1. 程式人生 > >容器編排系統K8s之NetworkPolicy資源

容器編排系統K8s之NetworkPolicy資源

  前文我們瞭解了k8s的網路外掛flannel的基礎工作邏輯,回顧請參考:https://www.cnblogs.com/qiuhom-1874/p/14225657.html;今天我們來聊一下k8s上的NetworkPolicy相關話題;

  NetworkPolicy資源是做什麼用的?

  我們知道在k8s上我們可以用名稱空間來隔離多個資源,在不同名稱空間下我們可以建立相同名稱和相同型別的資源;有些資源還必須依賴名稱空間才可以被建立;但是在k8s上,名稱空間不可以隔離網路,所謂隔離網路是指不管pod建立在那個名稱空間下,都可以被其他名稱空間下pod訪問到;如果我們想要限制對應名稱空間下的pod被別的名稱空間或外部客戶端訪問,我們可以在對應名稱空間下建立NetworkPolicy資源;該資源可以限制哪些pod可以被外部客戶端訪問,或者哪些pod不能夠被哪個或哪些名稱空間的pod訪問;除了能夠限制對應名稱空間下的pod網路入站流量,它還可以限制對應名稱空間下的pod出站的流量,允許或拒絕某個或某些個pod訪問別的名稱空間下pod或外部某服務等;我們可以簡單的理解NetworkPolicy就是對應名稱空間的一道防火牆;我們把NetworkPolicy資源建立在對應名稱空間下,那麼它就能實現對該名稱空間下的pod進行流量管控;

  NetworkPolicy基礎工作邏輯

  提示:首先networkpolicy是作用於一個名稱空間下的pod資源之上而進行的流量管控;它可以通過pod選擇器來選擇對應名稱空間下pod,滿足對應選擇器的條件的pod,將受到networkpolicy中定義的策略管控,預設pod選擇器沒有明確定義表示匹配對應名稱空間下的所有pod;Egress是用來定義pod出站策略,預設顯式定義的策略都是被允許出站的,沒有定義表示拒絕;對於ingress也是同樣的邏輯,只有顯式定義的規則才被允許,沒有定義就表示拒絕;對於出站流量來說,預設我們定義或不定義它都不會生效,都是允許放行的,只有顯式配置對應出站規則生效,它才會生效;

  示例:定義dev名稱空間下的pod不允許任何客戶端訪問

[root@master01 ~]# cat denyall-ingress-dev.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all-ingress
  namespace: dev
spec:
  podSelector: {}
  policyTypes:
  - Ingress
[root@master01 ~]# 

  提示:以上資源清單表示對dev名稱空間下的pod的入站流量進行管控,拒絕所有客戶端訪問對應dev名稱空間下的pod;這其中包含dev名稱空間下的pod;

  應用資源清單

  在應用之前請確保你所部署的網路外掛支援網路策略,預設flannel網路外掛不支援網路策略,我們需要部署canel這個網路外掛,該外掛能夠結合flannel外掛,讓其擁有calico的網路策略功能;

  部署canel

[root@master01 ~]# kubectl apply -f https://docs.projectcalico.org/manifests/canal.yaml
configmap/canal-config created
customresourcedefinition.apiextensions.k8s.io/bgpconfigurations.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/bgppeers.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/blockaffinities.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/clusterinformations.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/felixconfigurations.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/globalnetworkpolicies.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/globalnetworksets.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/hostendpoints.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/ipamblocks.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/ipamconfigs.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/ipamhandles.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/ippools.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/kubecontrollersconfigurations.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/networkpolicies.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/networksets.crd.projectcalico.org created
clusterrole.rbac.authorization.k8s.io/calico-kube-controllers created
clusterrolebinding.rbac.authorization.k8s.io/calico-kube-controllers created
clusterrole.rbac.authorization.k8s.io/calico-node created
clusterrole.rbac.authorization.k8s.io/flannel configured
clusterrolebinding.rbac.authorization.k8s.io/canal-flannel created
clusterrolebinding.rbac.authorization.k8s.io/canal-calico created
daemonset.apps/canal created
serviceaccount/canal created
deployment.apps/calico-kube-controllers created
serviceaccount/calico-kube-controllers created
poddisruptionbudget.policy/calico-kube-controllers created
[root@master01 ~]# 

  提示:等待上述資源都正常執行以後,我們就可以應用資源清單,讓其網路策略生效;

