連接到承租人 virtual 網路的容器端點Connect container endpoints to a tenant virtual network

適用於:Windows Server(以每年次管道)、Windows Server 2016Applies To: Windows Server (Semi-Annual Channel), Windows Server 2016

本主題您顯示如何在連接的容器端點建立透過 Microsoft 軟體定義網路 (SDN) 堆疊現有承租人 virtual 網路。This topic shows you how to connect container endpoints to an existing tenant virtual network created through the Microsoft Software Defined Networking (SDN) stack. 我們將使用l2bridge (也可以l2tunnel) 的 Docker 建立容器網路上的容器主機(承租人)一樣的 Windows libnetwork 增益集可用的網路驅動程式。We will use the l2bridge (and optionally l2tunnel) network driver available with the Windows libnetwork plugin for Docker to create a container network on the container host (tenant) virtual machine.

如中所述容器網路多個網路驅動程式都可以透過 windows Docker msdn 主題。As documented in the Container Networking topic on MSDN, multiple network drivers are available through Docker on Windows. 最適合 SDN 的驅動程式是l2bridgel2tunnelThe drivers most suitable for SDN are l2bridge and l2tunnel. 這兩個驅動程式,每個容器端點會在與容器主機(承租人)一樣相同 virtual 子網路中。For both drivers, each container endpoint is in the same virtual subnet as the container host (tenant) virtual machine. IP 位址的容器端點會動態指派來主機網路服務 (HNS) 透過私人雲端增益集。The IP addresses for container endpoints are assigned dynamically by the Host Networking Service (HNS) through the private cloud plugin. 容器端點具有獨特的 IP 位址,但分享的容器主機(承租人)一樣層級 2 位址轉譯因為相同的 MAC 地址。The container endpoints have unique IP addresses but share the same MAC address of the container host (tenant) virtual machine due to Layer-2 address translation. 網路原則 (例如:Acl、封裝,並 QoS) 這些容器端點會執行實體 HYPER-V 主機時收到 Network Controller 的及上層管理系統所述。Network policy (for example: ACLs, encapsulation, and QoS) for these container endpoints are enforced in the physical Hyper-V host as received by the Network Controller and defined in upper-layer management systems. 有會稍微不同l2bridgel2tunnel下面會解釋驅動程式。There is a slight difference between the l2bridge and l2tunnel drivers which is explained below.

  • L2 橋接器-上相同的容器主機一樣,並在相同的子網路中的容器端點能所有的網路流量橋接 HYPER-V virtual 開關切換至中。L2 Bridge - container endpoints that reside on the same container host virtual machine and are in the same subnet have all network traffic bridged within the Hyper-V virtual switch. 容器端點的 Vm 的不同的容器主機或哪些是不同的子網路中有他們流量轉寄給實體 HYPER-V 主機。Container endpoints which reside on different container host VMs or which are in different subnets have their traffic forwarded to the physical Hyper-V host. 因為容器主機上並在相同的子網路中間網路流量執行流向實體主機,會不執行任何網路原則。Since network traffic between containers on the same host and in the same subnet do not flow to the physical host, no network policy is enforced. 跨主機或跨子網路容器網路流量僅會套用原則。Policy is only applied for cross-host or cross-subnet container network traffic.

  • L2 通道 - 所有兩個容器端點間網路流量轉寄給實體 HYPER-V 主機無論主機或子網路。L2 Tunnel - all network traffic between two container endpoints is forwarded to the physical Hyper-V host regardless of host or subnet. 跨子網路和跨主機的網路流量被執行網路原則。Network policy is enforced for both cross-subnet and cross-host network traffic.

注意

這些網路功能模式連接 windows 容器端點承租人 virtual 網路 Azure 公用雲端中無法運作These networking modes do not work for connecting windows container endpoints to a tenant virtual network in Azure public cloud

PrerequistesPrerequistes

  • 使用網路控制器 SDN 基礎結構部署An SDN infrastructure with the Network Controller has been deployed
  • 已建立承租人 virtual 網路A tenant virtual network has been created
  • Windows 容器功能、與安裝 Docker HYPER-V 功能部署承租人一樣A tenant virtual machine has been deployed with the Windows Container feature enabled, Docker installed, and Hyper-V feature enabled

注意

巢的模擬和公開模擬延伸模組並不需要使用 HYPER-V 容器 HyperV 功能不需要安裝數個二進位檔 l2bridge 和 l2tunnel 網路Nested virtualization and exposing virtualization extensions is not required unless using Hyper-V Containers The HyperV feature is required to install several binaries for l2bridge and l2tunnel networks

# To install HyperV feature without checks for nested virtualization
dism /Online /Enable-Feature /FeatureName:Microsoft-Hyper-V /All 

工作流程Workflow

  1. 加入現有的 VM NIC 資源 Network Controller 透過多個 IP 設定(HYPER-V 主機)Add multiple IP configurations to an existing VM NIC resource through Network Controller (Hyper-V Host)
  2. 讓上的容器端點配置 CA IP 位址主機的網路 proxy(HYPER-V 主機)Enable the network proxy on the host to allocate CA IP Addresses for container endpoints (Hyper-V Host)
  3. 安裝私人雲端插件,以將 CA IP 位址指派給容器端點(容器主機 VM)Install the private cloud plug-in to assign CA IP addresses to container endpoints (Container Host VM)
  4. 建立l2bridgel2tunnel網路使用 docker (容器主機 VM)Create an l2bridge or l2tunnel network using docker (Container Host VM)

注意

多個 IP 設定不支援透過 System Center 一樣管理員建立 VM NIC 資源。Multiple IP configurations is not supported on VM NIC resources created through System Center Virtual Machine Manager. 建議的類部署建立 VM NIC 退出 band 使用網路控制器 PowerShell 資源。It is recommended for these deployments types that you create the VM NIC resource out of band using Network Controller PowerShell.

