容器編排系統K8s之NetworkPolicy資源
阿新 • • 發佈：2021-01-05
前文我們瞭解了k8s的網路外掛flannel的基礎工作邏輯，回顧請參考：https://www.cnblogs.com/qiuhom-1874/p/14225657.html；今天我們來聊一下k8s上的NetworkPolicy相關話題；
NetworkPolicy資源是做什麼用的？
我們知道在k8s上我們可以用名稱空間來隔離多個資源，在不同名稱空間下我們可以建立相同名稱和相同型別的資源；有些資源還必須依賴名稱空間才可以被建立；但是在k8s上，名稱空間不可以隔離網路，所謂隔離網路是指不管pod建立在那個名稱空間下，都可以被其他名稱空間下pod訪問到；如果我們想要限制對應名稱空間下的pod被別的名稱空間或外部客戶端訪問，我們可以在對應名稱空間下建立NetworkPolicy資源；該資源可以限制哪些pod可以被外部客戶端訪問，或者哪些pod不能夠被哪個或哪些名稱空間的pod訪問；除了能夠限制對應名稱空間下的pod網路入站流量，它還可以限制對應名稱空間下的pod出站的流量，允許或拒絕某個或某些個pod訪問別的名稱空間下pod或外部某服務等；我們可以簡單的理解NetworkPolicy就是對應名稱空間的一道防火牆；我們把NetworkPolicy資源建立在對應名稱空間下，那麼它就能實現對該名稱空間下的pod進行流量管控；
NetworkPolicy基礎工作邏輯
提示：首先networkpolicy是作用於一個名稱空間下的pod資源之上而進行的流量管控；它可以通過pod選擇器來選擇對應名稱空間下pod，滿足對應選擇器的條件的pod，將受到networkpolicy中定義的策略管控，預設pod選擇器沒有明確定義表示匹配對應名稱空間下的所有pod；Egress是用來定義pod出站策略，預設顯式定義的策略都是被允許出站的，沒有定義表示拒絕；對於ingress也是同樣的邏輯，只有顯式定義的規則才被允許，沒有定義就表示拒絕；對於出站流量來說，預設我們定義或不定義它都不會生效，都是允許放行的，只有顯式配置對應出站規則生效，它才會生效；
示例：定義dev名稱空間下的pod不允許任何客戶端訪問
[root@master01 ~]# cat denyall-ingress-dev.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: deny-all-ingress
namespace: dev
spec:
podSelector: {}
policyTypes:
- Ingress
[root@master01 ~]#
提示：以上資源清單表示對dev名稱空間下的pod的入站流量進行管控，拒絕所有客戶端訪問對應dev名稱空間下的pod；這其中包含dev名稱空間下的pod；
應用資源清單
在應用之前請確保你所部署的網路外掛支援網路策略，預設flannel網路外掛不支援網路策略，我們需要部署canel這個網路外掛，該外掛能夠結合flannel外掛，讓其擁有calico的網路策略功能；
部署canel
[root@master01 ~]# kubectl apply -f https://docs.projectcalico.org/manifests/canal.yaml configmap/canal-config created customresourcedefinition.apiextensions.k8s.io/bgpconfigurations.crd.projectcalico.org created customresourcedefinition.apiextensions.k8s.io/bgppeers.crd.projectcalico.org created customresourcedefinition.apiextensions.k8s.io/blockaffinities.crd.projectcalico.org created customresourcedefinition.apiextensions.k8s.io/clusterinformations.crd.projectcalico.org created customresourcedefinition.apiextensions.k8s.io/felixconfigurations.crd.projectcalico.org created customresourcedefinition.apiextensions.k8s.io/globalnetworkpolicies.crd.projectcalico.org created customresourcedefinition.apiextensions.k8s.io/globalnetworksets.crd.projectcalico.org created customresourcedefinition.apiextensions.k8s.io/hostendpoints.crd.projectcalico.org created customresourcedefinition.apiextensions.k8s.io/ipamblocks.crd.projectcalico.org created customresourcedefinition.apiextensions.k8s.io/ipamconfigs.crd.projectcalico.org created customresourcedefinition.apiextensions.k8s.io/ipamhandles.crd.projectcalico.org created customresourcedefinition.apiextensions.k8s.io/ippools.crd.projectcalico.org created customresourcedefinition.apiextensions.k8s.io/kubecontrollersconfigurations.crd.projectcalico.org created customresourcedefinition.apiextensions.k8s.io/networkpolicies.crd.projectcalico.org created customresourcedefinition.apiextensions.k8s.io/networksets.crd.projectcalico.org created clusterrole.rbac.authorization.k8s.io/calico-kube-controllers created clusterrolebinding.rbac.authorization.k8s.io/calico-kube-controllers created clusterrole.rbac.authorization.k8s.io/calico-node created clusterrole.rbac.authorization.k8s.io/flannel configured clusterrolebinding.rbac.authorization.k8s.io/canal-flannel created clusterrolebinding.rbac.authorization.k8s.io/canal-calico created daemonset.apps/canal created serviceaccount/canal created deployment.apps/calico-kube-controllers created serviceaccount/calico-kube-controllers created poddisruptionbudget.policy/calico-kube-controllers created [root@master01 ~]#
