NetworkPolicy Ingress及Egress简介及案例

标签：kubectl Ingress NetworkPolicy deploy python easzlab Egress pod root

一、NetworkPolicy简介

官方介绍：https://kubernetes.io/zh/docs/concepts/services-networking/network-policies/
基于NetworkPolicy在三层(网络层)或四层(传输层)控制拒绝或允许请求流量。

允许或拒绝特定的pod请求目的namespace中的目的pod的所有或指定端口。
允许或拒绝特定的namespace请求目的namespace中的所有或特定的pod所有或指定端口。
允许或拒绝特定的源IP范围或IP地址请求目的pod的所有或特定端口。

二、NetworkPolicy环境准备

2.1、环境条件

环境：

1.kubernetes 1.24.x， calico网络组件， 2个node节点或以上。
2.两个namespace， linux和python，分别代表不同项目的Pod。
3.每个namespace 运行多个pod，且pod可以运行在不同的node主机。
4.测试环境为每个namespace分别运行一个nginx和一个tomcat pod，用于测试不同主机的Pod运行在同一个ns的场景、以及跨ns的访问通信及访问限制。

创建namespace：

# kubectl create ns linux
# kubectl create ns python
# kubectl label ns linux nsname=linux
# kubectl label ns python nsname=python

2.2、部署测试web服务

1.linux ns部署nginx和tomcat，并让nginx可以将来自于/app的请求转发至当前namespace的tomcat pod。
2.python ns部署nginx和tomcat，并让nginx可以将来自于/app的请求转发至当前namespace的tomcat pod。
3.测试运行在linux ns的nginx能否将请求转发至运行在python ns的tomcat：
4.测试容器(创建多个pod用于后期从不同的节点进行测试)：

#创建测试Pod,用于测试访问目的nginx、 tomcat等业务pod：
~# kubectl run net-test-centos-pod1 --image=centos:7.9.2009 sleep 10000000 -n linux
~# kubectl run net-test-centos-pod1 --image=centos:7.9.2009 sleep 10000000 -n python
~# kubectl run centos-net-test1 --image=centos:7.9.2009 sleep 360000 #测试容器

[root@easzlab-deploy ~]# kubectl create ns linux
namespace/linux created
[root@easzlab-deploy ~]# kubectl create ns python
namespace/python created
[root@easzlab-deploy ~]# kubectl label ns linux nsname=linux
namespace/linux labeled
[root@easzlab-deploy ~]# kubectl label ns python nsname=python
namespace/python labeled
[root@easzlab-deploy ~]# kubectl run net-test-centos-pod1 --image=centos:7.9.2009 sleep 10000000 -n linux
pod/net-test-centos-pod1 created
[root@easzlab-deploy ~]# kubectl run net-test-centos-pod1 --image=centos:7.9.2009 sleep 10000000 -n python
pod/net-test-centos-pod1 created
[root@easzlab-deploy ~]# kubectl run centos-net-test1 --image=centos:7.9.2009 sleep 360000
pod/centos-net-test1 created
[root@easzlab-deploy ~]# kubectl get pod -n linux -owide
NAME                   READY   STATUS    RESTARTS   AGE   IP              NODE            NOMINATED NODE   READINESS GATES
net-test-centos-pod1   1/1     Running   0          80s   10.200.40.226   172.16.88.160   <none>           <none>
[root@easzlab-deploy ~]# kubectl get pod -n python -owide
NAME                   READY   STATUS    RESTARTS   AGE   IP              NODE            NOMINATED NODE   READINESS GATES
net-test-centos-pod1   1/1     Running   0          77s   10.200.40.227   172.16.88.160   <none>           <none>
[root@easzlab-deploy ~]#
[root@easzlab-deploy python-ns2]# kubectl get pod -owide
NAME               READY   STATUS    RESTARTS   AGE     IP              NODE            NOMINATED NODE   READINESS GATES
centos-net-test1   1/1     Running   0          3m58s   10.200.233.75   172.16.88.161   <none>           <none>
[root@easzlab-deploy python-ns2]#

在linux-ns1下准备服务部署文件

[root@easzlab-deploy linux-ns1]# cat nginx.yaml 
kind: Deployment
#apiVersion: extensions/v1beta1
apiVersion: apps/v1
metadata:
  labels:
    app: linux-nginx-deployment-label
  name: linux-nginx-deployment
  namespace: linux
spec:
  replicas: 1
  selector:
    matchLabels:
      app: linux-nginx-selector
  template:
    metadata:
      labels:
        app: linux-nginx-selector
    spec:
      containers:
      - name: linux-nginx-container
        image: nginx:1.20.2-alpine 
        #command: ["/apps/tomcat/bin/run_tomcat.sh"]
        #imagePullPolicy: IfNotPresent
        imagePullPolicy: Always
        ports:
        - containerPort: 80
          protocol: TCP
          name: http
        - containerPort: 443
          protocol: TCP
          name: https
        env:
        - name: "password"
          value: "123456"
        - name: "age"
          value: "18"
#        resources:
#          limits:
#            cpu: 2
#            memory: 2Gi
#          requests:
#            cpu: 500m
#            memory: 1Gi

---
kind: Service
apiVersion: v1
metadata:
  labels:
    app: linux-nginx-service-label
  name: linux-nginx-service
  namespace: linux
spec:
  type: NodePort
  ports:
  - name: http
    port: 80
    protocol: TCP
    targetPort: 80
    nodePort: 30008
  - name: https
    port: 443
    protocol: TCP
    targetPort: 443
    nodePort: 30443
  selector:
    app: linux-nginx-selector
[root@easzlab-deploy linux-ns1]#
[root@easzlab-deploy linux-ns1]# cat tomcat.yaml 
kind: Deployment
#apiVersion: extensions/v1beta1
apiVersion: apps/v1
metadata:
  labels:
    app: linux-tomcat-app1-deployment-label
  name: linux-tomcat-app1-deployment
  namespace: linux
spec:
  replicas: 1
  selector:
    matchLabels:
      app: linux-tomcat-app1-selector
  template:
    metadata:
      labels:
        app: linux-tomcat-app1-selector
    spec:
      containers:
      - name: linux-tomcat-app1-container
        image: tomcat:7.0.109-jdk8-openjdk 
        #command: ["/apps/tomcat/bin/run_tomcat.sh"]
        #imagePullPolicy: IfNotPresent
        imagePullPolicy: Always
        ports:
        - containerPort: 8080
          protocol: TCP
          name: http
        env:
        - name: "password"
          value: "123456"
        - name: "age"
          value: "18"
#        resources:
#          limits:
#            cpu: 2
#            memory: 2Gi
#          requests:
#            cpu: 500m
#            memory: 1Gi

