文章目录
前言准备工作linux命名空间python命名空间Ingress策略podSelectorpodSelector-SinglePortpodSelector-MultiPortingress-ipBlockingress-namespaceEgress策略egress-ipBlockegress-PodSelectoregress-namespace前言
NetworkPolicy网络策略可以在 IP 地址或端口层面（OSI 第 3 层或第 4 层）控制网络流量。 NetworkPolicy 是一种以应用为中心的结构，允许你设置如何允许 Pod 与网络上的各类网络“实体”通信。 NetworkPolicies 适用于一端或两端与 Pod 的连接，与其他连接无关。
Pod 可以通信的 Pod 是通过如下三个标识符的组合来辩识的：
其他被允许的 Pods（例外：Pod 无法阻塞对自身的访问）被允许的名字空间IP 组块（例外：与 Pod 运行所在的节点的通信总是被允许的， 无论 Pod 或节点的 IP 地址）
准备工作
创建两个命名空间，每个空间运行多个pod，多个pod运行在不同的节点。
kubectl create ns linuxkubectl create ns pythonkubectl label ns linux nsname=linux kubectl label ns python nsname=python
命名空间linux与python均部署nginx与tomcat。
tomcat镜像构建：
FROM tomcat:7.0.109-jdk8-openjdk# 自定义tomcat app路径首页RUN mkdir /usr/local/tomcat/webapps/app/ADD index.jsp /usr/local/tomcat/webapps/app/
nginx镜像构建：
FROM nginx:1.20.2-alpine# 自定义首页，配置nginxADD default.conf /etc/nginx/conf.d/ADD index.html /usr/share/nginx/html/
nginx配置，将访问app路径转发给tomcat。
vim /etc/nginx/conf.d/default.conflocation / {root /usr/share/nginx/html;index index.html index.htm;}location /app {proxy_pass http://10.68.4.22:80;}
测试容器，前台卡住一天时间，用于测试网络策略效果：
kubectl run net-test-centos-pod1 --image=centos:7.9. sleep 86400 -n linuxkubectl run net-test-centos-pod1 --image=centos:7.9. sleep 86400 -n pythonkubectl run centos-net-test1 --image=centos:7.9. sleep 86400
linux命名空间
部署linux-tomcat：
apiVersion: apps/v1kind: Deploymentmetadata:labels:app: linux-tomcat-app1-deployment-labelname: linux-tomcat-app1-deploymentnamespace: linuxspec:replicas: 1selector:matchLabels:app: linux-tomcat-app1-selectortemplate:metadata:labels:app: linux-tomcat-app1-selectorspec:containers:- name: linux-tomcat-app1-containerimage: tomcat:7.0.109-jdk8-openjdk imagePullPolicy: IfNotPresentports:- containerPort: 8080protocol: TCPname: http---kind: ServiceapiVersion: v1metadata:labels:app: linux-tomcat-app1-service-labelname: linux-tomcat-app1-servicenamespace: linuxspec:type: NodePortports:- name: httpport: 80protocol: TCPtargetPort: 8080nodePort: 38080selector:app: linux-tomcat-app1-selector
部署linux-nginx：
apiVersion: apps/v1kind: Deploymentmetadata:labels:app: linux-nginx-deployment-labelname: linux-nginx-deploymentnamespace: linuxspec:replicas: 1selector:matchLabels:app: linux-nginx-selectortemplate:metadata:labels:app: linux-nginx-selectorspec:containers:- name: linux-nginx-containerimage: nginx:1.20.2-alpine imagePullPolicy: IfNotPresentports:- containerPort: 80protocol: TCPname: http- containerPort: 443protocol: TCPname: https---kind: ServiceapiVersion: v1metadata:labels:app: linux-nginx-service-labelname: linux-nginx-servicenamespace: linuxspec:type: NodePortports:- name: httpport: 80protocol: TCPtargetPort: 80nodePort: 30080- name: httpsport: 443protocol: TCPtargetPort: 443nodePort: 30443selector:app: linux-nginx-selector
python命名空间
部署python-tomcat：
