Network Policy
Network Policy提供了基于策略的网络控制,用于隔离应用并减少攻击面。它使用标签选择器模拟传统的分段网络,并通过策略控制它们之间的流量以及来自外部的流量。
在使用Network Policy之前,需要注意
- apiserver开启extensions/v1beta1/networkpolicies
- 网络插件要支持Network Policy,如Calico、Romana、Weave Net和trireme等
策略
Namespace隔离
默认情况下,所有Pod之间是全通的。每个Namespace可以配置独立的网络策略,来隔离Pod之间的流量。比如隔离namespace的所有Pod之间的流量(包括从外部到该namespace中所有Pod的流量以及namespace内部Pod相互之间的流量):
kubectl annotate ns <namespace> "net.beta.kubernetes.io/network-policy={\"ingress\": {\"isolation\": \"DefaultDeny\"}}"
注:目前,Network Policy仅支持Ingress流量控制。
Pod隔离
通过使用标签选择器(包括namespaceSelector和podSelector)来控制Pod之间的流量。比如下面的Network Policy
- 允许default namespace中带有role=frontend标签的Pod访问default namespace中带有role=db标签Pod的6379端口
- 允许带有project=myprojects标签的namespace中所有Pod访问default namespace中带有role=db标签Pod的6379端口
apiVersion: extensions/v1beta1 kind: NetworkPolicy metadata: name: test-network-policy namespace: default spec: podSelector: matchLabels: role: db ingress: - from: - namespaceSelector: matchLabels: project: myproject - podSelector: matchLabels: role: frontend ports: - protocol: tcp port: 6379
示例
以calico为例看一下Network Policy的具体用法。
首先配置kubelet使用CNI网络插件
kubelet --network-plugin=cni --cni-conf-dir=/etc/cni/net.d --cni-bin-dir=/opt/cni/bin ...
安装calio网络插件
# 注意修改CIDR,需要跟k8s pod-network-cidr一致,默认为192.168.0.0/16 kubectl apply -f http://docs.projectcalico.org/v2.1/getting-started/kubernetes/installation/hosted/kubeadm/1.6/calico.yaml
首先部署一个nginx服务
$ kubectl run nginx --image=nginx --replicas=2 deployment "nginx" created $ kubectl expose deployment nginx --port=80 service "nginx" exposed
此时,通过其他Pod是可以访问nginx服务的
$ kubectl run busybox --rm -ti --image=busybox /bin/sh Waiting for pod default/busybox-472357175-y0m47 to be running, status is Pending, pod ready: false Hit enter for command prompt / # wget --spider --timeout=1 nginx Connecting to nginx (10.100.0.16:80) / #
开启default namespace的DefaultDeny Network Policy后,其他Pod(包括namespace外部)不能访问nginx了:
$ kubectl annotate ns default "net.beta.kubernetes.io/network-policy={\"ingress\": {\"isolation\": \"DefaultDeny\"}}" $ kubectl run busybox --rm -ti --image=busybox /bin/sh Waiting for pod default/busybox-472357175-y0m47 to be running, status is Pending, pod ready: false Hit enter for command prompt / # wget --spider --timeout=1 nginx Connecting to nginx (10.100.0.16:80) wget: download timed out / #
最后再创建一个运行带有access=true的Pod访问的网络策略
$ cat nginx-policy.yaml kind: NetworkPolicy apiVersion: extensions/v1beta1 metadata: name: access-nginx spec: podSelector: matchLabels: run: nginx ingress: - from: - podSelector: matchLabels: access: "true" $ kubectl create -f nginx-policy.yaml networkpolicy "access-nginx" created # 不带access=true标签的Pod还是无法访问nginx服务 $ kubectl run busybox --rm -ti --image=busybox /bin/sh Waiting for pod default/busybox-472357175-y0m47 to be running, status is Pending, pod ready: false Hit enter for command prompt / # wget --spider --timeout=1 nginx Connecting to nginx (10.100.0.16:80) wget: download timed out / # # 而带有access=true标签的Pod可以访问nginx服务 $ kubectl run busybox --rm -ti --labels="access=true" --image=busybox /bin/sh Waiting for pod default/busybox-472357175-y0m47 to be running, status is Pending, pod ready: false Hit enter for command prompt / # wget --spider --timeout=1 nginx Connecting to nginx (10.100.0.16:80) / #
最后开启nginx服务的外部访问:
$ cat nginx-external-policy.yaml apiVersion: extensions/v1beta1 kind: NetworkPolicy metadata: name: front-end-access namespace: sock-shop spec: podSelector: matchLabels: run: nginx ingress: - ports: - protocol: TCP port: 80 $ kubectl create -f nginx-external-policy.yaml
参考:https://feisky.gitbooks.io/kubernetes/concepts/network-policy.html