---
kind: Service
apiVersion: v1
metadata:
  labels:
    app: linux-tomcat-app1-service-label
  name: linux-tomcat-app1-service
  namespace: linux
spec:
  type: NodePort
  ports:
  - name: http
    port: 80
    protocol: TCP
    targetPort: 8080
    nodePort: 30006
  selector:
    app: linux-tomcat-app1-selector
[root@easzlab-deploy linux-ns1]#
[root@easzlab-deploy linux-ns1]# kubectl apply -f nginx.yaml 
deployment.apps/linux-nginx-deployment created
service/linux-nginx-service created
[root@easzlab-deploy linux-ns1]# 
[root@easzlab-deploy linux-ns1]# kubectl apply -f tomcat.yaml 
deployment.apps/linux-tomcat-app1-deployment created
service/linux-tomcat-app1-service created
[root@easzlab-deploy linux-ns1]#
[root@easzlab-deploy linux-ns1]# kubectl get pod -n linux -owide
NAME                                            READY   STATUS    RESTARTS   AGE     IP              NODE            NOMINATED NODE   READINESS GATES
linux-nginx-deployment-864bcf5f4c-vnssz         1/1     Running   0          2m27s   10.200.40.228   172.16.88.160   <none>           <none>
linux-tomcat-app1-deployment-78c6ff7749-l6sf2   1/1     Running   0          2m21s   10.200.40.229   172.16.88.160   <none>           <none>
net-test-centos-pod1                            1/1     Running   0          3h10m   10.200.40.226   172.16.88.160   <none>           <none>
[root@easzlab-deploy linux-ns1]# 
[root@easzlab-deploy linux-ns1]# kubectl get svc -n linux
NAME                        TYPE       CLUSTER-IP       EXTERNAL-IP   PORT(S)                      AGE
linux-nginx-service         NodePort   10.100.89.84     <none>        80:30008/TCP,443:30443/TCP   2m51s
linux-tomcat-app1-service   NodePort   10.100.238.159   <none>        80:30006/TCP                 2m44s
[root@easzlab-deploy linux-ns1]#

在python-ns2文件下准备部署文件

[root@easzlab-deploy python-ns2]# cat nginx.yaml 
kind: Deployment
#apiVersion: extensions/v1beta1
apiVersion: apps/v1
metadata:
  labels:
    app: python-nginx-deployment-label
  name: python-nginx-deployment
  namespace: python
spec:
  replicas: 1
  selector:
    matchLabels:
      app: python-nginx-selector
  template:
    metadata:
      labels:
        app: python-nginx-selector
        project: python
    spec:
      containers:
      - name: python-nginx-container
        image: nginx:1.20.2-alpine
        #command: ["/apps/tomcat/bin/run_tomcat.sh"]
        #imagePullPolicy: IfNotPresent
        imagePullPolicy: Always
        ports:
        - containerPort: 80
          protocol: TCP
          name: http
        - containerPort: 443
          protocol: TCP
          name: https
        env:
        - name: "password"
          value: "123456"
        - name: "age"
          value: "18"
#        resources:
#          limits:
#            cpu: 2
#            memory: 2Gi
#          requests:
#            cpu: 500m
#            memory: 1Gi

---
kind: Service
apiVersion: v1
metadata:
  labels:
    app: python-nginx-service-label
  name: python-nginx-service
  namespace: python
spec:
  type: NodePort
  ports:
  - name: http
    port: 80
    protocol: TCP
    targetPort: 80
    nodePort: 30016
  - name: https
    port: 443
    protocol: TCP
    targetPort: 443
    nodePort: 30456
  selector:
    app: python-nginx-selector
    project: python #一个或多个selector，至少能匹配目标pod的一个标签 
[root@easzlab-deploy python-ns2]# 
[root@easzlab-deploy python-ns2]# cat tomcat.yaml 
kind: Deployment
#apiVersion: extensions/v1beta1
apiVersion: apps/v1
metadata:
  labels:
    app: python-tomcat-app1-deployment-label
  name: python-tomcat-app1-deployment
  namespace: python
spec:
  replicas: 1
  selector:
    matchLabels:
      app: python-tomcat-app1-selector
  template:
    metadata:
      labels:
        app: python-tomcat-app1-selector
    spec:
      nodeName: 172.16.88.160
      containers:
      - name: python-tomcat-app1-container
        image: tomcat:7.0.109-jdk8-openjdk 
        #command: ["/apps/tomcat/bin/run_tomcat.sh"]
        #imagePullPolicy: IfNotPresent
        imagePullPolicy: Always
        ports:
        - containerPort: 8080
          protocol: TCP
          name: http
        env:
        - name: "password"
          value: "123456"
        - name: "age"
          value: "18"
#        resources:
#          limits:
#            cpu: 2
#            memory: 2Gi
#          requests:
#            cpu: 500m
#            memory: 1Gi

---
kind: Service
apiVersion: v1
metadata:
  labels:
    app: python-tomcat-app1-service-label
  name: python-tomcat-app1-service
  namespace: python
spec:
  type: NodePort
  ports:
  - name: http
    port: 80
    protocol: TCP
    targetPort: 8080
    nodePort: 30015
  selector:
    app: python-tomcat-app1-selector
[root@easzlab-deploy python-ns2]# 
[root@easzlab-deploy python-ns2]# kubectl apply -f nginx.yaml 
deployment.apps/python-nginx-deployment created
service/python-nginx-service created
[root@easzlab-deploy python-ns2]# 
[root@easzlab-deploy python-ns2]# kubectl apply -f tomcat.yaml 
deployment.apps/python-tomcat-app1-deployment created
service/python-tomcat-app1-service created
[root@easzlab-deploy python-ns2]#
[root@easzlab-deploy python-ns2]# kubectl get pod -n python -owide
NAME                                             READY   STATUS    RESTARTS   AGE     IP              NODE            NOMINATED NODE   READINESS GATES
net-test-centos-pod1                             1/1     Running   0          5h47m   10.200.40.227   172.16.88.160   <none>           <none>
python-nginx-deployment-5c658bf86b-l4q6h         1/1     Running   0          152m    10.200.40.230   172.16.88.160   <none>           <none>
python-tomcat-app1-deployment-5b9c8d6d9c-958lp   1/1     Running   0          58m     10.200.40.234   172.16.88.160   <none>           <none>
[root@easzlab-deploy python-ns2]# 
[root@easzlab-deploy python-ns2]# kubectl get svc -n python
NAME                         TYPE       CLUSTER-IP       EXTERNAL-IP   PORT(S)                      AGE
python-nginx-service         NodePort   10.100.151.110   <none>        80:30016/TCP,443:30456/TCP   152m
python-tomcat-app1-service   NodePort   10.100.179.187   <none>        80:30015/TCP                 58m
[root@easzlab-deploy python-ns2]#