提示：等待上述資源都正常執行以後，我們就可以應用資源清單，讓其網路策略生效；
建立dev名稱空間，並在其下建立一個deploy控制器，控制器建立3個nginx pod
[root@master01 manifests]# cat pod-demo.yaml
apiVersion: v1
kind: Namespace
metadata:
name: dev
labels:
name: dev
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: nginx-dep
namespace: dev
spec:
replicas: 3
selector:
matchLabels:
app: nginx
rel: stable
template:
metadata:
labels:
app: nginx
rel: stable
spec:
containers:
- name: nginx
image: nginx:1.14-alpine
imagePullPolicy: IfNotPresent
ports:
- name: http
containerPort: 80
[root@master01 manifests]# kubectl apply -f pod-demo.yaml
namespace/dev unchanged
deployment.apps/nginx-dep created
[root@master01 manifests]# kubectl get pods -n dev -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
nginx-dep-cb74c595f-5d9tb 1/1 Running 0 51s 10.244.4.6 node04.k8s.org <none> <none>
nginx-dep-cb74c595f-ftmn9 1/1 Running 0 51s 10.244.1.5 node01.k8s.org <none> <none>
nginx-dep-cb74c595f-jf9p9 1/1 Running 0 51s 10.244.3.4 node03.k8s.org <none> <none>
[root@master01 manifests]#
在沒有應用上述網路策略前，用default裡的pod訪問對應dev名稱空間下pod，看看是否可以正常訪問？
[root@master01 manifests]# kubectl get pods -n dev -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
nginx-dep-cb74c595f-5d9tb 1/1 Running 0 86s 10.244.4.6 node04.k8s.org <none> <none>
nginx-dep-cb74c595f-ftmn9 1/1 Running 0 86s 10.244.1.5 node01.k8s.org <none> <none>
nginx-dep-cb74c595f-jf9p9 1/1 Running 0 86s 10.244.3.4 node03.k8s.org <none> <none>
[root@master01 manifests]# kubectl get pods
NAME READY STATUS RESTARTS AGE
web-0 1/1 Running 6 3d16h
web-1 1/1 Running 5 3d16h
web-2 1/1 Running 6 3d16h
[root@master01 manifests]# kubectl exec web-0 -it -- /bin/sh
/ # wget -O - -q 10.244.4.6
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
body {
width: 35em;
margin: 0 auto;
font-family: Tahoma, Verdana, Arial, sans-serif;
}
</style>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>
<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>
<p><em>Thank you for using nginx.</em></p>
</body>
</html>
/ #
提示：可以看到用default名稱空間下的pod，是可以正常訪問dev名稱空間下的pod；
應用資源清單
[root@master01 ~]# cat denyall-ingress-dev.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: deny-all-ingress
namespace: dev
spec:
podSelector: {}
policyTypes:
- Ingress
[root@master01 ~]# kubectl apply -f denyall-ingress-dev.yaml
networkpolicy.networking.k8s.io/deny-all-ingress created
[root@master01 ~]# kubectl get netpol -n dev
NAME POD-SELECTOR AGE
deny-all-ingress <none> 10s
[root@master01 ~]# kubectl describe netpol deny-all-ingress -n dev
Name: deny-all-ingress
Namespace: dev
Created on: 2021-01-04 15:34:40 +0800 CST
Labels: <none>
Annotations: <none>
Spec:
PodSelector: <none> (Allowing the specific traffic to all pods in this namespace)
Allowing ingress traffic:
<none> (Selected pods are isolated for ingress connectivity)
Not affecting egress traffic
Policy Types: Ingress
[root@master01 ~]#
提示：從上面的netpol資源的詳細資訊中可以瞭解到，對應netpol資源pod選擇器為none表示選擇對應名稱空間下的所有pod，allowing ingress traffic 也是為none表示沒有任何客戶端允許訪問該名稱空間下的pod；沒有出站策略，表示拒絕所有出站流量；預設只是入站規則生效，所以這裡的出站規則不生效，即不限制出站流量；policyTypes表示對應的那個策略生效，預設不指定是Ingress；
驗證：使用default名稱空間下的pod訪問dev名稱空間下的pod，看看是否還可以正常訪問？
提示：可以看到現在default名稱空間下的pod是不能訪問dev名稱空間下的pod；
驗證：dev名稱空間下的pod訪問同名稱空間下的pod，看看是否可以允許訪問?
