kubernetes Network Policies 之 只允許設有某些標簽的Pod可以訪問
阿新 • • 發佈：2018-10-11
分享 -- eat online metadata pos efault service 是否 1、規則描述：
如一個apiserver服務，部署在帶有標簽app=bookstore, role=api的pod裏
希望達到的效果：
- 只能帶有app=bookstore標簽的pod訪問bookstorePod
- 其他pod不允許訪問此pod
如下圖所示：
2、使用鏡像準備：
- 下載Nginx鏡像
docker pull nginx - 編寫Dockerfile(添加wget)
FROM nginx RUN apt-get update RUN apt-get install -y iputils-ping iproute2 wget主要是想安裝上ip等網絡命令
- 重新構建鏡像
docker build -t mybusybox .3、創建相應的Pod
- 在default命名空間下, 創建一個帶有app=nginx標簽的pod,名稱是bookstore
kubectl run bookstore --image=mybusybox --labels app=bookstore,role=api --expose --port 80 --image-pull-policy=IfNotPresent - 在default命名空間下, 創建一個帶有Nginx服務的pod,名稱是frontend
kubectl run frontend --image=mybusybox --labels app=bookstore,role=frontend --image-pull-policy=IfNotPresent - 在policy-demo命名空間下, 創建一個帶有Nginx服務的pod,名稱是coffeeshop
kubectl run coffeeshop -n policy-demo --image=mybusybox --labels app=coffeeshop,role=api --image-pull-policy=IfNotPresent -
查看pod創建情況
[root@master day02]# kubectl get pod -owide NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE bookstore-6dc84486c7-wljn8 1/1 Running 0 65s 192.168.1.32 slave1 <none> frontend-6b855d4b8d-c2nft 1/1 Running 0 59s 192.168.2.51 slave2 <none> [root@master day02]# kubectl get pod -owide -npolicy-demo NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE coffeeshop-95cd499f8-d2dcn 1/1 Running 0 12s 192.168.2.52 slave2 <none> [root@master day02]#
4、開始測試
4.1、未使用策略前的測試
默認未使用任何策略時，可以互相訪問的，不再具體測試了4.2、開始使用策略的測試
-
創建NetworkPolicy類型的yaml文件，如 api-allow.yaml
apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: api-allow spec: podSelector: matchLabels: app: bookstore role: api ingress: - from: - podSelector: matchLabels: app: bookstore這個policy只針對標簽是app=bookstore，role=api的pod生效 ，限制這個pod的入站流量
這個策略，並未涉足egress, 也就是說，出站流量是允許的 - 使其生效
kubectl create -f api-allow.yaml -
測試bookstore的入站規則(只允許帶有指定標簽的pod進行訪問？)
# 第一步： 進入frontend pod，查看是否可以訪問bookstore裏的Nginx服務？ [root@master day02]# kubectl exec -it frontend-6b855d4b8d-c2nft sh # wget --timeout=1 http://bookstore -O- --2018-10-11 02:52:30-- http://bookstore/ Resolving bookstore (bookstore)... 10.96.172.80 Connecting to bookstore (bookstore)|10.96.172.80|:80... connected. HTTP request sent, awaiting response... 200 OK Length: 612 [text/html] Saving to: ‘STDOUT‘ - 0%[ ] 0 --.-KB/s <!DOCTYPE html> <html> <head> <title>Welcome to nginx!</title> <style> body { width: 35em; margin: 0 auto; font-family: Tahoma, Verdana, Arial, sans-serif; } </style> </head> <body> <h1>Welcome to nginx!</h1> <p>If you see this page, the nginx web server is successfully installed and working. Further configuration is required.</p> <p>For online documentation and support please refer to <a href="http://nginx.org/">nginx.org</a>.<br/> Commercial support is available at <a href="http://nginx.com/">nginx.com</a>.</p> <p><em>Thank you for using nginx.</em></p> </body> </html> - 100%[==========================================================================>] 612 --.-KB/s in 0s 2018-10-11 02:52:30 (98.5 MB/s) - written to stdout [612/612] # 第二步： 進入coffeeshop pod，查看是否可以訪問bookstore裏的服務 [root@master day02]# kubectl exec -it coffeeshop-95cd499f8-d2dcn sh -npolicy-demo # wget -O- --timeout=1 http://bookstore --2018-10-11 02:55:04-- http://bookstore/ Resolving bookstore (bookstore)... failed: Name or service not known. wget: unable to resolve host address ‘bookstore‘ # wget 192.168.1.32 --2018-10-11 02:55:51-- http://192.168.1.32/ Connecting to 192.168.1.32:80... failed: Connection timed out. Retrying. --2018-10-11 02:57:59-- (try: 2) http://192.168.1.32/ Connecting to 192.168.1.32:80... ^C #說明，api-allow策略起作用了。 只允許某些pod進行訪問
5、清理工作
kubectl delete networkpolicy api-allow
kubectl delete svc bookstore
kubectl delete deployment bookstore frontend
kubectl delete deployment coffeeshop -n policy-demo kubernetes Network Policies 之 只允許設有某些標簽的Pod可以訪問