创建nginx测试页面

[root@easzlab-deploy python-ns2]# kubectl exec -it -n linux  linux-nginx-deployment-864bcf5f4c-vnssz sh
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead./ # cd /usr/share/nginx/html/
/usr/share/nginx/html # echo "networkpolicy-linux-nginx-20221031-test" > index.html 
/usr/share/nginx/html # 

[root@easzlab-deploy python-ns2]# kubectl exec -it -n python python-nginx-deployment-5c658bf86b-l4q6h sh
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
/ # cd /usr/share/nginx/html//usr/share/nginx/html # echo "networkpolicy-python-nginx-20221031-test" > index.html
/usr/share/nginx/html #

创建tomcat测试页面

[root@easzlab-deploy python-ns2]# kubectl exec -it -n linux linux-tomcat-app1-deployment-78c6ff7749-l6sf2 bash
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
root@linux-tomcat-app1-deployment-78c6ff7749-l6sf2:/usr/local/tomcat# cd webapps
root@linux-tomcat-app1-deployment-78c6ff7749-l6sf2:/usr/local/tomcat/webapps# mkdir app
root@linux-tomcat-app1-deployment-78c6ff7749-l6sf2:/usr/local/tomcat/webapps# echo "networkpolicy-linux-tomcatl-20221031-test" > app/index.jsp
root@linux-tomcat-app1-deployment-78c6ff7749-l6sf2:/usr/local/tomcat/webapps#

[root@easzlab-deploy python-ns2]# kubectl exec -it -n python python-tomcat-app1-deployment-5b9c8d6d9c-958lp bash
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
root@python-tomcat-app1-deployment-5b9c8d6d9c-d4f5b:/usr/local/tomcat# cd webapps
root@python-tomcat-app1-deployment-5b9c8d6d9c-d4f5b:/usr/local/tomcat/webapps# mkdir app
root@python-tomcat-app1-deployment-5b9c8d6d9c-d4f5b:/usr/local/tomcat/webapps# echo "networkpolicy-python-tomcatl-20221031-test" > app/index.jsp
root@python-tomcat-app1-deployment-5b9c8d6d9c-d4f5b:/usr/local/tomcat/webapps#

三、NetworkPolicy应用场景

3.1、ingress-以pod为限制单位、只允同namespace含有特定标签的源pod访问目标pod的所有端口

[root@easzlab-deploy python-ns2]# vi case1-ingress-podSelector.yaml 
[root@easzlab-deploy python-ns2]# cat case1-ingress-podSelector.yaml 
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: tomcat-access--networkpolicy
  namespace: python
spec:
  policyTypes:
  - Ingress
  podSelector:
    matchLabels:
      app: python-tomcat-app1-selector #对匹配到的目的Pod应用以下规则
  ingress: #入栈规则，如果指定目标端口就是匹配全部端口和协议，协议TCP, UDP, or SCTP
  - from:
    - podSelector:
        matchLabels:
          #app: python-nginx-selector #如果存在多个matchLabel条件，如果存在多个matchLabel条件,是and的关系,即要同时满足条件A、条件B、条件X
          project: "python"
[root@easzlab-deploy python-ns2]# kubectl apply -f case1-ingress-podSelector.yaml 
networkpolicy.networking.k8s.io/tomcat-access--networkpolicy created
[root@easzlab-deploy python-ns2]#

结果：
1.不允许从其它namespace访问目标pod，即默认禁止了跨ns访问目标pod。

# kubectl exec -it net-test-centos-pod1 bash
# curl python-tomcat-app1-service.python.svc.magedu.local/app/index.jsp #来自于default ns的请求会被禁止

2.非明确允许的pod，同namespace 也无法访问
3.不允许从宿主机访问目标pod。
4.该策略只允许同namespace含有特定标签的源pod访问目标pod，比如tomcat只允许了有特定标签的源pod nginx访问。
5.该策略不影响其它namespace的pod内部之间的相互访问，即linux的pod与linux的pod访问正常。
6.该策略不影响各namespace的pod与非明确禁止的pod之间的访问，即linux的pod访问python的其它pod也正常。

验证结果

[root@easzlab-deploy python-ns2]# kubectl get pod -n python  -owide
NAME                                             READY   STATUS    RESTARTS   AGE     IP              NODE            NOMINATED NODE   READINESS GATES
net-test-centos-pod1                             1/1     Running   0          9h      10.200.40.227   172.16.88.160   <none>           <none>
python-nginx-deployment-5c658bf86b-l4q6h         1/1     Running   0          6h1m    10.200.40.230   172.16.88.160   <none>           <none>
python-tomcat-app1-deployment-5b9c8d6d9c-958lp   1/1     Running   0          4h27m   10.200.40.234   172.16.88.160   <none>           <none>
[root@easzlab-deploy python-ns2]# kubectl get pod -n linux  -owide
NAME                                            READY   STATUS    RESTARTS   AGE    IP              NODE            NOMINATED NODE   READINESS GATES
linux-nginx-deployment-864bcf5f4c-vnssz         1/1     Running   0          6h8m   10.200.40.228   172.16.88.160   <none>           <none>
linux-tomcat-app1-deployment-78c6ff7749-l6sf2   1/1     Running   0          6h8m   10.200.40.229   172.16.88.160   <none>           <none>
net-test-centos-pod1                            1/1     Running   0          9h     10.200.40.226   172.16.88.160   <none>           <none>
[root@easzlab-deploy python-ns2]#

#启用networkpolicy策略
[root@easzlab-deploy python-ns2]# kubectl create -f case1-ingress-podSelector.yaml 
networkpolicy.networking.k8s.io/tomcat-access--networkpolicy created
[root@easzlab-deploy python-ns2]# 

#测试普通pod访问linux、python 命名空间下资源
[root@easzlab-deploy python-ns2]# kubectl exec -it centos-net-test1 bash
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
[root@centos-net-test1 /]# curl http://10.200.40.230/index.html #正常访问python 命名空间下nginx pod 80端口
networkpolicy-python-nginx-20221031-test
[root@centos-net-test1 /]# 
[root@centos-net-test1 /]# curl http://10.200.40.234:8080/app/index.jsp #访问python命名空间tomcat pod 8080失败
^C
[root@centos-net-test1 /]# 
[root@centos-net-test1 /]# curl http://10.200.40.228/index.html  #访问linux命名空间nginx pod 80 端口正常
networkpolicy-linux-nginx-20221031-test
[root@centos-net-test1 /]# 
[root@centos-net-test1 /]# curl http://10.200.40.229:8080/app/index.jsp #访问linux 命名空间下tomcat pod 8080 端口正常
networkpolicy-linux-tomcatl-20221031-test
[root@centos-net-test1 /]# 

