What is the connectivity and isolation of flannel?

This article introduces you how the connectivity and isolation of flannel is, the content is very detailed, interested friends can refer to, hope to be helpful to you.

Connectivity and isolation features of flannel.

Flannel network connectivity

Test the connectivity of bbox1 and bbxo2:

Bbox1 can ping to bbox2 in different subnet and analyze the path from bbox1 to bbox2 through traceroute.

Bbox1 and bbox2 are not a subnet, and the packet is sent to the default gateway 10.2.40.1 (docker0).

According to the routing table of host1 (below), the packet is sent to flannel.1.

Flannel.1 encapsulates the packet into VxLAN and sends it to host2 through enp0s8.

Host2 received the packet de-encapsulation and found that the destination address of the packet was 10.2.17.2. According to the routing table (below), the packet was sent to flannel.1 and reached bbox2 through docker0.

In addition, flannel does not have a DNS service, and the container cannot communicate through hostname.

Flannel network isolation

Flannel assigns a separate subnet to each host, but flannel.1 connects these subnet together and can be routed to each other. In essence, flannel forms a large interworking network of independent docker0 containers on each host, which realizes the communication between containers across hosts. Flannel does not provide isolation.

Connectivity between flannel and external network

Because the flannel network uses the default bridge network, the container is connected with the public network in the same way as the bridge network, that is:

Container accesses public network through docker0 NAT

Through host port mapping, the public network can access the container

About how the connectivity and isolation of flannel is shared here, I hope that the above content can be of some help to you, can learn more knowledge. If you think the article is good, you can share it for more people to see.