Kubernetes之NetworkPolicy的實踐
之前做過NetworkPolicy的實踐，那個比較簡單，只驗證了同一個namespace下不同應用之間的訪問控制場景，本周實踐了一下不同namespace下應用之間的訪問控制場景，
首先還是創建應用，一個sshd，另一個httpd，分屬于兩個不同的namespace，
vim sshd-deployment.yaml，
apiVersion: v1
kind: Namespace
metadata:
name: sshd
labels:
app: sshd
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: sshd
labels:
app: sshd
namespace: sshd
spec:
selector:
matchLabels:
app: sshd
template:
metadata:
labels:
app: sshd
spec:
containers:
- name: sshd
image: docker.mirrors.ustc.edu.cn/rastasheep/ubuntu-sshd:14.04
imagePullPolicy: IfNotPresent
ports:
- containerPort: 22
vim httpd-deployment.yaml，
apiVersion: v1
kind: Namespace
metadata:
name: httpd
labels:
app: httpd
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: httpd
labels:
app: httpd
namespace: httpd
spec:
replicas: 3
selector:
matchLabels:
app: httpd
template:
metadata:
labels:
app: httpd
spec:
containers:
- name: httpd
image: docker.mirrors.ustc.edu.cn/library/httpd
imagePullPolicy: IfNotPresent
ports:
- containerPort: 80
然后就是創建訪問控制策略，先給兩個namespace都搞成default deny，
vim sshd-policy-deny-all.yaml，
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-deny
namespace: sshd
spec:
podSelector: {}
policyTypes:
- Ingress
- Egress
vim httpd-policy-deny-all.yaml，
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-deny
namespace: httpd
spec:
podSelector: {}
policyTypes:
- Ingress
- Egress
然后再給sshd和httpd分別放開訪問策略，
vim policy-sshd-access.yaml，
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: sshd-network-policy
namespace: sshd
spec:
podSelector:
matchLabels:
app: sshd
policyTypes:
- Egress
egress:
- to:
- namespaceSelector:
matchLabels:
app: httpd
vim policy-httpd-access.yaml，
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: httpd-network-policy
namespace: httpd
spec:
podSelector:
matchLabels:
app: httpd
policyTypes:
- Ingress
ingress:
- from:
- namespaceSelector:
matchLabels:
app: sshd
最后看一下效果，
總結來說，NeworkPolicy要實現不同namespace下應用之間的訪問控制需要做到兩點：
1、每個namespace下要開default deny
2、訪問雙方應用各要搞一個放開訪問策略
3、放開訪問策略里匹配對端只能寫namespace
NeworkPolicy最后是把策略下到iptables上的，像下面這樣，