#测试python 命名空间下测试pod访问
[root@easzlab-deploy python-ns2]# kubectl exec -it -n python net-test-centos-pod1 bash
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
[root@net-test-centos-pod1 /]# 
[root@net-test-centos-pod1 /]# curl http://10.200.40.230/index.html #访问python 命名空间下nginx pod 80端口正常
networkpolicy-python-nginx-20221031-test
[root@net-test-centos-pod1 /]# curl http://10.200.40.234:8080/app/index.jsp #访问python 命名空间下tomcat pod 8080 端口失败
^C
[root@net-test-centos-pod1 /]# 
[root@net-test-centos-pod1 /]# curl http://10.200.40.228/index.html #访问linux 命名空间下nginx pod 80 端口正常
networkpolicy-linux-nginx-20221031-test
[root@net-test-centos-pod1 /]# 
[root@net-test-centos-pod1 /]# curl http://10.200.40.229:8080/app/index.jsp #访问linux命名空间下tomcat pod 8080 端口正常
networkpolicy-linux-tomcatl-20221031-test
[root@net-test-centos-pod1 /]# 

#测试linux命名空间下测试pod访问
[root@easzlab-deploy python-ns2]# kubectl exec -it -n linux net-test-centos-pod1 bash
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
[root@net-test-centos-pod1 /]# 
[root@net-test-centos-pod1 /]# curl http://10.200.40.230/index.html #访问python 命名空间下nginx pod 80 端口正常
networkpolicy-python-nginx-20221031-test
[root@net-test-centos-pod1 /]# curl http://10.200.40.234:8080/app/index.jsp #访问python 命名空间下tomcat pod 8080端口失败
^C
[root@net-test-centos-pod1 /]# 
[root@net-test-centos-pod1 /]# curl http://10.200.40.228/index.html #访问linux命名空间下nginx pod 80 端口正常
networkpolicy-linux-nginx-20221031-test
[root@net-test-centos-pod1 /]# 
[root@net-test-centos-pod1 /]# curl http://10.200.40.229:8080/app/index.jsp #访问linux 命名空间下tomcat pod 8080端口正常
networkpolicy-linux-tomcatl-20221031-test
[root@net-test-centos-pod1 /]#

3.2、ingress-以pod加端口为限制单位、只允同namespace含有特定标签的源pod访问目标pod的指定端口

1.只允许指定的源pod访问同namespace目标pod的指定端口
2.非允许的端口将被禁止访问

[root@easzlab-deploy python-ns2]# vim case2-ingress-podSelector-ns-SinglePort.yaml
[root@easzlab-deploy python-ns2]# cat case2-ingress-podSelector-ns-SinglePort.yaml 
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: tomcat-access--networkpolicy
  namespace: python
spec:
  policyTypes:
  - Ingress
  podSelector:
    matchLabels:
      app: python-tomcat-app1-selector
  ingress:
  - from:
    - podSelector:
        matchLabels:
          #app: python-nginx-selector #指定访问源的匹配条件,如果存在多个matchLabel条件,是and的关系,即要同时满足条件A、条件B、条件X
          project: "python"
    ports: #入栈规则，如果指定目标端口就是匹配全部端口和协议,协议TCP, UDP, or SCTP
    - protocol: TCP
      port: 8080 #允许通过TCP协议访问目标pod的8080端口,但是其它没有允许的端口将全部禁止访问
      #port: 80
[root@easzlab-deploy python-ns2]#

验证结果

[root@easzlab-deploy python-ns2]# kubectl get pod -n python -owide
NAME                                             READY   STATUS    RESTARTS   AGE   IP              NODE            NOMINATED NODE   READINESS GATES
net-test-centos-pod1                             1/1     Running   0          10h   10.200.40.227   172.16.88.160   <none>           <none>
python-nginx-deployment-5c658bf86b-q9xnf         1/1     Running   0          59s   10.200.40.235   172.16.88.160   <none>           <none>
python-tomcat-app1-deployment-7bf9bb6989-jbxhj   1/1     Running   0          59s   10.200.40.236   172.16.88.160   <none>           <none>
[root@easzlab-deploy python-ns2]# 

#未启用networkpolicy策略，python命名空间下nginx可以正常访问tomcat 8080
[root@easzlab-deploy python-ns2]# kubectl exec -it -n python python-nginx-deployment-5c658bf86b-q9xnf sh
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
/ # curl http://10.200.40.236:8080/app/index.jsp
networkpolicy-python-tomcatl-20221031-test
/ # 

#启用networkpolicy策略
[root@easzlab-deploy python-ns2]# grep port case2-ingress-podSelector-ns-SinglePort.yaml 
    ports: #入栈规则，如果指定目标端口就是匹配全部端口和协议,协议TCP, UDP, or SCTP
      port: 8080 #允许通过TCP协议访问目标pod的8080端口,但是其它没有允许的端口将全部禁止访问
      #port: 80
[root@easzlab-deploy python-ns2]# kubectl apply -f case2-ingress-podSelector-ns-SinglePort.yaml 
networkpolicy.networking.k8s.io/tomcat-access--networkpolicy created
[root@easzlab-deploy python-ns2]# 
[root@easzlab-deploy python-ns2]# kubectl exec -it -n python python-nginx-deployment-5c658bf86b-q9xnf sh
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead./ # curl http://10.200.40.236:8080/app/index.jsp
networkpolicy-python-tomcatl-20221031-test
/ # 
/ # curl http://10.200.40.236:8080/app/index.jsp  #此时python命名空间下nginx pod 还可以正常访问
networkpolicy-python-tomcatl-20221031-test
/ # 

