in K8s 1.13: https://kubernetes.io/blog/2019/03/07/raw-block-volume-support-to-beta/

The following in-tree volumes types support raw blocks:

• AWS EBS
• Azure Disk
• Cinder

amshinde

Resources for guest time sync:

• https://opensource.com/article/17/6/timekeeping-linux-vms
• https://zshisite.wordpress.com/2017/10/25/sync-your-cloud-with-ptp/
• http://versatic.net/tracecompass/synchronization/2018/01/15/synchronization-and-ntp.html

amshinde

Getting docker to work with corporate proxy

Docker's conf file /etc/docker/daemon.json :

{  
   "dns":[  
      "10.248.2.1",
      "10.22.224.196"
   ],
 "dns-search":[ 

amshinde

Create a process with its own network and pid namespace

$ unshare --user --map-root-user --net --mount
[root@incensed-gawain ~]# echo $$
2646

Run the slirp process on the host

amshinde

https://software.intel.com/sites/default/files/managed/c5/15/vt-directed-io-spec.pdf

• Legacy pin interrupts

— For devices that use legacy methods for interrupt routing (such as either through direct wiring to the I/OxAPIC input pins, or through INTx messages), the I/OxAPIC hardware generates the interrupt-request transaction. To identify the source of interrupt requests generated by I/OxAPICs, the interrupt-remapping hardware requires each I/OxAPIC in the platform (enumerated through the ACPI Multiple APIC Descriptor Tables (MADT)) to include a unique 16-bit source-id in its requests. BIOS reports the source-id for these I/OxAPICs via ACPI