diff --git a/content/zh/docs/ambient/architecture/traffic-redirection/index.md b/content/zh/docs/ambient/architecture/traffic-redirection/index.md index a38efcc62e..08e5bb8d40 100644 --- a/content/zh/docs/ambient/architecture/traffic-redirection/index.md +++ b/content/zh/docs/ambient/architecture/traffic-redirection/index.md @@ -159,7 +159,6 @@ COMMIT COMMIT {{< /text >}} -The command output shows that additional Istio-specific chains are added to the NAT and Mangle tables in netfilter/iptables within the application pod's network namespace. All TCP traffic coming into the pod is redirected to the ztunnel proxy for ingress processing. If the traffic is plaintext (source port != 15008), it will be redirected to the in-pod ztunnel plaintext listening port 15006. If the traffic is HBONE (source port == 15008), it will be redirected to the in-pod ztunnel HBONE listening port 15008. Any TCP traffic leaving the pod is redirected to ztunnel's port 15001 for egress processing, before being sent out by ztunnel using HBONE encapsulation. 命令输出显示,额外的 Istio 特定链已被添加到应用程序 Pod 网络命名空间内的 netfilter/iptables 中的 NAT 和 Mangle 表中。 所有进入 Pod 的 TCP 流量都会被重定向到 ztunnel 代理进行入口处理。 diff --git a/content/zh/docs/ambient/architecture/traffic-redirection/pod-added-to-ambient.svg b/content/zh/docs/ambient/architecture/traffic-redirection/pod-added-to-ambient.svg index 63b226d3a4..5e20372254 100644 --- a/content/zh/docs/ambient/architecture/traffic-redirection/pod-added-to-ambient.svg +++ b/content/zh/docs/ambient/architecture/traffic-redirection/pod-added-to-ambient.svg @@ -1,21 +1,484 @@ - + + + - - - - + + - Node Network NamespaceAmbientworkloadpodZtunnelpod1. Jump into workload network namespace and write iptables rules2. Notifyztunnelto create workload proxy3. Ztunnel createslistening sockets inside workload network namespaceIstio-cni podResponsibilities:- The istio-cni node agent watches for new pods labeled for ambient- The istio-cni sets up in-Pod iptables redirection rules- Ztunnel owns the sockets and subscribes to istio-cni agent eventsIstio CNI Ambient Pod Configure Flow \ No newline at end of file + + + + + + 节点网络命名空间 + + + + + + + + + + + Ambient + 工作负载 + pod + + + + + + + Ztunnel + pod + + + + + + + + + + + + + + + 1. 跳进工作负载网络命名空间 + 并写入 iptables 规则 + + + + + + + + + + + + + + + 2. 通知 + ztunnel + 创建 + 工作负载代理 + + + + + + + + + + + + + + + 3. Ztunnel + 工作负载网络命名空间内 + 创建侦听套接字 + + + Istio-cni pod + + + Istio CNI Ambient Pod 配置流程 + + 职责:- istio-cni 节点代理监视打了 Ambient 标签的新 Pod- istio-cni 设置 Pod 内 iptables 重定向规则- Ztunnel 拥有套接字并订阅到 istio-cni 代理事件 + diff --git a/content/zh/docs/ambient/architecture/traffic-redirection/traffic-flows-between-pods-in-ambient.svg b/content/zh/docs/ambient/architecture/traffic-redirection/traffic-flows-between-pods-in-ambient.svg index 10bc317656..b00a2e9111 100644 --- a/content/zh/docs/ambient/architecture/traffic-redirection/traffic-flows-between-pods-in-ambient.svg +++ b/content/zh/docs/ambient/architecture/traffic-redirection/traffic-flows-between-pods-in-ambient.svg @@ -1,21 +1,1395 @@ - + + + - - - - + + - Node Network NamespaceZtunnelPodZtunnelContainerDestination Workload PodHBONE Socket 15008Port 80Destination Workload Podiptables1HBONE to 15008(target 80)2To proxy for decap3Source Workload PodOutbound Socket 15001Port 80Source Workload PodiptablesHBONE Inbound ExampleHBONE Outbound Example21Outboundto 5151To proxy for encap3Leaves pod as HBONEon 15008(target 5151)- Everything entering or exiting a pod "hairpins" thru the local ztunnel- All redirection happens WITHIN the pod - nothing on the host side- Looks just like old sidecar to CNIs (and to pods) without actually adding a sidecar - "sidecar with long, long straws"To workloadport \ No newline at end of file + + + + + + 节点网络命名空间 + + + + + + + + + + + + + + + + + + + + + + + + + Ztunnel + Pod + + + + + + + + + + + Ztunnel + 容器 + + + 目标工作负载Pod + + + + + + + HBONE 套接字 15008 + + + + + + + 端口80 + + + + + + + + + 目标 + 工作负载Pod + + + + + + i + p + t + a + b + l + e + s + + + + + + + + + + + + + + + + + + 1 + + + HBONE 15008 + (目标80) + + + + + + + + + + + + + + + + + + 2 + + + 到代理解除封装 + + + + + + + + + + + + + + + + + + 3 + + + + + + + + + + + + + + + + + + + + + + + + + + 源工作负载 Pod + + + + + + + 出站套接字15001 + + + + + + + 端口 + + + + + + + + + + 工作负载Pod + + + + + + i + p + t + a + b + l + e + s + + + HBONE 入站示例 + + + HBONE 出站示例 + + + + + + + + + + + + + + + + + + 2 + + + + + + + + + + + + + + + + + + 1 + + + 出站到5151 + + + 到代理进行封装 + + + + + + + + + + + + + + + + + + 3 + + + 在15008上 + 以HBONE保留Pod + (目标5151) + + + 到工作负载 + 端口 + + - 进出 Pod 探针的一切都流过本地 ztunnel- 所有重定向均发生在 Pod 内,在主机侧什么都没有- 看起来就像是到 CNI(和到 Pod 的)旧 Sidecar,没有实际添加 Sidecar,就像一个 Sidecar 带有很长的稻杆 +