iptables example

.pre-commit-config.yaml

@@ -7,7 +7,6 @@ repos:
   - id: trailing-whitespace
   - id: end-of-file-fixer
   - id: check-yaml
-  - id: check-added-large-files
 
 - repo: https://github.com/pre-commit/pre-commit-hooks
   rev: v3.2.0

common_k8s_manifests/http-echo/deployment.yaml

@@ -0,0 +1,27 @@
+# reference: https://github.com/hashicorp/http-echo
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: http-echo
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: http-echo
+  template:
+    metadata:
+      labels:
+        app: http-echo
+    spec:
+      containers:
+      - name: http-echo
+        image: traefik/whoami
+        ports:
+        - containerPort: 80
+        resources:
+          limits:
+            cpu: "0.1"
+            memory: 50Mi
+          requests:
+            cpu: "0.1"
+            memory: 50Mi

common_k8s_manifests/http-echo/service.yaml

@@ -0,0 +1,13 @@
+# reference: https://github.com/hashicorp/http-echo
+apiVersion: v1
+kind: Service
+metadata:
+  name: http-echo
+spec:
+  selector:
+    app: http-echo
+  ports:
+  - protocol: TCP
+    port: 80
+    targetPort: 80
+  type: ClusterIP

kubernetes/Readme.md

@@ -11,3 +11,4 @@
 | 8 | 쿠버네티스 security | [링크](./security/)|
 | 9 | statefulset + downward API | [링크](./statefulset_podname/)|
 | 9 | statefulset 운영 | [링크](./operate_statefulset/)|
+| 10 | iptables | [링크](./iptables_exporter/)|

kubernetes/iptables_exporter/README.md

@@ -0,0 +1,43 @@
+# 개요
+* kind cluster에서 iptables 시각화
+
+# 실습환경 구축
+* [환경 구축 문서 바로가기](./install/README.md)
+
+# iptables-exporter
+
+* manifest 배포
+
+```sh
+kubectk apply ./manifests/iptables-exporter/
+```
+
+* pod 실행상태 확인
+
+```sh
+$ kubectl -n kube-system get pod -l app=iptables-exporter
+NAME                      READY   STATUS    RESTARTS   AGE
+iptables-exporter-hg4dw   1/1     Running   0          8h
+```
+
+* prometheus targets 확인
+
+![](./imgs/iptables-exporter1.png)
+
+![](./imgs/iptables-exporter2.png)
+
+
+# 실습
+* prometheus에서 iptables-exporter metrics 조회
+
+> iptables_로 시작
+
+![](./imgs/iptables-exporter3.png)
+
+
+# 참고자료
+* https://github.com/madron/iptables-exporter
+* https://openai.com/index/scaling-kubernetes-to-7500-nodes/
+* https://popappend.tistory.com/140
+* https://iximiuz.com/en/posts/laymans-iptables-101/
+* https://kschoi728.tistory.com/261

kubernetes/iptables_exporter/install/Dockerfile-amd

@@ -0,0 +1,16 @@
+# for AMD64
+FROM messense/rust-musl-cross:x86_64-musl as builder
+
+WORKDIR /usr/src/iptables_exporter
+RUN git clone https://github.com/kbknapp/iptables_exporter .
+RUN cargo build --release --target x86_64-unknown-linux-musl
+
+FROM debian:bullseye-slim
+
+RUN apt-get update && apt-get install -y iptables && rm -rf /var/lib/apt/lists/*
+
+COPY --from=builder /usr/src/iptables_exporter/target/x86_64-unknown-linux-musl/release/iptables_exporter /usr/local/bin/iptables_exporter
+
+EXPOSE 9455
+
+ENTRYPOINT ["iptables_exporter", "-t", "iptables", "-t", "iptables-legacy", "-t", "ip6tables"]

kubernetes/iptables_exporter/install/Dockerfile-arm

@@ -0,0 +1,16 @@
+# for AMD64
+FROM messense/rust-musl-cross:aarch64-musl as builder
+
+WORKDIR /usr/src/iptables_exporter
+RUN git clone https://github.com/kbknapp/iptables_exporter .
+RUN cargo build --release --target aarch64-unknown-linux-musl
+
+FROM debian:bullseye-slim
+
+RUN apt-get update && apt-get install -y iptables && rm -rf /var/lib/apt/lists/*
+
+COPY --from=builder /usr/src/iptables_exporter/target/aarch64-unknown-linux-musl/release/iptables_exporter /usr/local/bin/iptables_exporter
+
+EXPOSE 9455
+
+ENTRYPOINT ["iptables_exporter", "-t", "iptables", "-t", "iptables-legacy", "-t", "ip6tables"]

kubernetes/iptables_exporter/install/Makefile

@@ -0,0 +1,22 @@
+IMAGE_NAME=choisunguk/iptables_exporter
+IMAGE_TAG-AMD=v3
+IMAGE_TAG-ARM=v3
+
+up:
+	@kind create cluster --config kind-config.yaml
+	@helm upgrade --install metrics-server -n kube-system -f ./metrics_server_values.yaml metrics-server/metrics-server
+	@helm upgrade --install prometheus-stack -n monitoring --create-namespace -f prometheus_stack_values.yaml prometheus-community/kube-prometheus-stack
+
+down:
+	@kind delete cluster --name iptables-exporter
+
+create-builder:
+	docker buildx create --name mybuilder --use
+
+build-push-amd:
+	docker buildx build --platform linux/amd64 -t $(IMAGE_NAME):amd-${IMAGE_TAG-AMD} -f Dockerfile-amd --push .
+
+build-push-arm:
+	docker build --platform linux/arm64 -t $(IMAGE_NAME):arm-${IMAGE_TAG-ARM} -f Dockerfile-arm --push .
+
+.PHONY: create-builder build-push-amd build-push-arm up down

kubernetes/iptables_exporter/install/README.md

@@ -0,0 +1,43 @@
+# 개요
+* 쿠버네티스에서 iptables를 실습하기 위한 환경 설치
+
+# kind cluster 생성
+
+```sh
+kind create cluster --config kind-config.yaml
+```
+
+# metrics server 설치
+
+```sh
+helm repo add metrics-server https://kubernetes-sigs.github.io/metrics-server/
+helm upgrade --install metrics-server \
+  -n kube-system \
+  -f ./metrics_server_values.yaml \
+  metrics-server/metrics-server
+```
+
+# prometheus-operator stack 설치
+
+```sh
+helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
+helm repo update
+```
+
+```sh
+helm upgrade --install prometheus-stack \
+  -n monitoring --create-namespace \
+  -f prometheus_stack_values.yaml \
+  prometheus-community/kube-prometheus-stack
+```
+
+# prometheus, grafana 접속방법
+
+* prometeus: http://localhost:30090
+* grafana: http://localhost:30080
+
+# kind cluster 삭제
+
+```sh
+kind delete cluster --name iptables-exporter
+```