CKA备战08-真题：创建 NetworkPolicy

题目

Create a new NetworkPolicy named allow-port-from-namespace that allows Pods in the existing namespace internal to connect to port 9000 of other Pods in the same namespace.

Ensure that the new NetworkPolicy：

• does not allow access to Pods not listening on port 9000
• does not allow access from Pods not in namespace internal

答案

官网：Kubernetes 文档/概念/服务/负载均衡和联网/网络策略

https://kubernetes.io/docs/concepts/services-networking/network-policies/

如果你希望在 IP 地址或端口层面（OSI 第 3 层或第 4 层）控制网络流量， 则你可以考虑为集群中特定应用使用 Kubernetes 网络策略（NetworkPolicy）。

1.同一个 namespace

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-port-from-namespace
  namespace: internal
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress:
  - to:
    - podSelector: {}
    ports:
    - protocol: TCP
      port: 9000

2.不同 namespace

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-port-from-namespace
  namespace: internal
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          project: internal

3.yaml生效

$ kubectl config use-context hk8s
$ vi netwokpolicy.yaml
# 将上面的 yaml 内容粘贴进来
$ kubectl apply -f netwokpolicy.yaml