1、隔离模型

在这里插入图片描述

2、创建命名空间

创建明明空间sub1和sub2,分别打上对应标签ns:sub1和 ns:sub2

apiVersion: v1
kind: Namespace
metadata:
   name: sub1
   labels:
     ns: sub1
---
apiVersion: v1
kind: Namespace
metadata:
   name: sub2
   labels:
     ns: sub2

3、创建网络访问策略

.spec.PodSelector

顾名思义,它是pod选择器,基于标签选择与Network Policy处于同一namespace下的pod,如果pod被选中,则对其应用Network Policy中定义的规则。此为可选字段,当没有此字段时,表示选中所有pod。

.spec.PolicyTypes

Network Policy定义的规则可以分成两种,一种是入pod的Ingress规则,一种是出pod的Egress规则。本字段可以看作是一个开关,如果其中包含Ingress,则Ingress部分定义的规则生效,如果是Egress则Egress部分定义的规则生效,如果都包含则全部生效。当然此字段也可选,如果没有指定的话,则默认Ingress生效,如果Egress部分有定义的话,Egress才生效。怎么理解这句话,下文会提到,没有明确定义Ingress、Egress部分,它也是一种规则,默认规则而非没有规则。

.spec.ingress与.spec.egress

前者定义入pod规则,后者定义出pod规则,详细参考这里,这里只讲一下重点。上例中ingress与egress都只包含一条规则,两者都是数组,可以包含多条规则。当包含多条时,条目之间的逻辑关系是“或”,只要匹配其中一条就可以。.spec.ingress[].from
也是数组,数组成员对访问pod的外部source进行描述,符合条件的source才可以访问pod,有多种方法,如示例中的ip地址块、名称空间、pod标签等,数组中的成员也是逻辑或的关系。spec.ingress[].from.prots表示允许通过的协议及端口号。

.spec.egress.to定义的是pod想要访问的外部destination,其它与ingress相同。

.spec.ingress.to.namespaceSelector

namespace选择器,可以通过labels进行选择,此networkpolicy所属namespace下所有pod可以访问被选中的namespace下的pod

.spec.ingress.from.namespaceSelector

namespace选择器,可以通过labels进行选择,此networkpolicy所属namespace下所有pod可以被选中的namespace下的pod访问

1、为default创建访问策略

default中所有pod

只支持外网的入网和出网

屏蔽所有内网的出网和入网

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default
spec:
  podSelector: {}
  ingress:
    - from:
      - ipBlock:
          cidr: 0.0.0.0/0
          except:
          - 172.1.0.0/12
  egress:
    - to:
      - ipBlock:
          cidr: 0.0.0.0/0
          except:
          - 172.1.0.0/12
  policyTypes:
  - Egress
  - Ingress

2、为sub1和sub2创建访问策略

sub1和sub2相同

相比于default的访问策略

sub1和sub2中同一命名空间之中的pod可以相互访问

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: sub1
  namespace: sub1
spec:
  podSelector: {}
  egress:
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0
        except:
        - 172.1.0.0/12
    - namespaceSelector:
        matchLabels:
          ns: sub1
  ingress:
  - from:
    - ipBlock:
        cidr: 0.0.0.0/0
        except:
        - 172.1.0.0/12
    - namespaceSelector:
        matchLabels:
          ns: sub1
  policyTypes:
  - Egress
  - Ingress
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: sub2
  namespace: sub2
spec:
  podSelector: {}
  egress:
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0
        except:
        - 172.1.0.0/12
    - namespaceSelector:
        matchLabels:
          ns: sub2
  ingress:
  - from:
    - ipBlock:
        cidr: 0.0.0.0/0
        except:
        - 172.1.0.0/12
    - namespaceSelector:
        matchLabels:
          ns: sub2
  policyTypes:
  - Egress
  - Ingress

4、测试

  1. 测试出网情况,使用外网ip 106.13.118.232
  2. 测试同一命名空间下pod之间的访问
  3. 测试不同命名空间下pod之间的访问
  4. 测试外网的入网

4.1、创建pod

测试镜像为,vnc镜像

启动5个pod作为测试

开启hostPort端口映射,使用30001~30005主机端口

下面为pod模板

apiVersion: v1
kind: Pod
metadata:
 #Pod的名称,全局唯一
 name: ubuntu-vnc-1
 namespace: default
spec:
  containers:
   #容器名称
   - name: zyh
     #容器对应的Docker Image
     image: ubuntu-vnc:v2
     #command: [ "/bin/bash", "-c", "--" ]
     #args: [ "while true; do sleep 3600; done;" ]
     ports:
     - name: http
       containerPort: 80
       hostPort: 30001
       protocol: TCP

创建pod对应ip

default       ubuntu-vnc-1                                172.11.205.146   
default       ubuntu-vnc-2                                172.11.205.147 
sub1          ubuntu-vnc-3                                172.11.205.148   
sub1          ubuntu-vnc-4                                172.11.205.149   
sub2          ubuntu-vnc-5                                172.11.205.150