提示：可以看到在dev名稱空間下的pod也沒法訪問dev名稱空間下的pod，但是自己可以訪問自己，其原因是自己訪問自己，流量不會出站，在lo介面就被處理了，所以自己訪問自己不受限制；
驗證：使用dev名稱空間下的pod訪問default名稱空間下的pod，看看是否被允許 ？
提示：可以看到使用dev名稱空間下的pod訪問default名稱空間下的pod上沒有問題，說明剛才的那條規則只是現在了dev名稱空間下的pod的入站流量，並沒有限制其出站流量；上面訪問10.244.4.5和3.3響應404，是因為對應pod上的web服務沒有主頁；
示例：限制dev名稱空間下的pod的出站流量，拒絕所有pod流量出站
[root@master01 ~]# cat denyall-Egress.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: deny-all-egress
namespace: dev
spec:
podSelector: {}
policyTypes:
- Egress
[root@master01 ~]#
提示：policyTypes欄位用來控制那個型別的規則生效，該欄位是一個列表，預設是Ingress，表示只對入站流量做限制，如果明確手動定義為Egress表示，只限製出站流量；出站策略和入站策略的邏輯都是一樣的，只要沒有明且定義的，都是表示拒絕操作，只有明確定義的才表示對應允許操作；上述沒有定義任何出站規則，表示拒絕所有pod訪問外部服務；
應用資源清單
[root@master01 ~]# kubectl apply -f denyall-Egress.yaml
networkpolicy.networking.k8s.io/deny-all-egress created
[root@master01 ~]# kubectl get netpol -n dev
NAME POD-SELECTOR AGE
deny-all-egress <none> 10s
deny-all-ingress <none> 24m
[root@master01 ~]# kubectl describe netpol deny-all-egress -n dev
Name: deny-all-egress
Namespace: dev
Created on: 2021-01-04 15:59:16 +0800 CST
Labels: <none>
Annotations: <none>
Spec:
PodSelector: <none> (Allowing the specific traffic to all pods in this namespace)
Not affecting ingress traffic
Allowing egress traffic:
<none> (Selected pods are isolated for egress connectivity)
Policy Types: Egress
[root@master01 ~]#
驗證：進入dev名稱空間下的pod互動式介面，看看是否可以訪問其他名稱空間下的pod？
提示：可以看到現在dev名稱空間下的pod訪問default名稱空間下的pod就不能訪問了；
驗證：刪除入站限制，使用dev名稱空間下的pod互相訪問，看看是否可以正常訪問呢？
[root@master01 ~]# kubectl get netpol -n dev
NAME POD-SELECTOR AGE
deny-all-egress <none> 5m50s
deny-all-ingress <none> 30m
[root@master01 ~]# kubectl delete netpol deny-all-ingress -n dev
networkpolicy.networking.k8s.io "deny-all-ingress" deleted
[root@master01 ~]# kubectl get netpol -n dev
NAME POD-SELECTOR AGE
deny-all-egress <none> 6m9s
[root@master01 ~]# kubectl get pods -n dev -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
nginx-dep-cb74c595f-5d9tb 1/1 Running 0 34m 10.244.4.6 node04.k8s.org <none> <none>
nginx-dep-cb74c595f-ftmn9 1/1 Running 0 34m 10.244.1.5 node01.k8s.org <none> <none>
nginx-dep-cb74c595f-jf9p9 1/1 Running 0 34m 10.244.3.4 node03.k8s.org <none> <none>
[root@master01 ~]# kubectl exec -it nginx-dep-cb74c595f-5d9tb -n dev -- /bin/sh
/ # wget -O - -q 10.244.1.5
^C
/ # wget -O - -q 10.244.3.4
^C
/ # wget -O - -q 10.244.4.6
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
body {
width: 35em;
margin: 0 auto;
font-family: Tahoma, Verdana, Arial, sans-serif;
}
</style>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>
<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>
<p><em>Thank you for using nginx.</em></p>
</body>
</html>
/ #
提示：可以看到限制了出站流量以後，在同一名稱空間下的pod也是無法正常訪問的；但是自己可以訪問自己；
示例：限制dev名稱空間下的pod的出站流量，允許dev名稱空間下的pod互相訪問
[root@master01 ~]# cat allow-dev-Egress.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-dev-egress
namespace: dev
spec:
podSelector: {}
egress:
- to:
- podSelector:
matchLabels:
app: nginx
rel: stable
ports:
- port: 80
protocol: TCP
policyTypes:
- Egress
[root@master01 ~]#
