简介

基于OpenStack云主机搭建的k8s集群，网络CNI选用的calico，使用的是BGP模式，pod直接无法ping通，宿主机也无法ping通pod。
排除后发现不是安全组的原因，应该是OpenStack的网卡默认会丢掉非本网卡ip地址的包，导致网卡无法转发。

解决方案

1. 使用calico的IPIP模式
2. 关闭网卡(port)安全检查

openstack port set --no-security-group  e0d5c005-0297-4878-8470-e509e9890835
openstack port set --disable-port-security  e0d5c005-0297-4878-8470-e509e9890835

参考

https://blog.csdn.net/x356982611/article/details/110423370
https://github.com/projectcalico/calico/issues/2082
https://blog.csdn.net/fyggzb/article/details/53889492
https://www.packetflow.co.uk/openstack-neutron-port-security-explained/
https://www.cloudqubes.com/hands-on/openstack/openstack-port-security/
https://www.oreilly.com/library/view/learning-openstack-networking/9781788392495/14671514-a976-495c-a679-eb54a6d82163.xhtml
https://wiki.openstack.org/wiki/Neutron/ML2PortSecurityExtensionDriver
https://docs.projectcalico.org/maintenance/troubleshoot/troubleshooting