#修改networkpolicy策略之前的8080为80
[root@easzlab-deploy python-ns2]# vi case2-ingress-podSelector-ns-SinglePort.yaml 
[root@easzlab-deploy python-ns2]# grep port case2-ingress-podSelector-ns-SinglePort.yaml 
    ports: #入栈规则，如果指定目标端口就是匹配全部端口和协议,协议TCP, UDP, or SCTP
      #port: 8080 #允许通过TCP协议访问目标pod的8080端口,但是其它没有允许的端口将全部禁止访问
      port: 80
[root@easzlab-deploy python-ns2]# 
[root@easzlab-deploy python-ns2]# kubectl apply -f case2-ingress-podSelector-ns-SinglePort.yaml 
networkpolicy.networking.k8s.io/tomcat-access--networkpolicy configured
[root@easzlab-deploy python-ns2]# 
root@easzlab-deploy python-ns2]# kubectl exec -it -n python python-nginx-deployment-5c658bf86b-q9xnf sh
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead./ # curl http://10.200.40.236:8080/app/index.jsp
networkpolicy-python-tomcatl-20221031-test
/ # 
/ # curl http://10.200.40.236:8080/app/index.jsp
networkpolicy-python-tomcatl-20221031-test
/ # / # curl http://10.200.40.236:8080/app/index.jsp #此时python命名空间下nginx pod 访问失败
^C
/ #

3.3、ingress-允许同namespace的所有pod访问当前namespace的目标pod多个指定端口

[root@easzlab-deploy python-ns2]# vim case3-ingress-podSelector-ns-MultiPort.yaml 
[root@easzlab-deploy python-ns2]# cat case3-ingress-podSelector-ns-MultiPort.yaml 
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: tomcat-access-networkpolicy
  namespace: python
spec:
  policyTypes:
  - Ingress
  podSelector: #目标pod
    matchLabels:
      app: python-tomcat-app1-selector
  ingress:
  - from:
    - podSelector: #匹配源pod,matchLabels: {}为不限制源pod即允许所有pod,写法等同于resources(不加就是不限制)
        matchLabels: {}
    ports: #入栈规则，如果指定目标端口就是匹配全部端口和协议，协议TCP, UDP, or SCTP
    - protocol: TCP
      port: 8080 #允许通过TCP协议访问目标pod的8080端口，但是其它没有允许的端口将全部禁止访问
      #port: 80
    - protocol: TCP
      port: 3306
    - protocol: TCP
      port: 6379
[root@easzlab-deploy python-ns2]#

验证实验结果

[root@easzlab-deploy python-ns2]# kubectl apply -f case3-ingress-podSelector-ns-MultiPort.yaml #启用networkpolicy策略
networkpolicy.networking.k8s.io/tomcat-access-networkpolicy created
[root@easzlab-deploy python-ns2]# 

#普通pod访问测试
[root@easzlab-deploy python-ns2]# kubectl exec -it centos-net-test1 bash
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
[root@centos-net-test1 /]# curl http://10.200.40.236:8080/app/index.jsp
^C
[root@centos-net-test1 /]# 

#python 命名空间下pod访问
[root@easzlab-deploy python-ns2]# kubectl exec -it -n python python-nginx-deployment-5c658bf86b-q9xnf sh
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
/ # 
/ # curl http://10.200.40.236:8080/app/index.jsp
networkpolicy-python-tomcatl-20221031-test
/ # 
[root@easzlab-deploy python-ns2]# kubectl exec -it -n python net-test-centos-pod1 bash
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
[root@net-test-centos-pod1 /]# curl http://10.200.40.236:8080/app/index.jsp
networkpolicy-python-tomcatl-20221031-test
[root@net-test-centos-pod1 /]# 

#linux命名空间下pod访问
[root@easzlab-deploy python-ns2]# kubectl exec -it -n linux net-test-centos-pod1 bash
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
[root@net-test-centos-pod1 /]# 
[root@net-test-centos-pod1 /]# curl 10.200.40.236:8080/app/index.jsp
^C
[root@net-test-centos-pod1 /]#

拒绝访问的规则

[root@easzlab-k8s-node-01 ~]# iptables-save |grep 6379 (pod所在主机，其他主机无此规则)
-A cali-pi-_0JuoNaejpHrnq9ok3ft -p tcp -m comment --comment "cali:qEZjDE_j-MWialKp" -m set --match-set cali40s:i_4-mErXOxx3I3EQOxm4JCQ src -m multiport --dports 3306,6379,8080 -j MARK --set-xmark 0x10000/0x10000
[root@easzlab-k8s-node-01 ~]#

3.4、ingress-允许同namespace的所有pod访问当前namespace的目标pod所有端口

[root@easzlab-deploy python-ns2]# cat case4-ingress-podSelector-ns.yaml 
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: tomcat-access--networkpolicy
  namespace: python
spec:
  policyTypes:
  - Ingress
  podSelector: #目标pod
    matchLabels: {} #匹配所有目标pod
  ingress:
  - from:
    - podSelector: #匹配源pod,matchLabels: {}为不限制源pod即允许所有pod,写法等同于resources(不加就是不限制)
        matchLabels: {}
    #ports: #入栈规则，如果指定目标端口就是匹配全部端口和协议，协议TCP, UDP, or SCTP
    #- protocol: TCP
    #  port: {} #允许通过TCP协议访问目标pod的8080端口，但是其它没有允许的端口将全部禁止访问
      #port: 80
    #- protocol: TCP
    #  port: 3306
    #- protocol: TCP
    #  port: 6379
[root@easzlab-deploy python-ns2]#

1.其它namespace无法访问目标ns的pod。
2.同namespace的pod可以访问当前namespace中的所有pod的任意端口。

验证测试

[root@easzlab-deploy python-ns2]# kubectl apply -f case4-ingress-podSelector-ns.yaml #启用networkpolicy策略
networkpolicy.networking.k8s.io/tomcat-access--networkpolicy created
[root@easzlab-deploy python-ns2]# 

#普通pod访问
[root@easzlab-deploy python-ns2]# kubectl exec -it centos-net-test1 bash
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
[root@centos-net-test1 /]# curl http://10.200.40.236:8080/app/index.jsp
^C
[root@centos-net-test1 /]# 

#python命名空间下pod访问
[root@easzlab-deploy python-ns2]# kubectl exec -it -n python net-test-centos-pod1 bash
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
[root@net-test-centos-pod1 /]# curl http://10.200.40.236:8080/app/index.jsp
networkpolicy-python-tomcatl-20221031-test
[root@net-test-centos-pod1 /]# 
[root@net-test-centos-pod1 /]# curl http://10.200.40.236:8080/app/index.jsp
networkpolicy-python-tomcatl-20221031-test
[root@net-test-centos-pod1 /]# 
[root@easzlab-deploy python-ns2]# kubectl exec -it -n python python-nginx-deployment-5c658bf86b-q9xnf sh
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
/ # curl http://10.200.40.236:8080/app/index.jsp
networkpolicy-python-tomcatl-20221031-test
/ # 