提示：限制出站流量，可以在spec.egress中來定義允許的出站的規則；其中to欄位是用來描述被訪問端，其值型別是一個列表物件；podSelector欄位是用來描述被訪問端pod選擇器，只有滿足對應pod選擇器的條件的pod都被允許出站；spec.egress.ports欄位是用來描述被訪問端點埠資訊；該欄位為一個列表物件；這裡需要注意，預設沒有在規則指定其名稱空間表示匹配當前netpol所在名稱空間；以上清單表示dev下的pod允許訪問dev名稱空間下標籤為app=nginx,rel=stable的pod的80埠；
刪除deny-all-egress出站策略，應用其資源清單
[root@master01 ~]# kubectl get netpol -n dev
NAME POD-SELECTOR AGE
deny-all-egress <none> 26m
[root@master01 ~]# kubectl delete netpol deny-all-egress -n dev
networkpolicy.networking.k8s.io "deny-all-egress" deleted
[root@master01 ~]# kubectl apply -f allow-dev-Egress.yaml
networkpolicy.networking.k8s.io/allow-dev-egress created
[root@master01 ~]# kubectl get netpol -n dev
NAME POD-SELECTOR AGE
allow-dev-egress <none> 10s
[root@master01 ~]# kubectl describe netpol allow-dev-egress -n dev
Name: allow-dev-egress
Namespace: dev
Created on: 2021-01-04 16:34:23 +0800 CST
Labels: <none>
Annotations: <none>
Spec:
PodSelector: <none> (Allowing the specific traffic to all pods in this namespace)
Not affecting ingress traffic
Allowing egress traffic:
To Port: 80/TCP
To:
PodSelector: app=nginx,rel=stable
Policy Types: Egress
[root@master01 ~]#
驗證：進入dev名稱空間下pod的裡，看看是否可以正常訪問dev名稱空間下的pod？
[root@master01 ~]# kubectl get pods -n dev -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
nginx-dep-cb74c595f-5d9tb 1/1 Running 0 65m 10.244.4.6 node04.k8s.org <none> <none>
nginx-dep-cb74c595f-ftmn9 1/1 Running 0 65m 10.244.1.5 node01.k8s.org <none> <none>
nginx-dep-cb74c595f-jf9p9 1/1 Running 0 65m 10.244.3.4 node03.k8s.org <none> <none>
[root@master01 ~]# kubectl exec -it -n dev nginx-dep-cb74c595f-5d9tb -- /bin/sh
/ # wget -O - -q 10.244.1.5
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
body {
width: 35em;
margin: 0 auto;
font-family: Tahoma, Verdana, Arial, sans-serif;
}
</style>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>
<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>
<p><em>Thank you for using nginx.</em></p>
</body>
</html>
/ # wget -O - -q 10.244.3.4
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
body {
width: 35em;
margin: 0 auto;
font-family: Tahoma, Verdana, Arial, sans-serif;
}
</style>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>
<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>
<p><em>Thank you for using nginx.</em></p>
</body>
</html>
/ #
提示：可以看到dev名稱空間pod訪問dev名稱空間下的pod可以正常訪問；
驗證：使用dev名稱空間pod訪問default名稱空間下，標籤為app=nginx，rel=stable的pod，看看是否可以正常訪問？
[root@master01 ~]# kubectl get pods -n dev NAME READY STATUS RESTARTS AGE nginx-dep-cb74c595f-27qjp 1/1 Running 2 88m nginx-dep-cb74c595f-b92s4 1/1 Running 1 88m nginx-dep-cb74c595f-wdqnh 1/1 Running 1 88m [root@master01 ~]# kubectl get pods -o wide --show-labels NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES LABELS nginx-dep-cb74c595f-5mwl2 1/1 Running 1 89m 10.244.4.18 node04.k8s.org <none> <none> app=nginx,pod-template-hash=cb74c595f,rel=stable nginx-dep-cb74c595f-vxc9z 1/1 Running 1 89m 10.244.3.12 node03.k8s.org <none> <none> app=nginx,pod-template-hash=cb74c595f,rel=stable nginx-dep-cb74c595f-z265t 1/1 Running 1 89m 