Antrea: A Deep Dive into Kubernetes Network Plug-In

Antrea is a Kubernetes (K8s) network plug-in that offers high performance, network policy, and observability. It is suitable for K8 clusters of various sizes and needs.

Photo by Bennet Robin Fabian on Unsplash

In this article, I will provide an in-depth analysis of Antrea’s core concepts, advantages, and disadvantages. I will also cover its usage scenarios and installation steps. By the end of this article, you will have a better understanding of Antrea and be able to utilize it to manage and protect your containerized applications.

The key concepts of Antrea include:

Antrea is an open-source K8s network plug-in, which is designed to provide high-performance, secure, and scalable network connections and network policies. The following are the core concepts of Antrea:

1. CNI plug-in: Antrea is a CNI (Container Network Interface) plug-in, which is responsible for managing the network interface and communication of containers in the K8s cluster. It implements the K8s network model, enabling containers to communicate with each other transparently.
2. Open vSwitch (OVS): Antrea uses OVS as the data plane, which is a high-performance virtual switch that handles the forwarding of network packets. OVS provides a programmable data plane that enables Antrea to implement advanced network functions.
3. Network Policies: Antrea supports network policies for K8s, allowing administrators to define which containers can communicate with which other containers and how security is implemented. This helps ensure network security and isolation within the cluster.
4. Service proxy: Antrea also provides a service proxy function that enables K8s services to communicate with backend Pods transparently without exposing the Pod’s IP address.

Advantages of Antrea

1. Lightweight: Antrea’s design is very lightweight, takes up less resources, and has little impact on system performance.
2. Easy to configure: Antrea provides simple and easy-to-use configuration files to help users get started quickly.
3. High performance: Antrea uses efficient data structures and algorithms to ensure good performance.
4. Supports multiple protocols: Antrea supports multiple protocols such as TCP and UDP to meet the needs of different scenarios.
5. Scalability: Antrea provides a rich API to facilitate users’ secondary development and customization.
6. Observability: Based on Calico, Antrea can provide rich network observability, helping administrators better understand network conditions.

Disadvantages of Antrea

1. Limited functions: Compared with other mature k8s network plug-ins, Antrea has relatively few functions and may not meet the needs of some complex scenarios.
2. Limited community support: Since Antrea is relatively new, its community support and documentation may not be as rich as other mature plugins.
3. Complexity: Antrea can be somewhat complex to set up and configure for beginners, especially if advanced network strategies are required.
4. OVS dependency: Antrea relies on OVS as the data plane, which may introduce additional complexity in some environments.

Usage scenarios

Antrea is suitable for the following scenarios:

1. Microservice architecture: In microservice architecture, communication and load balancing between services are very important. Antrea can help realize automatic discovery and load balancing of services, improving system scalability and availability.
2. Containerized deployment: In containerized deployment scenarios, network plug-ins are an essential component. Antrea can help containers communicate with each other and connect to the external network.
3. Edge computing: In edge computing scenarios, services are widely distributed and require efficient communication and load balancing. Antrea can meet these needs and improve the utilization of edge nodes.
4. Large-scale clusters: Antrea is a good choice when you need high-performance container communication in large-scale K8s clusters.
5. Network policy needs: Antrea’s network policy capabilities are useful in multi-tenant environments that require precise network policy control, security, and isolation.
6. Observability requirements: If detailed network monitoring and logging is required for troubleshooting and performance optimization, Antrea provides these capabilities.

Installation

To install the Antrea plugin, you can follow these steps:

1. Download Antrea YAML file
2. Edit the YAML file
3. Apply YAML file
4. Wait for the installation to complete
5. Configure network policy
6. Test network policy

Download Antrea YAML file

Execute the following command on a machine in the K8s cluster to download Antrea’s YAML file. The latest version of the YAML file can be obtained from Antrea’s GitHub repository.

curl -O https://raw.githubusercontent.com/vmware-tanzu/antrea/main/build/yamls/antrea.yml

Edit the YAML file

Open the downloaded Antrea YAML file (usually named antrea.yml) and edit it according to your cluster requirements. The file can be opened using a text editor and configured as needed.

