k8s资源之NetworkPolicy

矫情吗；* 2023-06-29 07:24 7阅读 0赞

#  欢迎关注我的公众号： #

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAaHhwamF2YTE_size_8_color_FFFFFF_t_70_g_se_x_16][]

目前刚开始写一个月，一共写了18篇原创文章，文章目录如下：

[istio多集群探秘，部署了50次多集群后我得出的结论][istio_50]

[istio多集群链路追踪，附实操视频][istio]

[istio防故障利器，你知道几个,istio新手不要读，太难！][istio_istio]

[istio业务权限控制，原来可以这么玩][istio 1]

[istio实现非侵入压缩，微服务之间如何实现压缩][istio 2]

[不懂envoyfilter也敢说精通istio系列-http-rbac-不要只会用AuthorizationPolicy配置权限][envoyfilter_istio_-http-rbac-_AuthorizationPolicy]

[不懂envoyfilter也敢说精通istio系列-02-http-corsFilter-不要只会vs][envoyfilter_istio_-02-http-corsFilter-_vs]

[不懂envoyfilter也敢说精通istio系列-03-http-csrf filter-再也不用再代码里写csrf逻辑了][envoyfilter_istio_-03-http-csrf filter-_csrf]

[不懂envoyfilter也敢说精通istio系列http-jwt\_authn-不要只会RequestAuthorization][envoyfilter_istio_http-jwt_authn-_RequestAuthorization]

[不懂envoyfilter也敢说精通istio系列-05-fault-filter-故障注入不止是vs][envoyfilter_istio_-05-fault-filter-_vs]

[不懂envoyfilter也敢说精通istio系列-06-http-match-配置路由不只是vs][envoyfilter_istio_-06-http-match-_vs]

[不懂envoyfilter也敢说精通istio系列-07-负载均衡配置不止是dr][envoyfilter_istio_-07-_dr]

[不懂envoyfilter也敢说精通istio系列-08-连接池和断路器][envoyfilter_istio_-08-]

[不懂envoyfilter也敢说精通istio系列-09-http-route filter][envoyfilter_istio_-09-http-route filter]

[不懂envoyfilter也敢说精通istio系列-network filter-redis proxy][envoyfilter_istio_-network filter-redis proxy]

[不懂envoyfilter也敢说精通istio系列-network filter-HttpConnectionManager][envoyfilter_istio_-network filter-HttpConnectionManager]

[不懂envoyfilter也敢说精通istio系列-ratelimit-istio ratelimit完全手册][envoyfilter_istio_-ratelimit-istio ratelimit]

————————————————

# NetworkPolicy： #

•使用network policy资源可以配置pod的网络，networkPolicy是namespace scoped的，也就是作用域只是在某个namespace，它只能影响某个namespace下的pod的网络出入站规则。

•不是所有的 Kubernetes 网络方案都支持 Network Policy。比如 Flannel 就不支持

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h4cGphdmEx_size_16_color_FFFFFF_t_70][]

# ingress： #

## deny all： ##

[root@master01 networkPolicy]# cat default-deny-ingress.yaml 
    apiVersion: networking.k8s.io/v1
    kind: NetworkPolicy
    metadata:
      name: default-deny
    spec:
      podSelector: {}
      policyTypes:
      - Ingress

## allow all： ##

[root@master01 networkPolicy]# cat allow-all-ingress.yaml 
    apiVersion: networking.k8s.io/v1
    kind: NetworkPolicy
    metadata:
      name: allow-all
    spec:
      podSelector: {}
      ingress:
      - {}

## namespaceSelector： ##

[root@master01 networkPolicy]# cat namespace-access-ingress.yaml 
    apiVersion: networking.k8s.io/v1
    kind: NetworkPolicy
    metadata:
      name: test-network-policy
      namespace: default
    spec:
      podSelector:
        matchLabels:
          app: nginx
      policyTypes:
      - Ingress
      ingress:
      - from:
        - namespaceSelector:
            matchLabels:
              project: dev
        ports:
        - protocol: TCP
          port: 80

## podSelector: ##

[root@master01 networkPolicy]# cat podSelector-ingerss.yaml 
    apiVersion: networking.k8s.io/v1
    kind: NetworkPolicy
    metadata:
      name: test-network-policy
      namespace: default
    spec:
      podSelector:
        matchLabels:
          app: nginx
      policyTypes:
      - Ingress
      - Egress
      ingress:
      - from:
        - podSelector:
            matchLabels:
              app: busybox
        ports:
        - protocol: TCP
          port: 80