10.244.2.13 node02.k8s.org <none> <none> app=nginx,pod-template-hash=cb74c595f,rel=stable web-0 1/1 Running 8 3d20h 10.244.2.14 node02.k8s.org <none> <none> app=nginx,controller-revision-hash=web-6db9455fdf,statefulset.kubernetes.io/pod-name=web-0 web-1 1/1 Running 7 3d20h 10.244.4.16 node04.k8s.org <none> <none> app=nginx,controller-revision-hash=web-6db9455fdf,statefulset.kubernetes.io/pod-name=web-1 web-2 1/1 Running 8 3d20h 10.244.3.11 node03.k8s.org <none> <none> app=nginx,controller-revision-hash=web-6db9455fdf,statefulset.kubernetes.io/pod-name=web-2 [root@master01 ~]# kubectl exec -it nginx-dep-cb74c595f-27qjp -n dev -- /bin/sh / # wget -O - -q 10.244.4.18 ^C / # wget -O - -q 10.244.3.12 ^C / # wget -O - -q 10.244.2.13 ^C / #
提示：可以看到dev名稱空間下的pod訪問default名稱空間下標籤為app=nginx，rel=stable的pod也是無法正常訪問，原因是我們在策略中沒有指定對應訪問目標的名稱空間，預設就是對應netpol所在名稱空間；
示例：允許dev名稱空間下的pod訪問default和dev名稱空間下標籤為app=nginx，rel=stable的pod
[root@master01 ~]# cat allow-dev-def-egress.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-dev-egress
namespace: dev
spec:
podSelector: {}
egress:
- to:
- namespaceSelector:
matchExpressions:
- key: name
operator: In
values: ["def","dev"]
podSelector:
matchLabels:
app: nginx
rel: stable
ports:
- port: 80
protocol: TCP
policyTypes:
- Egress
[root@master01 ~]#
提示：spec.egress.to中的namespeceSelector欄位使用來描述被訪問端所在名稱空間；podSelector欄位是用來描述被訪問端的pod；如果這兩個欄位中只有一個欄位前用了“-”，那麼namespaceSelector和podSelector所指定的條件是與關係，即兩個條件必須都滿足；如果兩個欄位都用了“-”開頭，則兩個欄位所指定的條件就是或關係，即滿足其中一個欄位的條件都可以被規則匹配；上述示例表示dev下的所有pod能夠訪問名稱空間上的標籤是name=def或name=dev的名稱空間下的pod，並且這些pod的標籤必須是app=nginx,rel=stable；即要想被dev名稱空間下的pod所訪問，對應pod的應該同時滿足兩個條件，第一對應名稱空間上有name=def或者name=dev的標籤；其次pod本身要有兩個標籤，app=nginx和rel=stable；這兩個條件缺一不可；
刪除原有netpol，應用新的清單
[root@master01 ~]# kubectl get netpol -n dev
NAME POD-SELECTOR AGE
allow-dev-egress <none> 28m
[root@master01 ~]# kubectl delete netpol allow-dev-egress -n dev
networkpolicy.networking.k8s.io "allow-dev-egress" deleted
[root@master01 ~]# kubectl apply -f allow-dev-def-egress.yaml
networkpolicy.networking.k8s.io/allow-dev-egress created
[root@master01 ~]# kubectl get netpol -n dev
NAME POD-SELECTOR AGE
allow-dev-egress <none> 5s
[root@master01 ~]# kubectl describe netpol allow-dev-egress -n dev
Name: allow-dev-egress
Namespace: dev
Created on: 2021-01-04 19:44:32 +0800 CST
Labels: <none>
Annotations: <none>
Spec:
PodSelector: <none> (Allowing the specific traffic to all pods in this namespace)
Not affecting ingress traffic
Allowing egress traffic:
To Port: 80/TCP
To:
NamespaceSelector: name in (def,dev)
PodSelector: app=nginx,rel=stable
Policy Types: Egress
[root@master01 ~]#
提示：可以看到對應的出站規則就有兩個條件，首先稱空間必須匹配，name=def或者name=dev，即對應名稱空間必須要這樣的標籤；其次pod必須滿足有app=nginx,rel=stable的標籤；
給default名稱空間打上name=def的標籤