apiVersion: apps/v1kind: Deploymentmetadata:labels:app: python-tomcat-app1-deployment-labelname: python-tomcat-app1-deploymentnamespace: pythonspec:replicas: 1selector:matchLabels:app: python-tomcat-app1-selectortemplate:metadata:labels:app: python-tomcat-app1-selectorspec:nodeName: 192.168.100.164containers:- name: python-tomcat-app1-containerimage: tomcat:7.0.109-jdk8-openjdk imagePullPolicy: IfNotPresentports:- containerPort: 8080protocol: TCPname: http---kind: ServiceapiVersion: v1metadata:labels:app: python-tomcat-app1-service-labelname: python-tomcat-app1-servicenamespace: pythonspec:type: NodePortports:- name: httpport: 80protocol: TCPtargetPort: 8080nodePort: 38081selector:app: python-tomcat-app1-selector
部署python-tomcat：
apiVersion: apps/v1kind: Deploymentmetadata:labels:app: python-nginx-deployment-labelname: python-nginx-deploymentnamespace: pythonspec:replicas: 1selector:matchLabels:app: python-nginx-selectortemplate:metadata:labels:app: python-nginx-selectorproject: pythonspec:containers:- name: python-nginx-containerimage: nginx:1.20.2-alpineimagePullPolicy: IfNotPresentports:- containerPort: 80protocol: TCPname: http- containerPort: 443protocol: TCPname: https---kind: ServiceapiVersion: v1metadata:labels:app: python-nginx-service-labelname: python-nginx-servicenamespace: pythonspec:type: NodePortports:- name: httpport: 80protocol: TCPtargetPort: 80nodePort: 30081- name: httpsport: 443protocol: TCPtargetPort: 443nodePort: 30444selector:app: python-nginx-selectorproject: python #一个或多个selector，至少能匹配目标pod的一个标签
Ingress策略
Pod 有两种隔离: 出口的隔离和入口的隔离。入口隔离(Ingress)策略较为常用。
podSelector
apiVersion: networking.k8s.io/v1kind: NetworkPolicymetadata:name: tomcat-access--networkpolicynamespace: pythonspec:policyTypes:- IngresspodSelector:matchLabels:app: python-tomcat-app1-selector #对匹配到的目的Pod应用以下规则ingress: #入栈规则，如果指定目标端口就是匹配全部端口和协议，协议TCP, UDP, or SCTP- from:- podSelector:matchLabels:#app: python-nginx-selector #and关系project: "python"
对命名空间python中的app=python-tomcat-app1-selector的pod进行网络隔离入口隔离，即只对谁可以访问该pod进行管控标签project=python的pod允许访问未指定则允许访问全部端口全部协议
在project=linux的pod进行测试：
# NetworkPolicy前curl http://172.20.153.199:8080/app/tomcat app python 456# NetworkPolicy后curl http://172.20.153.199:8080/app/curl: (7) Failed connect to 172.20.153.199:8080; Connection timed out
podSelector-SinglePort
apiVersion: networking.k8s.io/v1kind: NetworkPolicymetadata:name: tomcat-access--networkpolicynamespace: pythonspec:policyTypes:- IngresspodSelector:matchLabels:app: python-tomcat-app1-selectoringress:- from:- podSelector:matchLabels:#app: python-nginx-selector #指定访问源的匹配条件,如果存在多个matchLabel条件,是and的关系,即要同时满足条件A、条件B、条件Xproject: "python"ports: #入栈规则，如果指定目标端口就是匹配全部端口和协议,协议TCP, UDP, or SCTP- protocol: TCPport: 8080 #允许通过TCP协议访问目标pod的8080端口,但是其它没有允许的端口将全部禁止访问#port: 80
对命名空间python中的app=python-tomcat-app1-selector的pod进行网络隔离入口隔离，即只对谁可以访问该pod进行管控标签project=python的pod允许访问只允许访问tcp协议的8080端口
podSelector-MultiPort
apiVersion: networking.k8s.io/v1kind: NetworkPolicymetadata:name: tomcat-access-networkpolicynamespace: pythonspec:policyTypes:- IngresspodSelector: #目标podmatchLabels:app: python-tomcat-app1-selectoringress:- from:- podSelector: #匹配源pod,matchLabels: {}为不限制源pod即允许所有pod,写法等同于resources(不加就是不限制)matchLabels: {}ports: #入栈规则，如果指定目标端口就是匹配全部端口和协议，协议TCP, UDP, or SCTP- protocol: TCPport: 8080 endPort: 8090- protocol: TCPport: 3306- protocol: TCPport: 6379
对命名空间python中的app=python-tomcat-app1-selector的pod进行网络隔离入口隔离，即只对谁可以访问该pod进行管控所有pod允许访问允许访问tcp协议的8080至8090，3306，6379这些端口访问
