Docer + calico

etcd

# yum install -y etcd
# nohup etcd -listen-peer-urls http://192.168.243.101:2380 -listen-client-urls http://192.168.243.101:2379,http://127.0.0.1:2379 -advertise-client-urls http://192.168.243.101:2379   &
//启动单节点服务

下载calicoctl

# wget https://github.com/projectcalico/calico-containers/releases/download/v1.0.0-beta/calicoctl
# chmod +x calicoctl

启动calico node

# calicoctl node  --libnetwork
//通过`export ETCD_AUTHORITY=192.168.243.101:2379`指定etcd地址

新建docker网络

# docker network create --driver=calico --ipam-driver=calico test     

启动容器

# docker run --net test --name nginx1 -tid nginx

在marathon中启动容器

{ "id": "my-docker-task", "cpus": 0.1, "mem": 64.0, "container": { "type": "DOCKER", "docker": { "network": "USER", "image": "nginx" } }, "ipAddress": { "networkName": "docker" }, "healthChecks": [{ "protocol": "HTTP", "path": "/", "port": 80, "gracePeriodSeconds": 300, "intervalSeconds": 60, "timeoutSeconds": 20, "maxConsecutiveFailures": 3 }]}

查看地址分配

# calicoctl endpoint show --detailed
+----------+-----------------+-------------+------------------------------------------------------------------+-----------------+-------------------+------------------------------------------------------------------+--------+
| Hostname | Orchestrator ID | Workload ID |                           Endpoint ID                            |    Addresses    |        MAC        |                             Profiles                             | State  |
+----------+-----------------+-------------+------------------------------------------------------------------+-----------------+-------------------+------------------------------------------------------------------+--------+
|  host1   |    libnetwork   |  libnetwork | 5791d20260f59b0c4c4920ac07322b8fc274c29e7e7d448fbab956430124440a | 172.16.1.193/32 | EE:EE:EE:EE:EE:EE | 3a6a51fa55a2a8cd02f53607f4a3419ab9751a5eb3afa10448350fb46697c71d | active |
|  host2   |    libnetwork   |  libnetwork | aa91b803f659b90f0abae4edf223ec99d4ae859ba056f8d2875cc1fad640197f |  172.16.1.0/32  | EE:EE:EE:EE:EE:EE | 3a6a51fa55a2a8cd02f53607f4a3419ab9751a5eb3afa10448350fb46697c71d | active |
|  host3   |    libnetwork   |  libnetwork | 5fccc1a7858654f8795cfca2c27f12ac72a7e3e921c8d5a7beb2b324356e09cf | 172.16.1.128/32 | EE:EE:EE:EE:EE:EE | 3a6a51fa55a2a8cd02f53607f4a3419ab9751a5eb3afa10448350fb46697c71d | active |
+----------+-----------------+-------------+------------------------------------------------------------------+-----------------+-------------------+------------------------------------------------------------------+--------+

设置profile规则

# calicoctl profile fb2d3b8ee1d1160072070cbe82a6ae0a6e63afe72c8f1920613fe660e761615b rule add inbound allow tcp to ports 80,443
//放行80 和 443
# calicoctl profile fb2d3b8ee1d1160072070cbe82a6ae0a6e63afe72c8f1920613fe660e761615b rule add inbound allow icmp type 8
//放行ping