## ipBlock: ##

[root@master01 networkPolicy]# cat ip-ingerss.yaml 
    apiVersion: networking.k8s.io/v1
    kind: NetworkPolicy
    metadata:
      name: test-network-policy
      namespace: default
    spec:
      podSelector:
        matchLabels:
          app: nginx
      policyTypes:
      - Ingress
      - Egress
      ingress:
      - from:
        - ipBlock:
            cidr: 172.20.59.192/32

## 整合: ##

[root@master01 networkPolicy]# cat namespace-podSelector-ingress.yaml 
    apiVersion: networking.k8s.io/v1
    kind: NetworkPolicy
    metadata:
      name: test-network-policy
    spec:
      podSelector:
        matchLabels:
          app: nginx
      policyTypes:
      - Ingress
      ingress:
      - from:
        - namespaceSelector:
            matchLabels:
              project: dev
        - podSelector:
            matchLabels:
              app: busybox
        ports:
        - protocol: TCP
          port: 80

[root@master01 networkPolicy]# cat namespace-podSelector-ip-ingress.yaml 
    apiVersion: networking.k8s.io/v1
    kind: NetworkPolicy
    metadata:
      name: test-network-policy
    spec:
      podSelector:
        matchLabels:
          app: nginx
      policyTypes:
      - Ingress
      ingress:
      - from:
        - ipBlock:
            cidr: 172.20.0.0/16
            except:
            - 172.20.58.195/32
        - namespaceSelector:
            matchLabels:
              project: dev
        - podSelector:
            matchLabels:
              app: busybox
        ports:
        - protocol: TCP
          port: 80

# egress: #

## default deny: ##

[root@master01 networkPolicy]# cat default-deny-egress.yaml 
    apiVersion: networking.k8s.io/v1
    kind: NetworkPolicy
    metadata:
     name: default-deny
    spec:
     podSelector: {}
     policyTypes:
     - Egress

## allow all: ##

[root@master01 networkPolicy]# cat allow-all-egress.yaml 
    apiVersion: networking.k8s.io/v1
    kind: NetworkPolicy
    metadata:
     name: allow-all
    spec:
     podSelector: {}
     egress:
     - {}
     policyTypes:
     - Egress

## namespaceSelector: ##

[root@master01 networkPolicy]# cat namespace-egress.yaml 
    apiVersion: networking.k8s.io/v1
    kind: NetworkPolicy
    metadata:
      name: test-network-policy
    spec:
      podSelector:
        matchLabels:
          app: busybox
      policyTypes:
      - Egress
      egress:
      - to:
        - namespaceSelector:
            matchLabels:
              project: dev
        ports:
        - protocol: TCP
          port: 80

## podSelector: ##

[root@master01 networkPolicy]# cat podSelector-egerss.yaml 
    apiVersion: networking.k8s.io/v1
    kind: NetworkPolicy
    metadata:
      name: test-network-policy
    spec:
      podSelector:
        matchLabels:
          app: busybox
      policyTypes:
      - Egress
      egress:
      - to:
        - podSelector:
            matchLabels:
              app: nginx
        ports:
        - protocol: TCP
          port: 80

## ipBlock: ##

[root@master01 networkPolicy]# cat ip-egress.yaml 
    apiVersion: networking.k8s.io/v1
    kind: NetworkPolicy
    metadata:
      name: test-network-policy
    spec:
      podSelector:
        matchLabels:
          app: busybox
      policyTypes:
      - Egress
      egress:
      - to:
        - ipBlock:
            cidr: 172.20.59.192/32

## 整合: ##

[root@master01 networkPolicy]# cat namespace-podSelector-egress.yaml 
    apiVersion: networking.k8s.io/v1
    kind: NetworkPolicy
    metadata:
      name: test-network-policy
    spec:
      podSelector:
        matchLabels:
          app: busybox
      policyTypes:
      - Egress
      egress:
      - to :
        - namespaceSelector:
            matchLabels:
              project: dev
        - podSelector:
            matchLabels:
              app: nginx
        ports:
        - protocol: TCP
          port: 80