  建立dev名稱空間,並在其下建立一個deploy控制器,控制器建立3個nginx pod

[root@master01 manifests]# cat pod-demo.yaml
apiVersion: v1
kind: Namespace
metadata:
  name: dev
  labels:
    name: dev
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-dep
  namespace: dev
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx
      rel: stable
  template:
    metadata:
      labels:
        app: nginx
        rel: stable
    spec:
      containers:
      - name: nginx
        image: nginx:1.14-alpine
        imagePullPolicy: IfNotPresent
        ports:
        - name: http
          containerPort: 80
[root@master01 manifests]# kubectl apply -f pod-demo.yaml
namespace/dev unchanged
deployment.apps/nginx-dep created
[root@master01 manifests]# kubectl get pods -n dev -o wide
NAME                        READY   STATUS    RESTARTS   AGE   IP           NODE             NOMINATED NODE   READINESS GATES
nginx-dep-cb74c595f-5d9tb   1/1     Running   0          51s   10.244.4.6   node04.k8s.org   <none>           <none>
nginx-dep-cb74c595f-ftmn9   1/1     Running   0          51s   10.244.1.5   node01.k8s.org   <none>           <none>
nginx-dep-cb74c595f-jf9p9   1/1     Running   0          51s   10.244.3.4   node03.k8s.org   <none>           <none>
[root@master01 manifests]# 

  在沒有應用上述網路策略前,用default裡的pod訪問對應dev名稱空間下pod,看看是否可以正常訪問?

[root@master01 manifests]# kubectl get pods -n dev -o wide
NAME                        READY   STATUS    RESTARTS   AGE   IP           NODE             NOMINATED NODE   READINESS GATES
nginx-dep-cb74c595f-5d9tb   1/1     Running   0          86s   10.244.4.6   node04.k8s.org   <none>           <none>
nginx-dep-cb74c595f-ftmn9   1/1     Running   0          86s   10.244.1.5   node01.k8s.org   <none>           <none>
nginx-dep-cb74c595f-jf9p9   1/1     Running   0          86s   10.244.3.4   node03.k8s.org   <none>           <none>
[root@master01 manifests]# kubectl get pods 
NAME    READY   STATUS    RESTARTS   AGE
web-0   1/1     Running   6          3d16h
web-1   1/1     Running   5          3d16h
web-2   1/1     Running   6          3d16h
[root@master01 manifests]# kubectl exec web-0 -it -- /bin/sh
/ # wget -O - -q 10.244.4.6
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
    body {
        width: 35em;
        margin: 0 auto;
        font-family: Tahoma, Verdana, Arial, sans-serif;
    }
</style>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>
/ # 

  提示:可以看到用default名稱空間下的pod,是可以正常訪問dev名稱空間下的pod;

  應用資源清單

[root@master01 ~]# cat denyall-ingress-dev.yaml 
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all-ingress
  namespace: dev
spec:
  podSelector: {}
  policyTypes:
  - Ingress
[root@master01 ~]# kubectl apply -f denyall-ingress-dev.yaml
networkpolicy.networking.k8s.io/deny-all-ingress created
[root@master01 ~]# kubectl get netpol -n dev
NAME               POD-SELECTOR   AGE
deny-all-ingress   <none>         10s
[root@master01 ~]# kubectl describe netpol deny-all-ingress -n dev
Name:         deny-all-ingress
Namespace:    dev
Created on:   2021-01-04 15:34:40 +0800 CST
Labels:       <none>
Annotations:  <none>
Spec:
  PodSelector:     <none> (Allowing the specific traffic to all pods in this namespace)
  Allowing ingress traffic:
    <none> (Selected pods are isolated for ingress connectivity)
  Not affecting egress traffic
  Policy Types: Ingress
[root@master01 ~]# 

  提示:從上面的netpol資源的詳細資訊中可以瞭解到,對應netpol資源pod選擇器為none表示選擇對應名稱空間下的所有pod,allowing ingress traffic 也是為none表示沒有任何客戶端允許訪問該名稱空間下的pod;沒有出站策略,表示拒絕所有出站流量;預設只是入站規則生效,所以這裡的出站規則不生效,即不限制出站流量;policyTypes表示對應的那個策略生效,預設不指定是Ingress;

  驗證:使用default名稱空間下的pod訪問dev名稱空間下的pod,看看是否還可以正常訪問?

  提示:可以看到現在default名稱空間下的pod是不能訪問dev名稱空間下的pod;

  驗證:dev名稱空間下的pod訪問同名稱空間下的pod,看看是否可以允許訪問?

  提示:可以看到在dev名稱空間下的pod也沒法訪問dev名稱空間下的pod,但是自己可以訪問自己,其原因是自己訪問自己,流量不會出站,在lo介面就被處理了,所以自己訪問自己不受限制;

  驗證:使用dev名稱空間下的pod訪問default名稱空間下的pod,看看是否被允許 ?