[root@master01 ~]# kubectl get ns --show-labels NAME STATUS AGE LABELS default Active 27d <none> dev Active 4h24m name=dev ingress-nginx Active 13d app.kubernetes.io/name=ingress-nginx,app.kubernetes.io/part-of=ingress-nginx kube-node-lease Active 27d <none> kube-public Active 27d <none> kube-system Active 27d <none> kubernetes-dashboard Active 2d5h <none> prod Active 57m name=prod [root@master01 ~]# kubectl label ns default name=def namespace/default labeled [root@master01 ~]# kubectl get ns --show-labels NAME STATUS AGE LABELS default Active 27d name=def dev Active 4h24m name=dev ingress-nginx Active 13d app.kubernetes.io/name=ingress-nginx,app.kubernetes.io/part-of=ingress-nginx kube-node-lease Active 27d <none> kube-public Active 27d <none> kube-system Active 27d <none> kubernetes-dashboard Active 2d5h <none> prod Active 58m name=prod [root@master01 ~]#
驗證：用dev下的pod訪問default和dev名稱空間下pod標籤為app=nginx,rel=stable的pod，看看對應pod是否能夠被訪問到？
[root@master01 ~]# kubectl get pods -n dev -o wide --show-labels NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES LABELS nginx-dep-cb74c595f-27qjp 1/1 Running 2 116m 10.244.1.18 node01.k8s.org <none> <none> app=nginx,pod-template-hash=cb74c595f,rel=stable nginx-dep-cb74c595f-b92s4 1/1 Running 1 116m 10.244.4.17 node04.k8s.org <none> <none> app=nginx,pod-template-hash=cb74c595f,rel=stable nginx-dep-cb74c595f-wdqnh 1/1 Running 1 116m 10.244.1.19 node01.k8s.org <none> <none> app=nginx,pod-template-hash=cb74c595f,rel=stable [root@master01 ~]# kubectl get pods -o wide --show-labels NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES LABELS nginx-dep-cb74c595f-5mwl2 1/1 Running 1 117m 10.244.4.18 node04.k8s.org <none> <none> app=nginx,pod-template-hash=cb74c595f,rel=stable nginx-dep-cb74c595f-vxc9z 1/1 Running 1 117m 10.244.3.12 node03.k8s.org <none> <none> app=nginx,pod-template-hash=cb74c595f,rel=stable nginx-dep-cb74c595f-z265t 1/1 Running 1 117m 10.244.2.13 node02.k8s.org <none> <none> app=nginx,pod-template-hash=cb74c595f,rel=stable web-0 1/1 Running 8 3d21h 10.244.2.14 node02.k8s.org <none> <none> app=nginx,controller-revision-hash=web-6db9455fdf,statefulset.kubernetes.io/pod-name=web-0 web-1 1/1 Running 7 3d21h 10.244.4.16 node04.k8s.org <none> <none> app=nginx,controller-revision-hash=web-6db9455fdf,statefulset.kubernetes.io/pod-name=web-1 web-2 1/1 Running 8 3d21h 10.244.3.11 node03.k8s.org <none> <none> app=nginx,controller-revision-hash=web-6db9455fdf,statefulset.kubernetes.io/pod-name=web-2 [root@master01 ~]# kubectl exec -it -n dev nginx-dep-cb74c595f-27qjp -- /bin/sh / # wget --spider --timeout=1 10.244.4.17 Connecting to 10.244.4.17 (10.244.4.17:80) / # wget --spider --timeout=1 10.244.1.19 Connecting to 10.244.1.19 (10.244.1.19:80) / # wget --spider --timeout=1 10.244.4.18 Connecting to 10.244.4.18 (10.244.4.18:80) / # wget --spider --timeout=1 10.244.3.12 Connecting to 10.244.3.12 (10.244.3.12:80) / # wget --spider --timeout=1 10.244.2.13 Connecting to 10.244.2.13 (10.244.2.13:80) / # wget --spider --timeout=1 10.244.2.14 Connecting to 10.244.2.14 (10.244.2.14:80) wget: download timed out / #
提示：可以看到用dev名稱空間的pod訪問名稱空間上有name=def或name=dev標籤並且對應pod上有app=nginx和rel=stable的標籤的pod是能夠正常訪問到，如果不能滿足對應名稱空間和pod標籤的pod就不能被訪問；上面示例中最後一個podip不滿足pod的標籤，所以訪問不到對應pod；
示例：允許dev名稱空間下的pod訪問名稱空間上有name=def或name=dev標籤的名稱空間下的pod或者名稱空間上有name=prod標籤，並且對應名稱空間下的pod必須有app=nginx，rel=stable的標籤；