4.2、测试default中pod之间的通信

  1. 进入ubuntu-vnc-1中

    #测试出网ping 106.13.118.232
    root@ubuntu-vnc-1:/root# ping 106.13.118.232
    PING 106.13.118.232 (106.13.118.232): 56 data bytes
    64 bytes from 106.13.118.232: icmp_seq=0 ttl=52 time=28.637 ms
    64 bytes from 106.13.118.232: icmp_seq=1 ttl=52 time=28.978 ms
    64 bytes from 106.13.118.232: icmp_seq=2 ttl=52 time=31.893 ms
    64 bytes from 106.13.118.232: icmp_seq=3 ttl=52 time=28.490 ms
    64 bytes from 106.13.118.232: icmp_seq=4 ttl=52 time=27.679 ms
    64 bytes from 106.13.118.232: icmp_seq=5 ttl=52 time=28.395 ms
    64 bytes from 106.13.118.232: icmp_seq=6 ttl=52 time=28.359 ms
    64 bytes from 106.13.118.232: icmp_seq=7 ttl=52 time=28.945 ms
    64 bytes from 106.13.118.232: icmp_seq=8 ttl=52 time=28.167 ms
    64 bytes from 106.13.118.232: icmp_seq=9 ttl=52 time=27.802 ms
    64 bytes from 106.13.118.232: icmp_seq=10 ttl=52 time=27.804 ms
    64 bytes from 106.13.118.232: icmp_seq=11 ttl=52 time=27.502 ms
    64 bytes from 106.13.118.232: icmp_seq=12 ttl=52 time=27.933 ms
    64 bytes from 106.13.118.232: icmp_seq=13 ttl=52 time=28.100 ms
    64 bytes from 106.13.118.232: icmp_seq=14 ttl=52 time=28.016 ms
    64 bytes from 106.13.118.232: icmp_seq=15 ttl=52 time=27.551 ms
    ^C--- 106.13.118.232 ping statistics ---
    16 packets transmitted, 16 packets received, 0% packet loss
    round-trip min/avg/max/stddev = 27.502/28.391/31.893/1.005 ms
    #访问172.11.205.147
    root@ubuntu-vnc-1:/root# ping 172.11.205.147
    PING 172.11.205.147 (172.11.205.147): 56 data bytes
    ^C--- 172.11.205.147 ping statistics ---
    25 packets transmitted, 0 packets received, 100% packet loss
    
  2. 进入ubuntu-vnc-2中

    #测试出网ping 106.13.118.232
    root@ubuntu-vnc-2:/root# ping 106.13.118.232
    PING 106.13.118.232 (106.13.118.232): 56 data bytes
    64 bytes from 106.13.118.232: icmp_seq=0 ttl=52 time=28.881 ms
    64 bytes from 106.13.118.232: icmp_seq=1 ttl=52 time=28.398 ms
    64 bytes from 106.13.118.232: icmp_seq=2 ttl=52 time=28.302 ms
    64 bytes from 106.13.118.232: icmp_seq=3 ttl=52 time=27.717 ms
    ^C--- 106.13.118.232 ping statistics ---
    4 packets transmitted, 4 packets received, 0% packet loss
    round-trip min/avg/max/stddev = 27.717/28.324/28.881/0.414 ms
    #访问172.11.205.146
    root@ubuntu-vnc-2:/root# ping 172.11.205.146
    PING 172.11.205.146 (172.11.205.146): 56 data bytes
    ^C--- 172.11.205.146 ping statistics ---
    3 packets transmitted, 0 packets received, 100% packet loss
    
  3. 可以看出,ubuntu-vnc-1和 ubuntu-vnc-2是相互隔离的,但是都可以访问外网

4.3、测试sub1中pod之间的通信

  1. 进入ubuntu-vnc-3中

    #测试出网ping 106.13.118.232
    root@ubuntu-vnc-3:/root# ping 106.13.118.232
    PING 106.13.118.232 (106.13.118.232): 56 data bytes
    64 bytes from 106.13.118.232: icmp_seq=0 ttl=52 time=29.570 ms
    64 bytes from 106.13.118.232: icmp_seq=1 ttl=52 time=28.493 ms
    64 bytes from 106.13.118.232: icmp_seq=2 ttl=52 time=28.178 ms
    64 bytes from 106.13.118.232: icmp_seq=3 ttl=52 time=28.016 ms
    ^C--- 106.13.118.232 ping statistics ---
    4 packets transmitted, 4 packets received, 0% packet loss
    round-trip min/avg/max/stddev = 28.016/28.564/29.570/0.605 ms
    #访问172.11.205.149
    root@ubuntu-vnc-3:/root# ping 172.11.205.149
    PING 172.11.205.149 (172.11.205.149): 56 data bytes
    64 bytes from 172.11.205.149: icmp_seq=0 ttl=63 time=0.203 ms
    64 bytes from 172.11.205.149: icmp_seq=1 ttl=63 time=0.154 ms
    64 bytes from 172.11.205.149: icmp_seq=2 ttl=63 time=0.125 ms
    64 bytes from 172.11.205.149: icmp_seq=3 ttl=63 time=0.183 ms
    ^C--- 172.11.205.149 ping statistics ---
    4 packets transmitted, 4 packets received, 0% packet loss
    round-trip min/avg/max/stddev = 0.125/0.166/0.203/0.030 ms
    