  提示:可以看到使用dev名稱空間下的pod訪問default名稱空間下的pod上沒有問題,說明剛才的那條規則只是現在了dev名稱空間下的pod的入站流量,並沒有限制其出站流量;上面訪問10.244.4.5和3.3響應404,是因為對應pod上的web服務沒有主頁;

  示例:限制dev名稱空間下的pod的出站流量,拒絕所有pod流量出站

[root@master01 ~]# cat denyall-Egress.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: 
  name: deny-all-egress
  namespace: dev
spec:
  podSelector: {}
  policyTypes:
  - Egress
[root@master01 ~]# 

  提示:policyTypes欄位用來控制那個型別的規則生效,該欄位是一個列表,預設是Ingress,表示只對入站流量做限制,如果明確手動定義為Egress表示,只限製出站流量;出站策略和入站策略的邏輯都是一樣的,只要沒有明且定義的,都是表示拒絕操作,只有明確定義的才表示對應允許操作;上述沒有定義任何出站規則,表示拒絕所有pod訪問外部服務;

  應用資源清單

[root@master01 ~]# kubectl apply -f denyall-Egress.yaml
networkpolicy.networking.k8s.io/deny-all-egress created
[root@master01 ~]# kubectl get netpol -n dev
NAME               POD-SELECTOR   AGE
deny-all-egress    <none>         10s
deny-all-ingress   <none>         24m
[root@master01 ~]# kubectl describe netpol deny-all-egress -n dev
Name:         deny-all-egress
Namespace:    dev
Created on:   2021-01-04 15:59:16 +0800 CST
Labels:       <none>
Annotations:  <none>
Spec:
  PodSelector:     <none> (Allowing the specific traffic to all pods in this namespace)
  Not affecting ingress traffic
  Allowing egress traffic:
    <none> (Selected pods are isolated for egress connectivity)
  Policy Types: Egress
[root@master01 ~]# 

  驗證:進入dev名稱空間下的pod互動式介面,看看是否可以訪問其他名稱空間下的pod?

  提示:可以看到現在dev名稱空間下的pod訪問default名稱空間下的pod就不能訪問了;

  驗證:刪除入站限制,使用dev名稱空間下的pod互相訪問,看看是否可以正常訪問呢?

[root@master01 ~]# kubectl get netpol -n dev
NAME               POD-SELECTOR   AGE
deny-all-egress    <none>         5m50s
deny-all-ingress   <none>         30m
[root@master01 ~]# kubectl delete netpol deny-all-ingress -n dev
networkpolicy.networking.k8s.io "deny-all-ingress" deleted
[root@master01 ~]# kubectl get netpol -n dev                    
NAME              POD-SELECTOR   AGE
deny-all-egress   <none>         6m9s
[root@master01 ~]# kubectl get pods -n dev -o wide                             
NAME                        READY   STATUS    RESTARTS   AGE   IP           NODE             NOMINATED NODE   READINESS GATES
nginx-dep-cb74c595f-5d9tb   1/1     Running   0          34m   10.244.4.6   node04.k8s.org   <none>           <none>
nginx-dep-cb74c595f-ftmn9   1/1     Running   0          34m   10.244.1.5   node01.k8s.org   <none>           <none>
nginx-dep-cb74c595f-jf9p9   1/1     Running   0          34m   10.244.3.4   node03.k8s.org   <none>           <none>
[root@master01 ~]# kubectl exec -it nginx-dep-cb74c595f-5d9tb -n dev -- /bin/sh
/ # wget -O - -q 10.244.1.5
^C
/ # wget -O - -q 10.244.3.4
^C
/ # wget -O - -q 10.244.4.6
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
    body {
        width: 35em;
        margin: 0 auto;
        font-family: Tahoma, Verdana, Arial, sans-serif;
    }
</style>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>
/ # 

  提示:可以看到限制了出站流量以後,在同一名稱空間下的pod也是無法正常訪問的;但是自己可以訪問自己;

  示例:限制dev名稱空間下的pod的出站流量,允許dev名稱空間下的pod互相訪問

[root@master01 ~]# cat allow-dev-Egress.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-dev-egress
  namespace: dev
spec:
  podSelector: {}
  egress:
    - to:
      - podSelector:
          matchLabels:
            app: nginx
            rel: stable
      ports:
      - port: 80
        protocol: TCP 
  policyTypes:
  - Egress
[root@master01 ~]# 

  提示:限制出站流量,可以在spec.egress中來定義允許的出站的規則;其中to欄位是用來描述被訪問端,其值型別是一個列表物件;podSelector欄位是用來描述被訪問端pod選擇器,只有滿足對應pod選擇器的條件的pod都被允許出站;spec.egress.ports欄位是用來描述被訪問端點埠資訊;該欄位為一個列表物件;這裡需要注意,預設沒有在規則指定其名稱空間表示匹配當前netpol所在名稱空間;以上清單表示dev下的pod允許訪問dev名稱空間下標籤為app=nginx,rel=stable的pod的80埠;