[root@master01 ~]# cat allow-dev-def-egress.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-dev-egress
namespace: dev
spec:
podSelector: {}
egress:
- to:
- namespaceSelector:
matchExpressions:
- key: name
operator: In
values: ["def","dev"]
- to:
- namespaceSelector:
matchLables:
name: prod
podSelector:
matchLabels:
app: nginx
rel: stable
ports:
- port: 80
protocol: TCP
policyTypes:
- Egress
[root@master01 ~]#
應用配置清單
[root@master01 ~]# kubectl apply -f allow-dev-def-egress.yaml
networkpolicy.networking.k8s.io/allow-dev-egress created
[root@master01 ~]# kubectl get netpol -n dev
NAME POD-SELECTOR AGE
allow-dev-egress <none> 10s
[root@master01 ~]# kubectl describe netpol allow-dev-egress -n dev
Name: allow-dev-egress
Namespace: dev
Created on: 2021-01-04 20:44:42 +0800 CST
Labels: <none>
Annotations: <none>
Spec:
PodSelector: <none> (Allowing the specific traffic to all pods in this namespace)
Not affecting ingress traffic
Allowing egress traffic:
To Port: <any> (traffic allowed to all ports)
To:
NamespaceSelector: name in (def,dev)
----------
To Port: 80/TCP
To:
NamespaceSelector: name=prod
PodSelector: app=nginx,rel=stable
Policy Types: Egress
[root@master01 ~]#
驗證：用dev名稱空間下的pod訪問dev名稱空間下的pod，看看是否可以正常訪問？
[root@master01 ~]# kubectl get pods -n dev -o wide NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES nginx-dep-cb74c595f-27qjp 1/1 Running 2 168m 10.244.1.18 node01.k8s.org <none> <none> nginx-dep-cb74c595f-b92s4 1/1 Running 1 168m 10.244.4.17 node04.k8s.org <none> <none> nginx-dep-cb74c595f-wdqnh 1/1 Running 1 168m 10.244.1.19 node01.k8s.org <none> <none> [root@master01 ~]# kubectl exec -it -n dev nginx-dep-cb74c595f-27qjp -- /bin/sh / # wget --spider --timeout=1 10.244.4.17 Connecting to 10.244.4.17 (10.244.4.17:80) / # wget --spider --timeout=1 10.244.1.19 Connecting to 10.244.1.19 (10.244.1.19:80) / # exit [root@master01 ~]#
提示：可以看到dev名稱空間下的pod相互訪問沒有問題；
驗證：用dev名稱空間下的pod訪問default名稱空間下的pod ，看看是否可以正常訪問？
[root@master01 ~]# kubectl get pods -n dev -o wide NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES nginx-dep-cb74c595f-27qjp 1/1 Running 2 170m 10.244.1.18 node01.k8s.org <none> <none> nginx-dep-cb74c595f-b92s4 1/1 Running 1 170m 10.244.4.17 node04.k8s.org <none> <none> nginx-dep-cb74c595f-wdqnh 1/1 Running 1 170m 10.244.1.19 node01.k8s.org <none> <none> [root@master01 ~]# kubectl get pods -o wide NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES nginx-dep-cb74c595f-5mwl2 1/1 Running 1 171m 10.244.4.18 node04.k8s.org <none> <none> nginx-dep-cb74c595f-vxc9z 1/1 Running 1 171m 10.244.3.12 node03.k8s.org <none> <none> nginx-dep-cb74c595f-z265t 1/1 Running 1 171m 10.244.2.13 node02.k8s.org <none> <none> web-0 1/1 Running 8 3d22h 10.244.2.14 node02.k8s.org <none> <none> web-1 1/1 Running 7 3d22h 10.244.4.16 node04.k8s.org <none> <none> web-2 1/1 Running 8 3d22h 10.244.3.11 node03.k8s.org <none> <none> [root@master01 ~]# kubectl exec -it -n dev nginx-dep-cb74c595f-27qjp -- /bin/sh / # wget --spider --timeout=1 10.244.4.18 Connecting