路由与封装

// felix/dataplane/linux/ipip_mgr.go:35-54
type ipipManager struct {
    hostname      string
    ipVersion     uint8
    routeProtocol netlink.RouteProtocol
    routeMgr      *routeManager
    dpConfig      Config

    // 隧道设备信息
    tunnelDevice    string
    tunnelDeviceMTU int

    // 主机 IP 映射
    activeHostnameToIP map[string]string
}

func newIPIPManager(
    mainRouteTable routetable.Interface,
    tunnelDevice string,
    ipVersion uint8,
    mtu int,
    dpConfig Config,
    opRecorder logutils.OpRecorder,
) *ipipManager {
    m := &ipipManager{
        activeHostnameToIP: map[string]string{},
        hostname:           dpConfig.Hostname,
        tunnelDevice:       tunnelDevice,  // 默认 "tunl0"
        tunnelDeviceMTU:    mtu,
        // ...
    }
    return m
}

// felix/dataplane/linux/ipip_mgr.go
func (m *ipipManager) tunnelRoute(cidr ip.CIDR, msg *proto.RouteUpdate) *routetable.Target {
    // 获取远程节点的 IP
    tunnelIP := m.activeHostnameToIP[msg.DstNodeName]
    if tunnelIP == "" {
        return nil
    }

    // 生成通过 IPIP 隧道的路由
    return &routetable.Target{
        Type:   routetable.TargetTypeViaGateway,
        CIDR:   cidr,
        GW:     ip.FromString(tunnelIP),
        Device: m.tunnelDevice,  // tunl0
        Flags:  netlink.FLAG_ONLINK,
    }
}

# IPPool 配置
apiVersion: projectcalico.org/v3
kind: IPPool
metadata:
  name: default-ipv4-ippool
spec:
  cidr: 10.244.0.0/16
  ipipMode: Always    # Always: 总是使用 IPIP
                      # CrossSubnet: 仅跨子网时使用
                      # Never: 不使用 IPIP
  natOutgoing: true

// felix/dataplane/linux/vxlan_mgr.go:40-71
type vxlanManager struct {
    hostname string
    routeMgr *routeManager
    fdb      VXLANFDB

    ipsetsDataplane dpsets.IPSetsDataplane
    ipSetMetadata   ipsets.IPSetMetadata

    // VTEP（VXLAN Tunnel Endpoint）信息
    vtepsByNode map[string]*proto.VXLANTunnelEndpointUpdate
    myVTEP      *proto.VXLANTunnelEndpointUpdate

    // VXLAN 配置
    vxlanDevice string  // 默认 "vxlan.calico"
    vxlanID     int     // VNI，默认 4096
    vxlanPort   int     // UDP 端口，默认 4789
    ipVersion   uint8
    mtu         int

    vtepsDirty bool
}

func (m *vxlanManager) OnUpdate(msg interface{}) {
    switch msg := msg.(type) {
    case *proto.VXLANTunnelEndpointUpdate:
        // 更新远程 VTEP 信息
        m.vtepsByNode[msg.Node] = msg
        m.vtepsDirty = true

        if msg.Node == m.hostname {
            // 更新本地 VTEP
            m.myVTEPLock.Lock()
            m.myVTEP = msg
            m.myVTEPLock.Unlock()
        }

    case *proto.VXLANTunnelEndpointRemove:
        delete(m.vtepsByNode, msg.Node)
        m.vtepsDirty = true
    }
}

// felix/vxlanfdb/vxlanfdb.go
type VTEP struct {
    TunnelIP   net.IP
    TunnelMAC  net.HardwareAddr
    HostIP     net.IP
    ParentDev  string
}

func (v *VXLANFDB) SetVTEPs(vteps []VTEP) {
    // 清理旧的 FDB 条目
    for mac := range v.currentFDBByMAC {
        if !newVTEPs[mac] {
            v.deleteFDB(mac)
        }
    }

    // 添加新的 FDB 条目
    for _, vtep := range vteps {
        v.addFDB(vtep.TunnelMAC, vtep.HostIP)
    }
}

# IPPool 配置
apiVersion: projectcalico.org/v3
kind: IPPool
metadata:
  name: default-ipv4-ippool
spec:
  cidr: 10.244.0.0/16
  vxlanMode: Always   # Always: 总是使用 VXLAN
                      # CrossSubnet: 仅跨子网时使用
                      # Never: 不使用 VXLAN
  natOutgoing: true

// felix/dataplane/linux/route_mgr.go:38-79
type routeManager struct {
    routeTable           routetable.Interface
    routeClassTunnel     routetable.RouteClass
    routeClassSameSubnet routetable.RouteClass
    ipVersion            uint8
    ippoolType           proto.IPPoolType