  刪除deny-all-egress出站策略,應用其資源清單

[root@master01 ~]# kubectl get netpol -n dev
NAME              POD-SELECTOR   AGE
deny-all-egress   <none>         26m
[root@master01 ~]# kubectl delete netpol deny-all-egress -n dev
networkpolicy.networking.k8s.io "deny-all-egress" deleted
[root@master01 ~]# kubectl apply -f allow-dev-Egress.yaml
networkpolicy.networking.k8s.io/allow-dev-egress created
[root@master01 ~]# kubectl get netpol -n dev
NAME               POD-SELECTOR   AGE
allow-dev-egress   <none>         10s
[root@master01 ~]# kubectl describe netpol allow-dev-egress -n dev
Name:         allow-dev-egress
Namespace:    dev
Created on:   2021-01-04 16:34:23 +0800 CST
Labels:       <none>
Annotations:  <none>
Spec:
  PodSelector:     <none> (Allowing the specific traffic to all pods in this namespace)
  Not affecting ingress traffic
  Allowing egress traffic:
    To Port: 80/TCP
    To:
      PodSelector: app=nginx,rel=stable
  Policy Types: Egress
[root@master01 ~]# 

  驗證:進入dev名稱空間下pod的裡,看看是否可以正常訪問dev名稱空間下的pod?

[root@master01 ~]# kubectl get pods -n dev -o wide
NAME                        READY   STATUS    RESTARTS   AGE   IP           NODE             NOMINATED NODE   READINESS GATES
nginx-dep-cb74c595f-5d9tb   1/1     Running   0          65m   10.244.4.6   node04.k8s.org   <none>           <none>
nginx-dep-cb74c595f-ftmn9   1/1     Running   0          65m   10.244.1.5   node01.k8s.org   <none>           <none>
nginx-dep-cb74c595f-jf9p9   1/1     Running   0          65m   10.244.3.4   node03.k8s.org   <none>           <none>
[root@master01 ~]# kubectl exec -it -n dev nginx-dep-cb74c595f-5d9tb -- /bin/sh
/ # wget -O - -q 10.244.1.5
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
    body {
        width: 35em;
        margin: 0 auto;
        font-family: Tahoma, Verdana, Arial, sans-serif;
    }
</style>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>
/ # wget -O - -q 10.244.3.4
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
    body {
        width: 35em;
        margin: 0 auto;
        font-family: Tahoma, Verdana, Arial, sans-serif;
    }
</style>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>
/ # 

  提示:可以看到dev名稱空間pod訪問dev名稱空間下的pod可以正常訪問;

  驗證:使用dev名稱空間pod訪問default名稱空間下,標籤為app=nginx,rel=stable的pod,看看是否可以正常訪問?

[root@master01 ~]# kubectl get pods -n dev 
NAME                        READY   STATUS    RESTARTS   AGE
nginx-dep-cb74c595f-27qjp   1/1     Running   2          88m
nginx-dep-cb74c595f-b92s4   1/1     Running   1          88m
nginx-dep-cb74c595f-wdqnh   1/1     Running   1          88m
[root@master01 ~]# kubectl get pods -o wide --show-labels                      
NAME                        READY   STATUS    RESTARTS   AGE     IP            NODE             NOMINATED NODE   READINESS GATES   LABELS
nginx-dep-cb74c595f-5mwl2   1/1     Running   1          89m     10.244.4.18   node04.k8s.org   <none>           <none>            app=nginx,pod-template-hash=cb74c595f,rel=stable
nginx-dep-cb74c595f-vxc9z   1/1     Running   1          89m     10.244.3.12   node03.k8s.org   <none>           <none>            app=nginx,pod-template-hash=cb74c595f,rel=stable
nginx-dep-cb74c595f-z265t   1/1     Running   1          89m     10.244.2.13   node02.k8s.org   <none>           <none>            app=nginx,pod-template-hash=cb74c595f,rel=stable
web-0                       1/1     Running   8          3d20h   10.244.2.14   node02.k8s.org   <none>           <none>            app=nginx,controller-revision-hash=web-6db9455fdf,statefulset.kubernetes.io/pod-name=web-0
web-1                       1/1     Running   7          3d20h   10.244.4.16   node04.k8s.org   <none>           <none>            app=nginx,controller-revision-hash=web-6db9455fdf,statefulset.kubernetes.io/pod-name=web-1
web-2                       1/1     Running   8          3d20h   10.244.3.11   node03.k8s.org   <none>           <none>            app=nginx,controller-revision-hash=web-6db9455fdf,statefulset.kubernetes.io/pod-name=web-2
[root@master01 ~]# kubectl exec -it nginx-dep-cb74c595f-27qjp -n dev -- /bin/sh
/ # wget -O - -q 10.244.4.18
^C
/ # wget -O - -q 10.244.3.12
^C
/ # wget -O - -q 10.244.2.13
^C
/ # 