#linux命名空间下pod访问
[root@easzlab-deploy python-ns2]# kubectl exec -it -n linux net-test-centos-pod1 bash
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
[root@net-test-centos-pod1 /]# curl 10.200.40.236:8080/app/index.jsp
curl: (7) Failed connect to 10.200.40.236:8080; Connection timed out
[root@net-test-centos-pod1 /]#

3.5、ingress-ipBlock白名单

[root@easzlab-deploy python-ns2]# cat case5-ingress-ipBlock.yaml.bak 
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: tomcat-access--networkpolicy
  namespace: python
spec:
  policyTypes:
  - Ingress
  podSelector: #目标pod
    matchLabels:
      app: python-tomcat-app1-selector
  ingress:
  - from:
#    - podSelector: #匹配源pod,matchLabels: {}为不限制源pod即允许所有pod,写法等同于resources(不加就是不限制)
#        matchLabels: {}
    - ipBlock:
        cidr: 10.200.0.0/16 #白名单，允许访问的地址范围，没有允许的将禁止访问目标pod
        except:
        - 10.200.40.0/24
        - 10.200.219.0/24 #在以上范围内禁止访问的源IP地址
        - 10.200.229.0/24 #在以上范围内禁止访问的源IP地址
        - 10.200.207.31/32 #在以上范围内禁止访问的源IP地址
    ports: #入栈规则，如果指定目标端口就是匹配全部端口和协议，协议TCP, UDP, or SCTP
    - protocol: TCP
      port: 8080 #允许通过TCP协议访问目标pod的8080端口，但是其它没有允许的端口将全部禁止访问
      #port: 80
    - protocol: TCP
      port: 3306
    - protocol: TCP
      port: 6379
[root@easzlab-deploy python-ns2]#

1.只要在白名单范围内没有被except指定禁止的源pod IP，都允许访问。
2.在只设置了ipBlock匹配的前提下，其它namespace 中没有在except范围的pod 也可以访问目标pod，及linux ns中的pod只要不在except地址范围内，也可以访问python ns中的pod了。

测试验证

[root@easzlab-deploy python-ns2]# kubectl apply -f  case5-ingress-ipBlock.yaml #启用ip白名单
networkpolicy.networking.k8s.io/tomcat-access--networkpolicy configured
[root@easzlab-deploy python-ns2]# 
[root@easzlab-deploy python-ns2]# kubectl exec -it -n python net-test-centos-pod1 bash
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
[root@net-test-centos-pod1 /]#
[root@net-test-centos-pod1 /]# curl http://10.200.40.236:8080/app/index.jsp
networkpolicy-python-tomcatl-20221031-test
[root@net-test-centos-pod1 /]# curl http://10.200.40.236:8080/app/index.jsp
^C
[root@net-test-centos-pod1 /]#

[root@easzlab-deploy python-ns2]# kubectl exec -it -n python python-nginx-deployment-5c658bf86b-q9xnf sh
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
/ # / # curl http://10.200.40.236:8080/app/index.jsp
networkpolicy-python-tomcatl-20221031-test
/ # curl http://10.200.40.236:8080/app/index.jsp
^C
/ #

3.6、ingress-namespace Selector-ns选择器

# kubectl label ns linux nsname=linux
# kubectl label ns python nsname=python

[root@easzlab-deploy python-ns2]# cat case6-ingress-namespaceSelector.yaml 
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: tomcat-access--networkpolicy
  namespace: python
spec:
  policyTypes:
  - Ingress
  podSelector: #目标pod
    matchLabels: {} #允许访问python namespace 中的所有pod
#      app: python-tomcat-app1-selector #可以只允许访问python namespace中指定的pod
  ingress:
  - from:
#    - podSelector: #匹配源pod,matchLabels: {}为不限制源pod即允许所有pod,写法等同于resources(不加就是不限制)
#        matchLabels: {}
#    - ipBlock:
#        cidr: 10.200.0.0/16 #指定禁止访问的源网段
#        except:
#        - 10.200.218.0/24 #在以上范围内禁止访问的源IP地址

    - namespaceSelector:
#        matchLabels: {} #允许所有namespace访问python namespace指定的目标端口或指定的pod加指定端口
        matchLabels:
          nsname: linux #只允许指定的namespace访问
    - namespaceSelector:
        matchLabels:
          nsname: python #只允许指定的namespace访问
    ports: #入栈规则，如果指定目标端口就是匹配全部端口和协议，协议TCP, UDP, or SCTP
    - protocol: TCP
      port: 8080 #允许通过TCP协议访问目标pod的8080端口，但是其它没有允许的端口将全部禁止访问
      #port: 80
    - protocol: TCP
      port: 3306
    - protocol: TCP
      port: 6379
[root@easzlab-deploy python-ns2]#

1.被明确允许的namespace中的pod可以访问目标pod
2.没有明确声明允许的namespace将禁止访问
3.没有明确声明允许的话，即使同一个namespace也禁止访问
4.比如只允许了linux和python两个ns，那么default中的pod将无法访问。

验证结果

[root@easzlab-deploy python-ns2]# kubectl apply -f case6-ingress-namespaceSelector.yaml 
networkpolicy.networking.k8s.io/tomcat-access--networkpolicy created
[root@easzlab-deploy python-ns2]# 
[root@easzlab-deploy python-ns2]# kubectl exec -it centos-net-test1 bash  #普通pod测试
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
[root@centos-net-test1 /]#
[root@centos-net-test1 /]# curl http://10.200.40.236:8080/app/index.jsp
^C
[root@centos-net-test1 /]# 
[root@easzlab-deploy python-ns2]# kubectl exec -it -n linux net-test-centos-pod1 bash #指定linux命名空间测试
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
[root@net-test-centos-pod1 /]# 
[root@net-test-centos-pod1 /]# curl 10.200.40.236:8080/app/index.jsp
networkpolicy-python-tomcatl-20221031-test
[root@net-test-centos-pod1 /]# 
[root@easzlab-deploy ~]# kubectl  exec -it -n linux  linux-nginx-deployment-864bcf5f4c-vnssz sh #linux命名空间下其他pod
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
/ # 
/ # curl 10.200.40.236:8080/app/index.jsp
networkpolicy-python-tomcatl-20221031-test
/ # 
[root@easzlab-deploy python-ns2]# kubectl exec -it -n python net-test-centos-pod1 bash #python 命名空间下pod访问
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
[root@net-test-centos-pod1 /]# 
[root@net-test-centos-pod1 /]# curl http://10.200.40.236:8080/app/index.jsp
^C
[root@net-test-centos-pod1 /]# curl http://10.200.40.236:8080/app/index.jsp
networkpolicy-python-tomcatl-20221031-test
[root@net-test-centos-pod1 /]# 
[root@easzlab-deploy python-ns2]# kubectl exec -it -n python python-nginx-deployment-5c658bf86b-q9xnf sh
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
/ #/ # curl http://10.200.40.236:8080/app/index.jsp
^C
/ # curl http://10.200.40.236:8080/app/index.jsp
networkpolicy-python-tomcatl-20221031-test
/ #