ingress-ipBlock
apiVersion: networking.k8s.io/v1kind: NetworkPolicymetadata:name: tomcat-access--networkpolicynamespace: pythonspec:policyTypes:- IngresspodSelector: #目标podmatchLabels:app: python-tomcat-app1-selectoringress:- from:# - podSelector: #匹配源pod,matchLabels: {}为不限制源pod即允许所有pod,写法等同于resources(不加就是不限制)# matchLabels: {}- ipBlock:cidr: 10.200.0.0/16 #白名单，允许访问的地址范围，没有允许的将禁止访问目标podexcept:- 10.200.100.0/24 #在以上范围内禁止访问的源IP地址- 10.200.200.0/24 #在以上范围内禁止访问的源IP地址
对命名空间python中的app=python-tomcat-app1-selector的pod进行网络隔离入口隔离，即只对谁可以访问该pod进行管控所有pod允许访问全部端口与协议只允许10.200.0.0/16访问，其中10.200.100.0/24和10.200.200.0/24不允许访问
ingress-namespace
apiVersion: networking.k8s.io/v1kind: NetworkPolicymetadata:name: tomcat-access--networkpolicynamespace: pythonspec:policyTypes:- IngresspodSelector: #目标podmatchLabels: {} #允许访问python namespace 中的所有podingress:- from:- namespaceSelector:matchLabels:nsname: linux #只允许指定的namespace访问- namespaceSelector:matchLabels:nsname: python #只允许指定的namespace访问
对命名空间python中全部的pod进行网络管控入口隔离，即只对谁可以访问该pod进行管控只允许命名空间为linux或python的全部pod访问可以访问全部端口与协议
Egress策略
egress-ipBlock
apiVersion: networking.k8s.io/v1kind: NetworkPolicymetadata:name: egress-access-networkpolicynamespace: pythonspec:policyTypes:- EgresspodSelector: #目标pod选择器matchLabels: #基于label匹配目标podapp: python-tomcat-app1-selector #匹配python namespace中app的值为python-tomcat-app1-selector的pod,然后基于egress中的指定网络策略进行出口方向的网络限制egress:- to:- ipBlock:cidr: 10.200.0.0/16 #允许匹配到的pod出口访问的目的CIDR地址范围- ipBlock:cidr: 172.31.7.106/32 #允许匹配到的pod出口访问的目的主机ports:- protocol: TCPport: 80 #允许匹配到的pod访问目的端口为80的访问- protocol: TCPport: 53 #允许匹配到的pod访问目的端口为53 即DNS的解析- protocol: UDPport: 53 #允许匹配到的pod访问目的端口为53 即DNS的解析
对命名空间python中的app=python-tomcat-app1-selector的pod进行网络隔离出口隔离，即对该pod可以访问谁进行管控只允许往外访问10.200.0.0/16 和172.31.7.106/32同时只允许访问这些外部IP的80/tcp，53/tcp，53/udp端口协议
egress-PodSelector
apiVersion: networking.k8s.io/v1kind: NetworkPolicymetadata:name: egress-access-networkpolicynamespace: pythonspec:policyTypes:- EgresspodSelector: #目标pod选择器matchLabels: #基于label匹配目标podapp: python-nginx-selector #匹配python namespace中app的值为python-tomcat-app1-selector的pod,然后基于egress中的指定网络策略进行出口方向的网络限制egress:- to:- podSelector: #匹配pod,matchLabels: {}为不限制源pod即允许所有pod,写法等同于resources(不加就是不限制)matchLabels:app: python-tomcat-app1-selector
对命名空间python中的app=python-nginx-selector的pod进行网络隔离出口隔离，即对该pod可以访问谁进行管控只允许该pod访问标签app=python-tomcat-app1-selector的pod允许访问外部pod的全部端口与协议
egress-namespace
apiVersion: networking.k8s.io/v1kind: NetworkPolicymetadata:name: egress-access-networkpolicynamespace: pythonspec:policyTypes:- EgresspodSelector: #目标pod选择器matchLabels: #基于label匹配目标podapp: python-nginx-selector #匹配python namespace中app的值为python-tomcat-app1-selector的pod,然后基于egress中的指定网络策略进行出口方向的网络限制egress:- to:- namespaceSelector:matchLabels:nsname: python #指定允许访问的目的namespace- namespaceSelector:matchLabels:nsname: linux #指定允许访问的目的namespaceports:- protocol: TCPport: 8080 #允许80端口的访问- protocol: TCPport: 53 #允许DNS的解析- protocol: UDPport: 53
对命名空间python中的app=python-nginx-selector的pod进行网络隔离出口隔离，即对该pod可以访问谁进行管控允许该pod访问命名空间为python或linux的全部pod允许访问外部这些pod的8080/tcp，53/tcp，53/udp