  提示:可以看到dev名稱空間下的pod訪問default名稱空間下標籤為app=nginx,rel=stable的pod也是無法正常訪問,原因是我們在策略中沒有指定對應訪問目標的名稱空間,預設就是對應netpol所在名稱空間;

  示例:允許dev名稱空間下的pod訪問default和dev名稱空間下標籤為app=nginx,rel=stable的pod

[root@master01 ~]# cat allow-dev-def-egress.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-dev-egress
  namespace: dev
spec:
  podSelector: {} 
  egress:
    - to:
      - namespaceSelector:
          matchExpressions:
          - key: name
            operator: In
            values: ["def","dev"]
        podSelector:
          matchLabels:
            app: nginx
            rel: stable
      ports:
      - port: 80
        protocol: TCP 
  policyTypes:
  - Egress
[root@master01 ~]# 

  提示:spec.egress.to中的namespeceSelector欄位使用來描述被訪問端所在名稱空間;podSelector欄位是用來描述被訪問端的pod;如果這兩個欄位中只有一個欄位前用了“-”,那麼namespaceSelector和podSelector所指定的條件是與關係,即兩個條件必須都滿足;如果兩個欄位都用了“-”開頭,則兩個欄位所指定的條件就是或關係,即滿足其中一個欄位的條件都可以被規則匹配;上述示例表示dev下的所有pod能夠訪問名稱空間上的標籤是name=def或name=dev的名稱空間下的pod,並且這些pod的標籤必須是app=nginx,rel=stable;即要想被dev名稱空間下的pod所訪問,對應pod的應該同時滿足兩個條件,第一對應名稱空間上有name=def或者name=dev的標籤;其次pod本身要有兩個標籤,app=nginx和rel=stable;這兩個條件缺一不可;

   刪除原有netpol,應用新的清單

[root@master01 ~]# kubectl get netpol -n dev
NAME               POD-SELECTOR   AGE
allow-dev-egress   <none>         28m
[root@master01 ~]# kubectl delete netpol allow-dev-egress -n dev
networkpolicy.networking.k8s.io "allow-dev-egress" deleted
[root@master01 ~]# kubectl apply -f allow-dev-def-egress.yaml 
networkpolicy.networking.k8s.io/allow-dev-egress created
[root@master01 ~]# kubectl get netpol -n dev                    
NAME               POD-SELECTOR   AGE
allow-dev-egress   <none>         5s
[root@master01 ~]# kubectl describe netpol allow-dev-egress -n dev
Name:         allow-dev-egress
Namespace:    dev
Created on:   2021-01-04 19:44:32 +0800 CST
Labels:       <none>
Annotations:  <none>
Spec:
  PodSelector:     <none> (Allowing the specific traffic to all pods in this namespace)
  Not affecting ingress traffic
  Allowing egress traffic:
    To Port: 80/TCP
    To:
      NamespaceSelector: name in (def,dev)
      PodSelector: app=nginx,rel=stable
  Policy Types: Egress
[root@master01 ~]# 

  提示:可以看到對應的出站規則就有兩個條件,首先稱空間必須匹配,name=def或者name=dev,即對應名稱空間必須要這樣的標籤;其次pod必須滿足有app=nginx,rel=stable的標籤;

  給default名稱空間打上name=def的標籤

[root@master01 ~]# kubectl get ns --show-labels
NAME                   STATUS   AGE     LABELS
default                Active   27d     <none>
dev                    Active   4h24m   name=dev
ingress-nginx          Active   13d     app.kubernetes.io/name=ingress-nginx,app.kubernetes.io/part-of=ingress-nginx
kube-node-lease        Active   27d     <none>
kube-public            Active   27d     <none>
kube-system            Active   27d     <none>
kubernetes-dashboard   Active   2d5h    <none>
prod                   Active   57m     name=prod
[root@master01 ~]# kubectl label ns default name=def
namespace/default labeled
[root@master01 ~]# kubectl get ns --show-labels     
NAME                   STATUS   AGE     LABELS
default                Active   27d     name=def
dev                    Active   4h24m   name=dev
ingress-nginx          Active   13d     app.kubernetes.io/name=ingress-nginx,app.kubernetes.io/part-of=ingress-nginx
kube-node-lease        Active   27d     <none>
kube-public            Active   27d     <none>
kube-system            Active   27d     <none>
kubernetes-dashboard   Active   2d5h    <none>
prod                   Active   58m     name=prod
[root@master01 ~]# 

  驗證:用dev下的pod訪問default和dev名稱空間下pod標籤為app=nginx,rel=stable的pod,看看對應pod是否能夠被訪問到?