to 10.244.4.18 (10.244.4.18:80) / # wget --spider --timeout=1 10.244.3.12 Connecting to 10.244.3.12 (10.244.3.12:80) / # wget --spider --timeout=1 10.244.2.13 Connecting to 10.244.2.13 (10.244.2.13:80) / # wget --spider --timeout=1 10.244.2.14 Connecting to 10.244.2.14 (10.244.2.14:80) / # wget --spider --timeout=1 10.244.4.16 Connecting to 10.244.4.16 (10.244.4.16:80) wget: server returned error: HTTP/1.1 403 Forbidden / # wget --spider --timeout=1 10.244.3.11 Connecting to 10.244.3.11 (10.244.3.11:80) wget: server returned error: HTTP/1.1 403 Forbidden / #
提示：可以看到default名稱空間下的所有pod都能夠被dev名稱空間下的pod所訪問；後面顯示403是因為對應web服務沒有主頁；
驗證：使用dev名稱空間下的pod訪問prod名稱空間下的pod，看看對應pod是否能夠被訪問？
[root@master01 ~]# kubectl get ns prod --show-labels NAME STATUS AGE LABELS prod Active 118m name=prod [root@master01 ~]# kubectl get pods -n prod -o wide --show-labels NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES LABELS nginx-dep-cb74c595f-rzbv2 1/1 Running 0 118m 10.244.4.19 node04.k8s.org <none> <none> app=nginx,pod-template-hash=cb74c595f,rel=stable nginx-dep-cb74c595f-v8ssx 1/1 Running 0 118m 10.244.3.13 node03.k8s.org <none> <none> app=nginx,pod-template-hash=cb74c595f,rel=stable nginx-dep-cb74c595f-zsqcc 1/1 Running 0 118m 10.244.2.15 node02.k8s.org <none> <none> app=nginx,pod-template-hash=cb74c595f,rel=stable nginx-dep1-f85fdcdbc-kdq5b 1/1 Running 0 117m 10.244.1.21 node01.k8s.org <none> <none> app=nginx,pod-template-hash=f85fdcdbc nginx-dep1-f85fdcdbc-n8cvs 1/1 Running 0 117m 10.244.3.14 node03.k8s.org <none> <none> app=nginx,pod-template-hash=f85fdcdbc nginx-dep1-f85fdcdbc-vz2mp 1/1 Running 0 117m 10.244.4.20 node04.k8s.org <none> <none> app=nginx,pod-template-hash=f85fdcdbc [root@master01 ~]# kubectl get pods -n dev NAME READY STATUS RESTARTS AGE nginx-dep-cb74c595f-27qjp 1/1 Running 2 174m nginx-dep-cb74c595f-b92s4 1/1 Running 1 174m nginx-dep-cb74c595f-wdqnh 1/1 Running 1 174m [root@master01 ~]# kubectl exec -it -n dev nginx-dep-cb74c595f-27qjp -- /bin/sh / # wget --spider --timeout=1 10.244.4.20 Connecting to 10.244.4.20 (10.244.4.20:80) wget: download timed out / # wget --spider --timeout=1 10.244.3.14 Connecting to 10.244.3.14 (10.244.3.14:80) wget: download timed out / # wget --spider --timeout=1 10.244.1.21 Connecting to 10.244.1.21 (10.244.1.21:80) wget: download timed out / # wget --spider --timeout=1 10.244.2.15 Connecting to 10.244.2.15 (10.244.2.15:80) / # wget --spider --timeout=1 10.244.3.13 Connecting to 10.244.3.13 (10.244.3.13:80) / # wget --spider --timeout=1 10.244.4.19 Connecting to 10.244.4.19 (10.244.4.19:80) / #
提示：可以看到在prod名稱空間下對應pod標籤為app=nginx,rel=stable的pod都能夠被dev下的pod所訪問，如果對應標籤不是app=nginx,rel=stable的pod則不能被訪問到；
從上面的示例可以總結，在k8s上網路策略是白名單機制，所謂白名單機制是指，只有明確定義的策略才會被允許放行，預設沒有指定的規則就是拒絕的，即條件不匹配的都會被拒絕；其次對於ingress或egress來說，對應的from或to都是用來指定訪問端或被訪問端的資訊；如果我們在對應的欄位中沒有定義namespaceSelector欄位，預設ingress或egrss會匹配當前netpol所在名稱空間，即在沒有明確指定namespaceSelector欄位時，對應的其他條件都是針對當前netpol所在名稱空間；多個條件組合使用，如果多個條件都在一個列表中，則表示多個條件間是與關係，即指定的條件需要同時滿足對應策略才會放行；如果多個條件不再同一個列表中，則多個條件之間是或關係，即滿足其中一個條件都會被對應策略放