3.7、Egress-podSelector-Pod出口方向目的IP及目的端口限制-只允许访问指定的目的地址范围及端口

[root@easzlab-deploy python-ns2]# cat case7-Egress-ipBlock.yaml 
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: egress-access-networkpolicy
  namespace: python
spec:
  policyTypes:
  - Egress
  podSelector: #目标pod选择器
    matchLabels:  #基于label匹配目标pod
      app: python-tomcat-app1-selector #匹配python namespace中app的值为python-tomcat-app1-selector的pod,然后基于egress中的指定网络策略进行出口方向的网络限制
  egress:
  - to:
    - ipBlock:
        cidr: 10.200.0.0/16 #允许匹配到的pod出口访问的目的CIDR地址范围
    - ipBlock:
        cidr: 172.16.88.190/32 #允许匹配到的pod出口访问的目的主机
    - ipBlock:
        cidr: 0.0.0.0/0 #允许匹配到的pod出口访问的目的主机
    ports:
    - protocol: TCP
      port: 80 #允许匹配到的pod访问目的端口为80的访问
    - protocol: TCP
      port: 53 #允许匹配到的pod访问目的端口为53 即DNS的解析
    - protocol: UDP
      port: 53 #允许匹配到的pod访问目的端口为53 即DNS的解析
[root@easzlab-deploy python-ns2]#

验证结果

#未启用networkpolicy策略
[root@easzlab-deploy ~]# kubectl exec -it -n python  python-tomcat-app1-deployment-7bf9bb6989-jbxhj bash
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
16.^Cpython-tomcat-app1-deployment-7bf9bb6989-jbxhj:/usr/local/tomcat#
root@python-tomcat-app1-deployment-7bf9bb6989-jbxhj:/usr/local/tomcat# ping www.baidu.com  #ping 百度正常
PING www.a.shifen.com (182.61.200.6) 56(84) bytes of data.
64 bytes from 182.61.200.6 (182.61.200.6): icmp_seq=1 ttl=44 time=65.1 ms
64 bytes from 182.61.200.6 (182.61.200.6): icmp_seq=2 ttl=44 time=65.0 ms
^C
--- www.a.shifen.com ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 2ms
rtt min/avg/max/mdev = 65.024/65.072/65.120/0.048 ms
root@python-tomcat-app1-deployment-7bf9bb6989-jbxhj:/usr/local/tomcat# 

#启用networkpolicy策略
[root@easzlab-deploy python-ns2]# kubectl apply -f case7-Egress-ipBlock.yaml 
networkpolicy.networking.k8s.io/egress-access-networkpolicy created
[root@easzlab-deploy python-ns2]# 
[root@easzlab-deploy ~]# kubectl exec -it -n python  python-tomcat-app1-deployment-7bf9bb6989-jbxhj bash
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
root@python-tomcat-app1-deployment-7bf9bb6989-jbxhj:/usr/local/tomcat# ping www.baidu.com  #ping 百度失败
PING www.a.shifen.com (182.61.200.7) 56(84) bytes of data.
^C
--- www.a.shifen.com ping statistics ---
2 packets transmitted, 0 received, 100% packet loss, time 7ms
root@python-tomcat-app1-deployment-7bf9bb6989-jbxhj:/usr/local/tomcat# curl http://172.16.88.190 #访问指定地址正常
<!doctype html>
<html>

<head>
    <meta charset="utf-8">
    <title>Harbor</title>
    <base href="/">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <link rel="icon" type="image/x-icon" href="favicon.ico?v=2">
    <link rel="preload" as="style" href="./light-theme.css?buildTimestamp=1657173838042">
    <link rel="preload" as="style" href="./dark-theme.css?buildTimestamp=1657173838042">
<link rel="stylesheet" href="styles.f21a150d0d914470.css"></head>
<body>
    <harbor-app>
        <div class="spinner spinner-lg app-loading app-loading-fixed">
            Loading...
        </div>
    </harbor-app>
<script src="runtime.b2a241ce383ba716.js" type="module"></script><script src="polyfills.40b0dd9c16ed9dc8.js" type="module"></script><script src="scripts.a459d5a2820e9a99.js" defer></script><script src="main.e999b3efec0fb336.js" type="module"></script></body>

</html>
root@python-tomcat-app1-deployment-7bf9bb6989-jbxhj:/usr/local/tomcat#

3.8、Egress-podSelector-Pod出口方向目的Pod限制-只允许访问指定的pod及端口

基于podSelector选择器，限制源pod能够访问的目的pod

1.匹配成功的源pod只能访问指定的目的pod的指定端口
2.其它没有允许的出口请求将禁止访问

[root@easzlab-deploy python-ns2]# cat case8-Egress-PodSelector.yaml 
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: egress-access-networkpolicy
  namespace: python
spec:
  policyTypes:
  - Egress
  podSelector: #目标pod选择器
    matchLabels:  #基于label匹配目标pod
      app: python-nginx-selector #匹配python namespace中app的值为python-tomcat-app1-selector的pod,然后基于egress中的指定网络策略进行出口方向的网络限制
  egress:
  - to:
#    - ipBlock:
#        cidr: 10.200.0.0/16 #允许访问的目的CIDR地址范围
#    - ipBlock:
#        cidr: 172.31.7.106/32 #允许访问的目的主机地址
#    - ipBlock:
#        cidr: 10.200.218.4/32 #白名单,允许访问的目的主机地址
    - podSelector: #匹配pod,matchLabels: {}为不限制源pod即允许所有pod,写法等同于resources(不加就是不限制)
        matchLabels:
          app: python-tomcat-app1-selector
    ports:
    - protocol: TCP
      port: 8080 #允许80端口的访问
    - protocol: TCP
      port: 53 #允许DNS的解析
    - protocol: UDP
      port: 53
[root@easzlab-deploy python-ns2]#

验证结果

#未启用networkpolicy策略
[root@easzlab-deploy python-ns2]# kubectl exec -it -n python python-nginx-deployment-5c658bf86b-q9xnf sh
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
/ # curl http://10.200.40.228/index.html
networkpolicy-linux-nginx-20221031-test
/ # curl http://10.200.40.229:8080/app/index.jsp
networkpolicy-linux-tomcatl-20221031-test
/ # 
/ # curl http://10.200.40.235/index.html
networkpolicy-python-nginx-20221031-test
/ # curl http://10.200.40.236:8080/app/index.jsp
networkpolicy-python-tomcatl-20221031-test
/ # 