  2. 进入ubuntu-vnc-4中

    #测试出网ping 106.13.118.232
    root@ubuntu-vnc-4:/root# ping 106.13.118.232
    PING 106.13.118.232 (106.13.118.232): 56 data bytes
    64 bytes from 106.13.118.232: icmp_seq=0 ttl=52 time=29.126 ms
    64 bytes from 106.13.118.232: icmp_seq=1 ttl=52 time=28.551 ms
    64 bytes from 106.13.118.232: icmp_seq=2 ttl=52 time=28.755 ms
    64 bytes from 106.13.118.232: icmp_seq=3 ttl=52 time=28.337 ms
    ^C--- 106.13.118.232 ping statistics ---
    4 packets transmitted, 4 packets received, 0% packet loss
    round-trip min/avg/max/stddev = 28.337/28.692/29.126/0.291 ms
    #访问172.11.205.148
    root@ubuntu-vnc-4:/root# ping 172.11.205.148
    PING 172.11.205.148 (172.11.205.148): 56 data bytes
    64 bytes from 172.11.205.148: icmp_seq=0 ttl=63 time=0.174 ms
    64 bytes from 172.11.205.148: icmp_seq=1 ttl=63 time=0.117 ms
    64 bytes from 172.11.205.148: icmp_seq=2 ttl=63 time=0.092 ms
    64 bytes from 172.11.205.148: icmp_seq=3 ttl=63 time=0.137 ms
    ^C--- 172.11.205.148 ping statistics ---
    4 packets transmitted, 4 packets received, 0% packet loss
    round-trip min/avg/max/stddev = 0.092/0.130/0.174/0.030 ms
    
  3. 可以看出,sub1中的pod之间可以正常通信,且正常访问外网

4.4、测试default中pod和sub1中pod之间的通信

  1. 进入ubuntu-vnc-1

    # ping 172.11.205.148
    root@ubuntu-vnc-1:/root# ping 172.11.205.148
    PING 172.11.205.148 (172.11.205.148): 56 data bytes
    ^C--- 172.11.205.148 ping statistics ---
    15 packets transmitted, 0 packets received, 100% packet loss
    # ping 172.11.205.149
    root@ubuntu-vnc-1:/root# ping 172.11.205.149
    PING 172.11.205.149 (172.11.205.149): 56 data bytes
    ^C--- 172.11.205.149 ping statistics ---
    6 packets transmitted, 0 packets received, 100% packet loss
    
  2. 进入ubuntu-vnc-3

    #ping 172.11.205.146
    root@ubuntu-vnc-3:/root# ping 172.11.205.146
    PING 172.11.205.146 (172.11.205.146): 56 data bytes
    ^C--- 172.11.205.146 ping statistics ---
    12 packets transmitted, 0 packets received, 100% packet loss
    
  3. 可以看出default中的pod和sub1中的pod无法通信

4.5、测试default中pod和sub1中pod之间的通信

  1. 进入ubuntu-vnc-5

    # ping 172.11.205.148
    root@ubuntu-vnc-5:/root# ping 172.11.205.148
    PING 172.11.205.148 (172.11.205.148): 56 data bytes
    ^C--- 172.11.205.148 ping statistics ---
    17 packets transmitted, 0 packets received, 100% packet loss
    # ping 172.11.205.149
    root@ubuntu-vnc-5:/root# ping 172.11.205.149
    PING 172.11.205.149 (172.11.205.149): 56 data bytes
    ^C--- 172.11.205.149 ping statistics ---
    19 packets transmitted, 0 packets received, 100% packet loss
    
  2. 进入ubuntu-vnc-3

    # ping 172.11.205.150
    root@ubuntu-vnc-3:/root# ping 170.11.25.150
    PING 170.11.25.150 (170.11.25.150): 56 data bytes
    ^C--- 170.11.25.150 ping statistics ---
    6 packets transmitted, 0 packets received, 100% packet loss
    
  3. 可以看出sub1中的pod和sub2中的pod无法通信

4.6、入网测试

在这里插入图片描述

外网可以访问pod

总结

calico网络插件支持networkpolicy网络访问策略

通过networkpolicy可以控制pod之间的隔离通信,且支持外网访问

Logo

K8S/Kubernetes社区为您提供最前沿的新闻资讯和知识内容

更多推荐