1.新增多個 IP 設定1. Add Multiple IP Configurations

針對此範例,我們假設 VM 而承租人一樣的已經有一 IP 設定的 IP 位址的 192.168.1.9 和 192.168.1.0 24 IP 子網路中的 'VNet1' VNet 資源 ID 和 VM 子網路資源的 'Subnet1' 已連接。For this example, we assume that the VM NIC of the tenant virtual machine already has one IP configuration with IP address of 192.168.1.9 and is attached to a VNet Resource ID of 'VNet1' and VM Subnet Resource of 'Subnet1' in the 192.168.1.0/24 IP subnet. 我們會將 192.168.1.101-192.168.1.110 10 容器 IP 位址。We will add 10 IP addresses for containers from 192.168.1.101 - 192.168.1.110.

Import-Module NetworkController

# Specify Network Controller REST IP or FQDN
$uri = "<NC REST IP or FQDN>"
$vnetResourceId = "VNet1"
$vsubnetResourceId = "Subnet1"

$vmnic= Get-NetworkControllerNetworkInterface -ConnectionUri $uri | where {$_.properties.IpConfigurations.Properties.PrivateIPAddress -eq "192.168.1.9" }
$vmsubnet = Get-NetworkControllerVirtualSubnet -VirtualNetworkId $vnetResourceId -ResourceId $vsubnetResourceId -ConnectionUri $uri

# For this demo, we will assume an ACL has already been defined; any ACL can be applied here
$allowallacl = Get-NetworkControllerAccessControlList -ConnectionUri $uri -ResourceId "AllowAll"


foreach ($i in 1..10)
{
    $newipconfig = new-object Microsoft.Windows.NetworkController.NetworkInterfaceIpConfiguration
    $props = new-object Microsoft.Windows.NetworkController.NetworkInterfaceIpConfigurationProperties

    $resourceid = "IP_192_168_1_1"
    if ($i -eq 10) 
    {
        $resourceid += "10"
        $ipstr = "192.168.1.110"
    }
    else
    {
        $resourceid += "0$i"
        $ipstr = "192.168.1.10$i"
    }

    $newipconfig.ResourceId = $resourceid
    $props.PrivateIPAddress = $ipstr    

    $props.PrivateIPAllocationMethod = "Static"
    $props.Subnet = new-object Microsoft.Windows.NetworkController.Subnet
    $props.Subnet.ResourceRef = $vmsubnet.ResourceRef
    $props.AccessControlList = new-object Microsoft.Windows.NetworkController.AccessControlList
    $props.AccessControlList.ResourceRef = $allowallacl.ResourceRef

    $newipconfig.Properties = $props
    $vmnic.Properties.IpConfigurations += $newipconfig
}

New-NetworkControllerNetworkInterface -ResourceId $vmnic.ResourceId -Properties $vmnic.Properties -ConnectionUri $uri

2.可讓網路 Proxy2. Enable the Network Proxy

ConfigureMCNP.ps1ConfigureMCNP.ps1

此指令碼執行HYPER-V 主機,裝載容器主機(承租人)一樣,以便網路 proxy 配置多個 IP 位址的容器主機一樣。Run this script on the Hyper-V Host which is hosting the container host (tenant) virtual machine to enable the network proxy to allocate multiple IP addresses for the container host virtual machine.

PS C:\> ConfigureMCNP.ps1

3.安裝外掛程式的私人雲端3. Install Private Cloud plug-in

InstallPrivateCloudPlugin.ps1InstallPrivateCloudPlugin.ps1

執行中的指令碼容器主機(承租人)一樣允許主機網路服務 (HNS) 以與網路 proxy HYPER-V 主機上。Run this script inside the container host (tenant) virtual machine to allow the Host Networking Service (HNS) to communicate with the network proxy on the Hyper-V Host.

PS C:\> InstallPrivateCloudPlugin.ps1

4。建立l2bridge容器網路 4。4. Create an l2bridge Container Network

容器主機(承租人)一樣使用docker network create以建立 l2bridge 網路的命令On the container host (tenant) virtual machine use the docker network create command to create an l2bridge network

# Create the container network
C:\> docker network create -d l2bridge --subnet="192.168.1.0/24" --gateway="192.168.1.1" MyContainerOverlayNetwork

# Attach a container to the MyContainerOverlayNetwork 
C:\> docker run -it --network=MyContainerOverlayNetwork <image> <cmd>

注意

靜態 IP 指派不支援的l2bridgel2tunnel容器網路時搭配 Microsoft SDN 堆疊。Static IP assignment is not supported with l2bridge or l2tunnel container networks when used with the Microsoft SDN Stack.

更多的資訊More information

如需有關部署 SDN 基礎結構 infortation,部署軟體定義網路基礎架構For more infortation about deploying an SDN infrastructure, see Deploy a Software Defined Network Infrastructure.