首先分别在两个namespace创建pod:
apiVersion: v1
kind: Namespace
metadata:
name: network-policy-1
---
apiVersion: v1
kind: Namespace
metadata:
name: network-policy-2
---
apiVersion: v1
kind: Pod
metadata:
name: busybox-1
namespace: network-policy-1
labels:
name: busybox-1
spec:
containers:
- name: busybox
image: busybox:1.28
command: ['sh','-c','sleep 3600']
imagePullPolicy: IfNotPresent
---
apiVersion: v1
kind: Pod
metadata:
name: busybox-2
namespace: network-policy-2
labels:
name: busybox-2
spec:
containers:
- name: busybox
image: busybox:1.28
command: ['sh','-c','sleep 3600']
imagePullPolicy: IfNotPresent
未部署NetworkPolicy之前,两个不同namespace的pod是可以相互通信的。
busybox-2 1/1 Running 0 23s 10.244.139.253 k8s-calico-node02 <none> <none>
❯ kubectl get pod -n network-policy-1 -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
busybox-1 1/1 Running 0 26s 10.244.195.91 k8s-calico-master <none> <none>
#刚开始busybox-1和busybox-2是可以互相访问的
❯ kubectl exec -n network-policy-1 busybox-1 -- ping 10.244.139.253
PING 10.244.139.253 (10.244.139.253): 56 data bytes
64 bytes from 10.244.139.253: seq=0 ttl=62 time=1.220 ms
64 bytes from 10.244.139.253: seq=1 ttl=62 time=1.079 ms
64 bytes from 10.244.139.253: seq=2 ttl=62 time=1.093 ms
64 bytes from 10.244.139.253: seq=3 ttl=62 time=1.044 ms
❯ kubectl exec -n network-policy-2 busybox-2 -- ping 10.244.195.91
PING 10.244.195.91 (10.244.195.91): 56 data bytes
64 bytes from 10.244.195.91: seq=0 ttl=62 time=0.998 ms
64 bytes from 10.244.195.91: seq=1 ttl=62 time=1.230 ms
部署一条NetworkPolicy,作用在namespace为network-policy-1的pod上,禁止入访流量:
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-deny-ingress
namespace: network-policy-1 #networkPolicy配置在busybox-1的namespace,不允许外部流量主动访问
spec:
podSelector: {}
#policyType写了Ingress,在Ingress里没写内容,表示拒绝所有ingress流量
policyTypes:
- Ingress
#busybox-1可以访问busybox-2
❯ kubectl exec -n network-policy-1 busybox-1 -- ping 10.244.139.253
PING 10.244.139.253 (10.244.139.253): 56 data bytes
64 bytes from 10.244.139.253: seq=0 ttl=62 time=2.895 ms
64 bytes from 10.244.139.253: seq=1 ttl=62 time=0.605 ms
#busybox-2无法访问busybox-1
❯ kubectl exec -n network-policy-2 busybox-2 -- ping 10.244.195.91
^C
在前面那条NetworkPolicy不删除的同时,添加一条允许所有入访流量的networkPolicy,流量最终会允许。可以看到只要流量能够匹配到一条满足放行的NetworkPolicy,则流量就会被放行。
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-all-ingress
namespace: network-policy-1
spec:
podSelector: {}
#policyType写了Ingress,在ingress写了{},表示放行所有ingress流量
ingress:
- {}
policyTypes:
- Ingress
#两条networkPolicy同时存在
❯ kubectl get -n network-policy-1 networkpolicies.networking.k8s.io
NAME POD-SELECTOR AGE
allow-all-ingress <none> 27s
default-deny-ingress <none> 94s
#busybox-2重新可以访问busybox-1了
❯ kubectl exec -n network-policy-2 busybox-2 -- ping 10.244.195.91
PING 10.244.195.91 (10.244.195.91): 56 data bytes
64 bytes from 10.244.195.91: seq=0 ttl=62 time=1.057 ms
64 bytes from 10.244.195.91: seq=1 ttl=62 time=0.872 ms
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: network-policy-cidr
namespace: network-policy-1
spec:
podSelector:
matchLabels:
name: centos-1 #只有pod的label为name=centos-1的pod才会收到下面的policy的约束
policyTypes:
- Ingress
ingress:
- from:
- namespaceSelector:
matchLabels:
project: centos-2
- podSelector:
matchLabels:
name: centos-2
- ipBlock:
cidr: 10.244.0.0/16 #只允许源是10.244.0.0/16的网段来访问
except:
- 10.244.195.0/24 #源是10.244.195.0/24的网段不允许来访问
ports:
- protocol: TCP
port: 80 #只有80端口允许被访问
查看生成的具体规则
❯ kubectl describe -n network-policy-1 networkpolicies.
Name: network-policy-cidr
Namespace: network-policy-1
Created on: 2020-05-19 21:01:49 +0800 CST
Labels: <none>
Annotations: kubectl.kubernetes.io/last-applied-configuration:
{"apiVersion":"networking.k8s.io/v1","kind":"NetworkPolicy","metadata":{"annotations":{},"name":"network-policy-cidr","namespace":"network...
Spec:
PodSelector: name=centos-1
Allowing ingress traffic:
To Port: 80/TCP
From:
NamespaceSelector: project=centos-2
From:
PodSelector: name=centos-2
From:
IPBlock:
CIDR: 10.244.0.0/16
Except: 10.244.195.0/24
现在尝试在不同条件下(namespace label,pod label,pod ip地址)去访问名为centos-1的pod,以下表格为整理出的不同条件下的访问结果:(这里的策略是或的关系,只要满足一个就放行)
以下黑色字体加粗的为不满足要求的条件:
namespace label | pod label | pod CIDR | 访问centos1的80端口 | ping |
---|---|---|---|---|
project=centos-2 | name=centos-2 | 10.244.139.0/24 | 可以 | 不可以 |
project=centos-2 | name=centos-2 | 10.244.195.0/24 | 可以 | 不可以 |
project=centos-2 | 无 | 10.244.139.0/24 | 可以 | 不可以 |
无 | name=centos-2 | 10.244.139.0/24 | 可以 | 不可以 |
无 | 无 | 10.244.139.0/24 | 可以 | 不可以 |
无 | name=centos-2 | 10.244.195.0/24 | 可以 | 不可以 |
project=centos-2 | 无 | 10.244.195.0/24 | 可以 | 不可以 |
无 | 无 | 10.244.195.0/24 | 不可以 | 不可以 |
这个策略表示放行namespace label为project=centos2这个命名空间中的pod,或者pod label为name=centos2的pod:
ingress:
- from:
- namespaceSelector:
matchLabels:
project: centos-2
- podSelector:
matchLabels:
name: centos-2
注意观察,podSelector
前面没有-
,此时namespaceSelector和podSelector是与的关系,表示放行的是在namespace label为project=centos2这个命名空间中,并且pod的label为name=centos2的pod。
ingress:
- from:
- namespaceSelector:
matchLabels:
project: centos-2
podSelector:
matchLabels:
name: centos-2
通过https://orca.tufin.io/netpol/ 网站上可以对networkPolicy做可视化展示:
ingress:
egress: