通过定制NetworkPolicy，限制不同命名空间下的pod之间的网络策略

在Namespace space1和space2中有现有的Pod。

controlplane $ k get po -n space1
NAME     READY   STATUS    RESTARTS   AGE
app1-0   1/1     Running   0          29m
controlplane $ k get po -n space2
NAME              READY   STATUS    RESTARTS   AGE
microservice1-0   1/1     Running   0          29m
microservice2-0   1/1     Running   0          29m

定制一个名为np的新NetworkPolicy，限制Namespace space1中的所有Pod只能向Namespace space2中的Pod发出流量。

定制一个名为np的新NetworkPolicy，限制Namespace space2中的所有Pod只能从Namespace space1中的Pod传入流量。

网络政策应该仍然允许53端口的TCP和UDP的DNS流量

namespaceSelector对命名空间标签起作用，所以首先我们检查现有的命名空间标签

controlplane $ k get ns --show-labels
NAME              STATUS   AGE   LABELS
default           Active   84d   kubernetes.io/metadata.name=default
kube-node-lease   Active   84d   kubernetes.io/metadata.name=kube-node-lease
kube-public       Active   84d   kubernetes.io/metadata.name=kube-public
kube-system       Active   84d   kubernetes.io/metadata.name=kube-system
space1            Active   31m   kubernetes.io/metadata.name=space1
space2            Active   31m   kubernetes.io/metadata.name=space2

创建space1下的np,定制出口流量，只能将请求发往space2

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: np
  namespace: space1
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress:
  - to:
     - namespaceSelector:
        matchLabels:
         kubernetes.io/metadata.name: space2
  - ports:
    - port: 53
      protocol: TCP
    - port: 53
      protocol: UDP

创建space2下的np,定制入口流量,只接收处理space1下的请求

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: np
  namespace: space2
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  ingress:
   - from:
     - namespaceSelector:
        matchLabels:
         kubernetes.io/metadata.name: space1

验证

# these should work
k -n space1 exec app1-0 -- curl -m 1 microservice1.space2.svc.cluster.local
k -n space1 exec app1-0 -- curl -m 1 microservice2.space2.svc.cluster.local
k -n space1 exec app1-0 -- nslookup tester.default.svc.cluster.local
k -n kube-system exec -it validate-checker-pod -- curl -m 1 app1.space1.svc.cluster.local

# these should not work
k -n space1 exec app1-0 -- curl -m 1 tester.default.svc.cluster.local
k -n kube-system exec -it validate-checker-pod -- curl -m 1 microservice1.space2.svc.cluster.local
k -n kube-system exec -it validate-checker-pod -- curl -m 1 microservice2.space2.svc.cluster.local
k -n default run nginx --image=nginx:1.21.5-alpine --restart=Never -i --rm  -- curl -m 1 microservice1.space2.svc.cluster.local