    // 设备信息
    parentDevice     string
    parentDeviceAddr string
    tunnelDevice     string
    tunnelDeviceMTU  int
    tunnelRouteFn    func(ip.CIDR, *proto.RouteUpdate) *routetable.Target

    // 路由状态
    routesByDest    map[string]*proto.RouteUpdate
    localIPAMBlocks map[string]*proto.RouteUpdate

    hostname       string
    routesDirty    bool
    routeProtocol  netlink.RouteProtocol
}

// felix/dataplane/linux/route_mgr.go:159-200
func (m *routeManager) OnUpdate(protoBufMsg interface{}) {
    switch msg := protoBufMsg.(type) {
    case *proto.RouteUpdate:
        cidr, err := ip.CIDRFromString(msg.Dst)
        if err != nil || m.ipVersion != cidr.Version() {
            return
        }

        // 清理旧路由
        m.deleteRoute(msg.Dst)

        // 处理远程 IPAM Block
        if isType(msg, proto.RouteType_REMOTE_WORKLOAD) && msg.IpPoolType == m.ippoolType {
            m.routesByDest[msg.Dst] = msg
            m.routesDirty = true
        }

        // 处理远程隧道端点路由
        if isRemoteTunnelRoute(msg, m.ippoolType) {
            m.routesByDest[msg.Dst] = msg
            m.routesDirty = true
        }

        // 处理本地 IPAM Block
        if m.routeIsLocalBlock(msg) {
            m.localIPAMBlocks[msg.Dst] = msg
            m.routesDirty = true
        }

    case *proto.RouteRemove:
        m.deleteRoute(msg.Dst)
    }
}

func (m *routeManager) CompleteDeferredWork() error {
    if !m.routesDirty {
        return nil
    }

    // 确保隧道设备存在并配置正确
    err := m.ensureTunnelDevice()
    if err != nil {
        return err
    }

    // 应用路由更新
    for dst, route := range m.routesByDest {
        cidr := ip.MustParseCIDROrIP(dst)
        target := m.tunnelRouteFn(cidr, route)
        if target != nil {
            m.routeTable.SetRoutes(m.routeClassTunnel, cidr, []routetable.Target{*target})
        }
    }

    // 处理同子网路由（不需要封装）
    for dst, route := range m.routesByDest {
        if m.isSameSubnet(route) {
            cidr := ip.MustParseCIDROrIP(dst)
            target := m.sameSubnetRoute(cidr, route)
            m.routeTable.SetRoutes(m.routeClassSameSubnet, cidr, []routetable.Target{*target})
        }
    }

    m.routesDirty = false
    return nil
}

apiVersion: projectcalico.org/v3
kind: IPPool
metadata:
  name: default-ipv4-ippool
spec:
  cidr: 10.244.0.0/16
  ipipMode: CrossSubnet  # 或 vxlanMode: CrossSubnet
  natOutgoing: true

func (m *routeManager) isSameSubnet(route *proto.RouteUpdate) bool {
    // 获取本地节点的 IP
    localIP := net.ParseIP(m.parentDeviceAddr)
    if localIP == nil {
        return false
    }

    // 获取远程节点的 IP
    remoteIP := net.ParseIP(route.DstNodeIp)
    if remoteIP == nil {
        return false
    }

    // 判断是否在同一子网
    localSubnet := getSubnet(localIP, m.subnetMask)
    remoteSubnet := getSubnet(remoteIP, m.subnetMask)

    return localSubnet.String() == remoteSubnet.String()
}

// felix/dataplane/linux/int_dataplane.go:429-435
const (
    ipipMTUOverhead        = 20
    vxlanMTUOverhead       = 50
    vxlanV6MTUOverhead     = 70
    wireguardMTUOverhead   = 60
    wireguardV6MTUOverhead = 80
)

func determinePodMTU(config Config) int {
    // 从主机 MTU 减去封装开销
    mtu := config.hostMTU

    if config.IPIPEnabled {
        mtu -= ipipMTUOverhead
    } else if config.VXLANEnabled {
        mtu -= vxlanMTUOverhead
    } else if config.WireguardEnabled {
        mtu -= wireguardMTUOverhead
    }

    return mtu
}

# FelixConfiguration
apiVersion: projectcalico.org/v3
kind: FelixConfiguration
metadata:
  name: default
spec:
  # 自动检测主机 MTU
  mtuIfacePattern: "^(en|eth).*"

  # 或手动配置
  # ipipMTU: 1440      # IPIP 隧道 MTU
  # vxlanMTU: 1410     # VXLAN 隧道 MTU