[root@master01 networkPolicy]# cat namespace-podSelector-ip-egress.yaml 
    apiVersion: networking.k8s.io/v1
    kind: NetworkPolicy
    metadata:
      name: test-network-policy
    spec:
      podSelector:
        matchLabels:
          app: busybox
      policyTypes:
      - Egress
      egress:
      - to:
        - ipBlock:
            cidr: 172.20.0.0/16
            except:
            - 172.20.58.195/32
        - namespaceSelector:
            matchLabels:
              project: dev
        - podSelector:
            matchLabels:
              app: nginx
        ports:
        - protocol: TCP
          port: 80

## ingerss egress 完整例子： ##

[root@master01 networkPolicy]# cat ingress-egress.yaml 
    apiVersion: networking.k8s.io/v1
    kind: NetworkPolicy
    metadata:
      name: test-network-policy
    spec:
      podSelector:
        matchLabels:
          app: nginx
      policyTypes:
      - Ingress
      - Egress
      ingress:
      - from:
        - ipBlock:
            cidr: 172.20.0.0/16
            except:
            - 172.20.58.195/32
        - namespaceSelector:
            matchLabels:
              project: dev
        - podSelector:
            matchLabels:
              app: busybox
        ports:
        - protocol: TCP
          port: 80
      egress:
      - to:
        - ipBlock:
            cidr: 172.20.0.0/16
            except:
            - 172.20.58.195/32
        - namespaceSelector:
            matchLabels:
              project: dev
        - podSelector:
            matchLabels:
              app: nginx
        ports:
        - protocol: TCP
          port: 80

[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAaHhwamF2YTE_size_8_color_FFFFFF_t_70_g_se_x_16]: https://img-blog.csdnimg.cn/20211007094240106.jpg?x-oss-process=image/watermark,type_ZHJvaWRzYW5zZmFsbGJhY2s,shadow_50,text_Q1NETiBAaHhwamF2YTE=,size_8,color_FFFFFF,t_70,g_se,x_16
[istio_50]: https://mp.weixin.qq.com/s/_OPMjmWCDSTlmbAxytg33A
[istio]: https://mp.weixin.qq.com/s/kjvtno_UzJAGr1joxm3tvw
[istio_istio]: https://mp.weixin.qq.com/s/e2-p_NY31Mc5y07S4Bb1JQ
[istio 1]: https://mp.weixin.qq.com/s/iTV0SCQLhSOTYncp3PxoHQ
[istio 2]: https://mp.weixin.qq.com/s/eINlrT242RlAwfuZu1_PcA
[envoyfilter_istio_-http-rbac-_AuthorizationPolicy]: https://mp.weixin.qq.com/s/Q-yTGBNqkjOov49LTXPrPA
[envoyfilter_istio_-02-http-corsFilter-_vs]: https://mp.weixin.qq.com/s/bFMdrT7OKSqoWv8pDXOIqQ
[envoyfilter_istio_-03-http-csrf filter-_csrf]: https://mp.weixin.qq.com/s/dlG9phV-kMMxs4UPzuRNYg
[envoyfilter_istio_http-jwt_authn-_RequestAuthorization]: https://mp.weixin.qq.com/s/IfrJ-FdLYsdhPkDrcO_YXA
[envoyfilter_istio_-05-fault-filter-_vs]: https://mp.weixin.qq.com/s/a4gDXqD8uswgglMwkUph2Q
[envoyfilter_istio_-06-http-match-_vs]: https://mp.weixin.qq.com/s/TpS3DHdcaJiPivIS_jsIGw
[envoyfilter_istio_-07-_dr]: https://mp.weixin.qq.com/s/k-zJm7n7OOKg6MotQJYPAA
[envoyfilter_istio_-08-]: https://mp.weixin.qq.com/s/n_bJ3saNeTtXRprIymhwzg
[envoyfilter_istio_-09-http-route filter]: https://mp.weixin.qq.com/s/JAeZr0BMVQxIrB3S_7Ru0A
[envoyfilter_istio_-network filter-redis proxy]: https://mp.weixin.qq.com/s/B9IPTI8F3q42nVkqbQRlPw
[envoyfilter_istio_-network filter-HttpConnectionManager]: https://mp.weixin.qq.com/s/W3OPQWkCVvuHGS49cTNhlg
[envoyfilter_istio_-ratelimit-istio ratelimit]: https://mp.weixin.qq.com/s/KgiDsELNol27mgZvDbFsqw
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h4cGphdmEx_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20200111113522728.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2h4cGphdmEx,size_16,color_FFFFFF,t_70