[root@master01 ~]# kubectl get pods -n dev -o wide --show-labels
NAME                        READY   STATUS    RESTARTS   AGE    IP            NODE             NOMINATED NODE   READINESS GATES   LABELS
nginx-dep-cb74c595f-27qjp   1/1     Running   2          116m   10.244.1.18   node01.k8s.org   <none>           <none>            app=nginx,pod-template-hash=cb74c595f,rel=stable
nginx-dep-cb74c595f-b92s4   1/1     Running   1          116m   10.244.4.17   node04.k8s.org   <none>           <none>            app=nginx,pod-template-hash=cb74c595f,rel=stable
nginx-dep-cb74c595f-wdqnh   1/1     Running   1          116m   10.244.1.19   node01.k8s.org   <none>           <none>            app=nginx,pod-template-hash=cb74c595f,rel=stable
[root@master01 ~]# kubectl get pods  -o wide --show-labels      
NAME                        READY   STATUS    RESTARTS   AGE     IP            NODE             NOMINATED NODE   READINESS GATES   LABELS
nginx-dep-cb74c595f-5mwl2   1/1     Running   1          117m    10.244.4.18   node04.k8s.org   <none>           <none>            app=nginx,pod-template-hash=cb74c595f,rel=stable
nginx-dep-cb74c595f-vxc9z   1/1     Running   1          117m    10.244.3.12   node03.k8s.org   <none>           <none>            app=nginx,pod-template-hash=cb74c595f,rel=stable
nginx-dep-cb74c595f-z265t   1/1     Running   1          117m    10.244.2.13   node02.k8s.org   <none>           <none>            app=nginx,pod-template-hash=cb74c595f,rel=stable
web-0                       1/1     Running   8          3d21h   10.244.2.14   node02.k8s.org   <none>           <none>            app=nginx,controller-revision-hash=web-6db9455fdf,statefulset.kubernetes.io/pod-name=web-0
web-1                       1/1     Running   7          3d21h   10.244.4.16   node04.k8s.org   <none>           <none>            app=nginx,controller-revision-hash=web-6db9455fdf,statefulset.kubernetes.io/pod-name=web-1
web-2                       1/1     Running   8          3d21h   10.244.3.11   node03.k8s.org   <none>           <none>            app=nginx,controller-revision-hash=web-6db9455fdf,statefulset.kubernetes.io/pod-name=web-2
[root@master01 ~]# kubectl exec -it -n dev nginx-dep-cb74c595f-27qjp -- /bin/sh
/ # wget --spider --timeout=1 10.244.4.17
Connecting to 10.244.4.17 (10.244.4.17:80)
/ # wget --spider --timeout=1 10.244.1.19 
Connecting to 10.244.1.19 (10.244.1.19:80)
/ # wget --spider --timeout=1 10.244.4.18
Connecting to 10.244.4.18 (10.244.4.18:80)
/ # wget --spider --timeout=1 10.244.3.12
Connecting to 10.244.3.12 (10.244.3.12:80)
/ # wget --spider --timeout=1 10.244.2.13
Connecting to 10.244.2.13 (10.244.2.13:80)
/ # wget --spider --timeout=1 10.244.2.14
Connecting to 10.244.2.14 (10.244.2.14:80)
wget: download timed out
/ # 

  提示:可以看到用dev名稱空間的pod訪問名稱空間上有name=def或name=dev標籤並且對應pod上有app=nginx和rel=stable的標籤的pod是能夠正常訪問到,如果不能滿足對應名稱空間和pod標籤的pod就不能被訪問;上面示例中最後一個podip不滿足pod的標籤,所以訪問不到對應pod;

  示例:允許dev名稱空間下的pod訪問名稱空間上有name=def或name=dev標籤的名稱空間下的pod或者名稱空間上有name=prod標籤,並且對應名稱空間下的pod必須有app=nginx,rel=stable的標籤;

[root@master01 ~]# cat allow-dev-def-egress.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-dev-egress
  namespace: dev
spec:
  podSelector: {} 
  egress:
    - to:
      - namespaceSelector:
          matchExpressions:
          - key: name
            operator: In
            values: ["def","dev"]
    - to:
      - namespaceSelector:
          matchLables:
            name: prod
        podSelector:
          matchLabels:
            app: nginx
            rel: stable
      ports:
      - port: 80
        protocol: TCP 
  policyTypes:
  - Egress
[root@master01 ~]# 