Here is an example:

apiVersion: operator.antrea.io/v1alpha1
kind: AntreaCluster
metadata:
  name: antrea-cluster
spec:
  defaultAntreaAgent: {}
  controller:
    # Antrea controller configuration options
    service:
      type: LoadBalancer  # Choose the service type that suites your cluster
    networkPolicy:
      enable: true  # Anable network policy
  agent:
    # Antrea proxy configuration options
    logLevel: info  # Set log level
    ovs:
      bridgeName: br-int  # Specify the brigde name of OVS
    podCIDR: 192.168.0.0/16  # Specify the CIDR range of the Pod

Ensure that the configuration in the file is consistent with the K8s cluster topology and network policy requirements. Save and close the file.

Apply YAML file

Use kubectl or other K8s cluster management tools to apply the edited YAML file to your K8s cluster.

Execute the following command:

kubectl apply -f antrea.yml

This will start the Antrea plugin installation and configuration process.

Wait for the installation to complete

Wait for a while until the Antrea plugin is automatically installed and configured in the K8s cluster.

You can use the following command to check whether Antrea-related Pods are running:

kubectl get pods -n kube-system | grep antrea

When all related Antrea Pods are in the “Running” state, the installation is complete.

antrea-agent-74d2s               1/1     Running     4m
antrea-controller-9x6z2          1/1     Running     4m

Configure network policy

Based on specific needs, use K8s network policies to define communication rules between containers. Network policy objects can be created and applied to control traffic between containers.

Testing

Finally, ensure that containers in the K8s cluster can communicate according to your network policies while meeting security and isolation requirements. You can deploy some test applications and ensure that they adhere to the defined network policies.

This example will use an Nginx container as the test application and limit communication between them.

Step 1: Create a namespace

First, create a new namespace to isolate our test application:

kubectl create namespace test-namespace

Step 2: Deploy two Nginx Pods

Create two Nginx Pods and deploy them into the namespace you just created:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment-1
  namespace: test-namespace
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:latest
 
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment-2
  namespace: test-namespace
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:latest

Save the above YAML file as nginx-deployment.yamland deploy the Pods using the following command:

kubectl apply -f nginx-deployment.yaml

Step 3: Define network policy

Create a network policy that limits traffic from another Pod.

In this example, we will prevent Pods in the nginx-deployment-1 deployment from communicating with Pods in the nginx-deployment-2 deployment:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-nginx-communication
  namespace: test-namespace
spec:
  podSelector:
    matchLabels:
      app: nginx
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: nginx

Save the above YAML file as network-policy.yaml, then use the following command to create a network policy:

kubectl apply -f network-policy.yaml

Step 4: Test Network Policy

Now that we have defined a network policy, it should prevent Pods in the nginx-deployment-1 deployment from communicating with Pods in the nginx-deployment-2 deployment. We can test this by executing the following command on a Pod in the nginx-deployment-1 deployment:

# Create a temporary Pod fortesting communication
kubectl run -i --tty --rm debug --image=nginx --namespace=test-namespace
 
# Try to access another Pod's IP address in a temporary Pod
curl <IP_OF_NGINX_DEPLOYMENT_2_POD>

If the network policy is in effect, you will see a connection timeout or other error indicating that the Pod in nginx-deployment-1is unable to communicate with the Pod in nginx-deployment-2 :

curl: (7) Failed to connect to <IP_OF_NGINX_DEPLOYMENT_2_POD> port 80: Connection timed out

Through this example, we can see how to use Kubernetes network policies to ensure that communication between containers meets security and isolation requirements.

Based on specific actual needs, more complex network policies can be defined to meet the specific application and security requirements.