#启用networkpolicy策略
[root@easzlab-deploy python-ns2]# kubectl apply -f case8-Egress-PodSelector.yaml 
networkpolicy.networking.k8s.io/egress-access-networkpolicy created
[root@easzlab-deploy python-ns2]# 
[root@easzlab-deploy python-ns2]# kubectl exec -it -n python python-nginx-deployment-5c658bf86b-q9xnf sh
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
/ # curl http://10.200.40.228/index.html
networkpolicy-linux-nginx-20221031-test
/ # curl http://10.200.40.229:8080/app/index.jsp
networkpolicy-linux-tomcatl-20221031-test
/ # 
/ # curl http://10.200.40.235/index.html
networkpolicy-python-nginx-20221031-test
/ # curl http://10.200.40.236:8080/app/index.jsp
networkpolicy-python-tomcatl-20221031-test
/ # 
/ # 
/ # curl http://10.200.40.228/index.html
^C
/ # curl http://10.200.40.229:8080/app/index.jsp
^C
/ # 
/ # curl http://10.200.40.235/index.html
networkpolicy-python-nginx-20221031-test
/ # curl http://10.200.40.236:8080/app/index.jsp
networkpolicy-python-tomcatl-20221031-test
/ #

3.9、Egress-namespaceSelector

限制匹配成功的pod没有访问指定的namespace

1.匹配成功的源pod可以访问指定的目标namespace。
2.不能访问除指定的namespace以外的其它namespace及外网。
3.比如允许指定的源pod访问linux和python ns中的8080、 3306、 6379等端口，但是其它ns无法访问

[root@easzlab-deploy python-ns2]# cat case9-Egress-namespaceSelector.yaml 
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: egress-access-networkpolicy
  namespace: python
spec:
  policyTypes:
  - Egress
  podSelector: #目标pod选择器
    matchLabels:  #基于label匹配目标pod
      app: python-nginx-selector #匹配python namespace中app的值为python-tomcat-app1-selector的pod,然后基于egress中的指定网络策略进行出口方向的网络限制
  egress:
  - to:
#    - ipBlock:
#        cidr: 10.200.0.0/16 #允许访问的目的CIDR地址范围
#    - ipBlock:
#        cidr: 172.31.7.106/32 #允许访问的目的主机地址
#    - ipBlock:
#        cidr: 10.200.218.4/32 #允许访问的目的主机地址
#    - podSelector: #匹配pod,matchLabels: {}为不限制源pod即允许所有pod,写法等同于resources(不加就是不限制)
#        matchLabels:
#          app: python-tomcat-app1-selector

    - namespaceSelector:
        matchLabels:
          nsname: python #指定允许访问的目的namespace
    - namespaceSelector:
        matchLabels:
          nsname: linux #指定允许访问的目的namespace
    ports:
    - protocol: TCP
      port: 8080 #允许80端口的访问
    - protocol: TCP
      port: 53 #允许DNS的解析
    - protocol: UDP
      port: 53
[root@easzlab-deploy python-ns2]#

验证结果

[root@easzlab-deploy python-ns2]# kubectl apply -f case9-Egress-namespaceSelector.yaml #启用networkpolicy策略
networkpolicy.networking.k8s.io/egress-access-networkpolicy created
[root@easzlab-deploy python-ns2]# 
[root@easzlab-deploy python-ns2]# kubectl exec -it -n python python-nginx-deployment-5c658bf86b-q9xnf sh
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
/ # curl http://10.200.40.228/index.html  #访问linux命名空间下nginx pod 80失败
^C
/ # curl http://10.200.40.229:8080/app/index.jsp  #访问linux命名空间下tomcat pod 8080 正常
networkpolicy-linux-tomcatl-20221031-test
/ # 
/ # curl http://10.200.40.235/index.html #访问自己正常
networkpolicy-python-nginx-20221031-test
/ # curl http://10.200.40.236:8080/app/index.jsp #访问python命名空间下tomcat pod 8080正常
networkpolicy-python-tomcatl-20221031-test
/ #

标签：kubectl,Ingress,NetworkPolicy,deploy,python,easzlab,Egress,pod,root
From： https://www.cnblogs.com/cyh00001/p/16833586.html

NetworkPolicy Ingress及Egress简介及案例

一、NetworkPolicy简介

二、NetworkPolicy环境准备

2.1、环境条件

2.2、部署测试web服务

三、NetworkPolicy应用场景

3.1、ingress-以pod为限制单位、只允同namespace含有特定标签的源pod访问目标pod的所有端口

3.2、ingress-以pod加端口为限制单位、只允同namespace含有特定标签的源pod访问目标pod的指定端口

3.3、ingress-允许同namespace的所有pod访问当前namespace的目标pod多个指定端口

3.4、ingress-允许同namespace的所有pod访问当前namespace的目标pod所有端口

3.5、ingress-ipBlock白名单

3.6、ingress-namespace Selector-ns选择器

3.7、Egress-podSelector-Pod出口方向目的IP及目的端口限制-只允许访问指定的目的地址范围及端口

3.8、Egress-podSelector-Pod出口方向目的Pod限制-只允许访问指定的pod及端口

3.9、Egress-namespaceSelector

相关文章

赞助商

阅读排行

NetworkPolicy Ingress及Egress简介及案例

一、NetworkPolicy简介

二、NetworkPolicy环境准备

2.1、环境条件

2.2、部署测试web服务

三、NetworkPolicy应用场景

3.1、ingress-以pod为限制单位、 只允同namespace含有特定标签的源pod访问目标pod的所有端口

3.2、ingress-以pod加端口为限制单位、 只允同namespace含有特定标签的源pod访问目标pod的指定端口

3.3、ingress-允许同namespace的所有pod访问当前namespace的目标pod多个指定端口

3.4、ingress-允许同namespace的所有pod访问当前namespace的目标pod所有端口

3.5、ingress-ipBlock白名单

3.6、ingress-namespace Selector-ns选择器

3.7、Egress-podSelector-Pod出口方向目的IP及目的端口限制-只允许访问指定的目的地址范围及端口

3.8、Egress-podSelector-Pod出口方向目的Pod限制-只允许访问指定的pod及端口

3.9、Egress-namespaceSelector

相关文章

赞助商

阅读排行

3.1、ingress-以pod为限制单位、只允同namespace含有特定标签的源pod访问目标pod的所有端口

3.2、ingress-以pod加端口为限制单位、只允同namespace含有特定标签的源pod访问目标pod的指定端口