  應用配置清單

[root@master01 ~]# kubectl apply -f allow-dev-def-egress.yaml
networkpolicy.networking.k8s.io/allow-dev-egress created
[root@master01 ~]# kubectl get netpol -n dev
NAME               POD-SELECTOR   AGE
allow-dev-egress   <none>         10s
[root@master01 ~]# kubectl describe netpol allow-dev-egress -n dev
Name:         allow-dev-egress
Namespace:    dev
Created on:   2021-01-04 20:44:42 +0800 CST
Labels:       <none>
Annotations:  <none>
Spec:
  PodSelector:     <none> (Allowing the specific traffic to all pods in this namespace)
  Not affecting ingress traffic
  Allowing egress traffic:
    To Port: <any> (traffic allowed to all ports)
    To:
      NamespaceSelector: name in (def,dev)
    ----------
    To Port: 80/TCP
    To:
      NamespaceSelector: name=prod
      PodSelector: app=nginx,rel=stable
  Policy Types: Egress
[root@master01 ~]# 

  驗證:用dev名稱空間下的pod訪問dev名稱空間下的pod,看看是否可以正常訪問?

[root@master01 ~]# kubectl get pods -n dev -o wide 
NAME                        READY   STATUS    RESTARTS   AGE    IP            NODE             NOMINATED NODE   READINESS GATES
nginx-dep-cb74c595f-27qjp   1/1     Running   2          168m   10.244.1.18   node01.k8s.org   <none>           <none>
nginx-dep-cb74c595f-b92s4   1/1     Running   1          168m   10.244.4.17   node04.k8s.org   <none>           <none>
nginx-dep-cb74c595f-wdqnh   1/1     Running   1          168m   10.244.1.19   node01.k8s.org   <none>           <none>
[root@master01 ~]# kubectl exec -it -n dev nginx-dep-cb74c595f-27qjp -- /bin/sh
/ # wget --spider --timeout=1 10.244.4.17
Connecting to 10.244.4.17 (10.244.4.17:80)
/ # wget --spider --timeout=1 10.244.1.19
Connecting to 10.244.1.19 (10.244.1.19:80)
/ # exit
[root@master01 ~]# 

  提示:可以看到dev名稱空間下的pod相互訪問沒有問題;

  驗證:用dev名稱空間下的pod訪問default名稱空間下的pod ,看看是否可以正常訪問?

[root@master01 ~]# kubectl get pods -n dev -o wide
NAME                        READY   STATUS    RESTARTS   AGE    IP            NODE             NOMINATED NODE   READINESS GATES
nginx-dep-cb74c595f-27qjp   1/1     Running   2          170m   10.244.1.18   node01.k8s.org   <none>           <none>
nginx-dep-cb74c595f-b92s4   1/1     Running   1          170m   10.244.4.17   node04.k8s.org   <none>           <none>
nginx-dep-cb74c595f-wdqnh   1/1     Running   1          170m   10.244.1.19   node01.k8s.org   <none>           <none>
[root@master01 ~]# kubectl get pods -o wide
NAME                        READY   STATUS    RESTARTS   AGE     IP            NODE             NOMINATED NODE   READINESS GATES
nginx-dep-cb74c595f-5mwl2   1/1     Running   1          171m    10.244.4.18   node04.k8s.org   <none>           <none>
nginx-dep-cb74c595f-vxc9z   1/1     Running   1          171m    10.244.3.12   node03.k8s.org   <none>           <none>
nginx-dep-cb74c595f-z265t   1/1     Running   1          171m    10.244.2.13   node02.k8s.org   <none>           <none>
web-0                       1/1     Running   8          3d22h   10.244.2.14   node02.k8s.org   <none>           <none>
web-1                       1/1     Running   7          3d22h   10.244.4.16   node04.k8s.org   <none>           <none>
web-2                       1/1     Running   8          3d22h   10.244.3.11   node03.k8s.org   <none>           <none>
[root@master01 ~]# kubectl exec -it -n dev nginx-dep-cb74c595f-27qjp -- /bin/sh
/ # wget --spider --timeout=1 10.244.4.18
Connecting to 10.244.4.18 (10.244.4.18:80)
/ # wget --spider --timeout=1 10.244.3.12
Connecting to 10.244.3.12 (10.244.3.12:80)
/ # wget --spider --timeout=1 10.244.2.13
Connecting to 10.244.2.13 (10.244.2.13:80)
/ # wget --spider --timeout=1 10.244.2.14
Connecting to 10.244.2.14 (10.244.2.14:80)
/ # wget --spider --timeout=1 10.244.4.16
Connecting to 10.244.4.16 (10.244.4.16:80)
wget: server returned error: HTTP/1.1 403 Forbidden
/ # wget --spider --timeout=1 10.244.3.11
Connecting to 10.244.3.11 (10.244.3.11:80)
wget: server returned error: HTTP/1.1 403 Forbidden
/ # 

