Kubernetes的一個(gè)重要特性就是要把不同node節(jié)點(diǎn)的pod（container）連接起來，無視物理節(jié)點(diǎn)的限制。但是在某些應(yīng)用環(huán)境中，比如公有云，不同租戶的pod不應(yīng)該互通，這個(gè)時(shí)候就需要網(wǎng)絡(luò)隔離。幸好，Kubernetes提供了NetworkPolicy，支持按Namespace級(jí)別的網(wǎng)絡(luò)隔離。

使用NetworkPolicy需要kubernetes1.8以及calico2.6.2。

實(shí)驗(yàn)步驟 1.創(chuàng)建兩個(gè)namespace: ns-calico1、ns-calico2 2.分別在兩個(gè)namespace下創(chuàng)建應(yīng)用： ns-calico1下面創(chuàng)建三個(gè)應(yīng)用

ns-calico1下的calico1-busybox應(yīng)用：

apiVersion: extensions/v1beta1 kind: Deployment metadata: name: calico1-busybox namespace: ns-calico1 spec: replicas: 1 template: metadata: labels: user: calico1 app: calico1-busybox spec: containers: -name:calico1-busyboximage: busybox imagePullPolicy: IfNotPresent command: -sleep-"3600"

ns-calico1下的calico1-nginx應(yīng)用：

apiVersion: extensions/v1beta1 kind: Deployment metadata:name: calico1-nginxnamespace: ns-calico1spec:replicas: 1template:metadata:labels:user: calico1app: calico1-nginxspec:containers:- name: calico1-nginximage: nginxports:- containerPort: 80 ---apiVersion: v1 kind: Service metadata:name: calico1-nginxnamespace: ns-calico1labels:user: calico1spec:selector:app: calico1-nginxports:- port: 80

ns-calico1下的calico1-nginx2應(yīng)用：

apiVersion: extensions/v1beta1 kind: Deployment metadata:name: calico1-nginx2namespace: ns-calico1spec:replicas: 1template:metadata:labels:user: calico1app: calico1-nginx2spec:containers:- name: calico1-nginx2image: nginxports:- containerPort: 80 ---apiVersion: v1 kind: Service metadata:name: calico1-nginx2namespace: ns-calico1labels:user: calico1spec:selector:app: calico1-nginx2ports:- port: 80ns-

calico2下面創(chuàng)建一個(gè)應(yīng)用

ns-calico2下的calico2-busybox應(yīng)用：

apiVersion: extensions/v1beta1 kind: Deployment metadata: name: calico2-busybox namespace: ns-calico2 spec: replicas: 1 template: metadata: labels: user: calico2 app: calico2-busybox spec: containers: -name:calico2-busyboximage: busybox imagePullPolicy: IfNotPresent command: -sleep-"3600"

3.測(cè)試

3.1加策略前

測(cè)試結(jié)果

kubectl exec-itcalico1-busybox-5f4d7d5f4-n7qjg-nns-calico1--wget--spider--timeout=1calico1-nginx.ns-calico1Connectingtocalico1-nginx.ns-calico1(10.233.30.47:80) 通 kubectl exec-itcalico2-busybox-6dd875d4f-8747j-nns-calico2--wget--spider--timeout=1calico1-nginx.ns-calico1Connectingtocalico1-nginx.ns-calico1(10.233.30.47:80) 通

結(jié)論：加策略前，同namespace以及跨namespace的應(yīng)用之間都是互通的

3.2加策略后，應(yīng)用未打標(biāo)簽前

策略文件：

kind:NetworkPolicyapiVersion:networking.k8s.io/v1metadata:name: access-nginx namespace: ns-calico1spec:podSelector: matchLabels: app: calico1-nginx ingress: - from: - podSelector: matchLabels: access:"true"

說明：該策略只允許有access: “true”標(biāo)簽的應(yīng)用訪問ns-calico1下面有app: calico1-nginx標(biāo)簽的應(yīng)用，即我們的測(cè)試應(yīng)用

測(cè)試結(jié)果

kubectl exec-itcalico1-busybox-5f4d7d5f4-n7qjg-nns-calico1--wget--spider--timeout=1calico1-nginx.ns-calico1Connectingtocalico1-nginx.ns-calico1(10.233.30.47:80) wget: download timed out 不通 kubectl exec-itcalico2-busybox-6dd875d4f-8747j-nns-calico2--wget--spider--timeout=1calico1-nginx.ns-calico1Connectingtocalico1-nginx.ns-calico1(10.233.30.47:80) wget: download timed out 不通 kubectl exec-itcalico1-busybox-5f4d7d5f4-n7qjg-nns-calico1--wget--spider--timeout=1calico1-nginx2.ns-calico1Connectingtocalico1-nginx2.ns-calico1(10.233.23.44:80) 通 kubectl exec-itcalico2-busybox-6dd875d4f-8747j-nns-calico2--wget--spider--timeout=1calico1-nginx2.ns-calico1Connectingtocalico1-nginx2.ns-calico1(10.233.23.44:80) 通