  提示:可以看到default名稱空間下的所有pod都能夠被dev名稱空間下的pod所訪問;後面顯示403是因為對應web服務沒有主頁;

  驗證:使用dev名稱空間下的pod訪問prod名稱空間下的pod,看看對應pod是否能夠被訪問?

[root@master01 ~]# kubectl get ns prod --show-labels
NAME   STATUS   AGE    LABELS
prod   Active   118m   name=prod
[root@master01 ~]# kubectl get pods -n prod -o wide --show-labels
NAME                         READY   STATUS    RESTARTS   AGE    IP            NODE             NOMINATED NODE   READINESS GATES   LABELS
nginx-dep-cb74c595f-rzbv2    1/1     Running   0          118m   10.244.4.19   node04.k8s.org   <none>           <none>            app=nginx,pod-template-hash=cb74c595f,rel=stable
nginx-dep-cb74c595f-v8ssx    1/1     Running   0          118m   10.244.3.13   node03.k8s.org   <none>           <none>            app=nginx,pod-template-hash=cb74c595f,rel=stable
nginx-dep-cb74c595f-zsqcc    1/1     Running   0          118m   10.244.2.15   node02.k8s.org   <none>           <none>            app=nginx,pod-template-hash=cb74c595f,rel=stable
nginx-dep1-f85fdcdbc-kdq5b   1/1     Running   0          117m   10.244.1.21   node01.k8s.org   <none>           <none>            app=nginx,pod-template-hash=f85fdcdbc
nginx-dep1-f85fdcdbc-n8cvs   1/1     Running   0          117m   10.244.3.14   node03.k8s.org   <none>           <none>            app=nginx,pod-template-hash=f85fdcdbc
nginx-dep1-f85fdcdbc-vz2mp   1/1     Running   0          117m   10.244.4.20   node04.k8s.org   <none>           <none>            app=nginx,pod-template-hash=f85fdcdbc
[root@master01 ~]# kubectl get pods -n dev
NAME                        READY   STATUS    RESTARTS   AGE
nginx-dep-cb74c595f-27qjp   1/1     Running   2          174m
nginx-dep-cb74c595f-b92s4   1/1     Running   1          174m
nginx-dep-cb74c595f-wdqnh   1/1     Running   1          174m
[root@master01 ~]# kubectl exec -it -n dev nginx-dep-cb74c595f-27qjp -- /bin/sh
/ # wget --spider --timeout=1 10.244.4.20 
Connecting to 10.244.4.20 (10.244.4.20:80)
wget: download timed out
/ # wget --spider --timeout=1 10.244.3.14 
Connecting to 10.244.3.14 (10.244.3.14:80)
wget: download timed out
/ # wget --spider --timeout=1 10.244.1.21
Connecting to 10.244.1.21 (10.244.1.21:80)
wget: download timed out
/ # wget --spider --timeout=1 10.244.2.15
Connecting to 10.244.2.15 (10.244.2.15:80)
/ # wget --spider --timeout=1 10.244.3.13
Connecting to 10.244.3.13 (10.244.3.13:80)
/ # wget --spider --timeout=1 10.244.4.19
Connecting to 10.244.4.19 (10.244.4.19:80)
/ # 

  提示:可以看到在prod名稱空間下對應pod標籤為app=nginx,rel=stable的pod都能夠被dev下的pod所訪問,如果對應標籤不是app=nginx,rel=stable的pod則不能被訪問到;

  從上面的示例可以總結,在k8s上網路策略是白名單機制,所謂白名單機制是指,只有明確定義的策略才會被允許放行,預設沒有指定的規則就是拒絕的,即條件不匹配的都會被拒絕;其次對於ingress或egress來說,對應的from或to都是用來指定訪問端或被訪問端的資訊;如果我們在對應的欄位中沒有定義namespaceSelector欄位,預設ingress或egrss會匹配當前netpol所在名稱空間,即在沒有明確指定namespaceSelector欄位時,對應的其他條件都是針對當前netpol所在名稱空間;多個條件組合使用,如果多個條件都在一個列表中,則表示多個條件間是與關係,即指定的條件需要同時滿足對應策略才會放行;如果多個條件不再同一個列表中,則多個條件之間是或關係,即滿足其中一個條件都會被對應策略放