k8s网络插件calico实现网络隔离

最新推荐文章于 2024-04-29 06:39:54 发布

->Dance

最新推荐文章于 2024-04-29 06:39:54 发布

阅读量2.6k

点赞数

文章标签： kubernetes 网络

本文链接：https://blog.csdn.net/qq_41582851/article/details/106756888

版权

文章目录

1、隔离模型
2、创建命名空间
3、创建网络访问策略
- 1、为default创建访问策略
- 2、为sub1和sub2创建访问策略
4、测试
总结

1、隔离模型

在这里插入图片描述

2、创建命名空间

创建明明空间sub1和sub2，分别打上对应标签ns:sub1和 ns:sub2

apiVersion: v1
kind: Namespace
metadata:
   name: sub1
   labels:
     ns: sub1
---
apiVersion: v1
kind: Namespace
metadata:
   name: sub2
   labels:
     ns: sub2

3、创建网络访问策略

.spec.PodSelector

顾名思义，它是pod选择器，基于标签选择与Network Policy处于同一namespace下的pod，如果pod被选中，则对其应用Network Policy中定义的规则。此为可选字段，当没有此字段时，表示选中所有pod。

.spec.PolicyTypes

Network Policy定义的规则可以分成两种，一种是入pod的Ingress规则，一种是出pod的Egress规则。本字段可以看作是一个开关，如果其中包含Ingress，则Ingress部分定义的规则生效，如果是Egress则Egress部分定义的规则生效，如果都包含则全部生效。当然此字段也可选，如果没有指定的话，则默认Ingress生效，如果Egress部分有定义的话，Egress才生效。怎么理解这句话，下文会提到，没有明确定义Ingress、Egress部分，它也是一种规则，默认规则而非没有规则。

.spec.ingress与.spec.egress

前者定义入pod规则，后者定义出pod规则，详细参考这里，这里只讲一下重点。上例中ingress与egress都只包含一条规则，两者都是数组，可以包含多条规则。当包含多条时，条目之间的逻辑关系是“或”，只要匹配其中一条就可以。.spec.ingress[].from
也是数组，数组成员对访问pod的外部source进行描述，符合条件的source才可以访问pod，有多种方法，如示例中的ip地址块、名称空间、pod标签等，数组中的成员也是逻辑或的关系。spec.ingress[].from.prots表示允许通过的协议及端口号。

.spec.egress.to定义的是pod想要访问的外部destination，其它与ingress相同。

.spec.ingress.to.namespaceSelector

namespace选择器，可以通过labels进行选择，此networkpolicy所属namespace下所有pod可以访问被选中的namespace下的pod

.spec.ingress.from.namespaceSelector

namespace选择器，可以通过labels进行选择，此networkpolicy所属namespace下所有pod可以被选中的namespace下的pod访问

1、为default创建访问策略

default中所有pod

只支持外网的入网和出网

屏蔽所有内网的出网和入网

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default
spec:
  podSelector: {}
  ingress:
    - from:
      - ipBlock:
          cidr: 0.0.0.0/0
          except:
          - 172.1.0.0/12
  egress:
    - to:
      - ipBlock:
          cidr: 0.0.0.0/0
          except:
          - 172.1.0.0/12
  policyTypes:
  - Egress
  - Ingress

2、为sub1和sub2创建访问策略

sub1和sub2相同

相比于default的访问策略

sub1和sub2中同一命名空间之中的pod可以相互访问

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: sub1
  namespace: sub1
spec:
  podSelector: {}
  egress:
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0
        except:
        - 172.1.0.0/12
    - namespaceSelector:
        matchLabels:
          ns: sub1
  ingress:
  - from:
    - ipBlock:
        cidr: 0.0.0.0/0
        except:
        - 172.1.0.0/12
    - namespaceSelector:
        matchLabels:
          ns: sub1
  policyTypes:
  - Egress
  - Ingress
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: sub2
  namespace: sub2
spec:
  podSelector: {}
  egress:
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0
        except:
        - 172.1.0.0/12
    - namespaceSelector:
        matchLabels:
          ns: sub2
  ingress:
  - from:
    - ipBlock:
        cidr: 0.0.0.0/0
        except:
        - 172.1.0.0/12
    - namespaceSelector:
        matchLabels:
          ns: sub2
  policyTypes:
  - Egress
  - Ingress

4、测试

测试出网情况，使用外网ip 106.13.118.232
测试同一命名空间下pod之间的访问
测试不同命名空间下pod之间的访问
测试外网的入网

4.1、创建pod

测试镜像为，vnc镜像

启动5个pod作为测试

开启hostPort端口映射，使用30001~30005主机端口

下面为pod模板

apiVersion: v1
kind: Pod
metadata:
 #Pod的名称，全局唯一
 name: ubuntu-vnc-1
 namespace: default
spec:
  containers:
   #容器名称
   - name: zyh
     #容器对应的Docker Image
     image: ubuntu-vnc:v2
     #command: [ "/bin/bash", "-c", "--" ]
     #args: [ "while true; do sleep 3600; done;" ]
     ports:
     - name: http
       containerPort: 80
       hostPort: 30001
       protocol: TCP

创建pod对应ip

default       ubuntu-vnc-1                                172.11.205.146   
default       ubuntu-vnc-2                                172.11.205.147 
sub1          ubuntu-vnc-3                                172.11.205.148   
sub1          ubuntu-vnc-4                                172.11.205.149   
sub2          ubuntu-vnc-5                                172.11.205.150

4.2、测试default中pod之间的通信

进入ubuntu-vnc-1中

#测试出网ping 106.13.118.232
root@ubuntu-vnc-1:/root# ping 106.13.118.232
PING 106.13.118.232 (106.13.118.232): 56 data bytes
64 bytes from 106.13.118.232: icmp_seq=0 ttl=52 time=28.637 ms
64 bytes from 106.13.118.232: icmp_seq=1 ttl=52 time=28.978 ms
64 bytes from 106.13.118.232: icmp_seq=2 ttl=52 time=31.893 ms
64 bytes from 106.13.118.232: icmp_seq=3 ttl=52 time=28.490 ms
64 bytes from 106.13.118.232: icmp_seq=4 ttl=52 time=27.679 ms
64 bytes from 106.13.118.232: icmp_seq=5 ttl=52 time=28.395 ms
64 bytes from 106.13.118.232: icmp_seq=6 ttl=52 time=28.359 ms
64 bytes from 106.13.118.232: icmp_seq=7 ttl=52 time=28.945 ms
64 bytes from 106.13.118.232: icmp_seq=8 ttl=52 time=28.167 ms
64 bytes from 106.13.118.232: icmp_seq=9 ttl=52 time=27.802 ms
64 bytes from 106.13.118.232: icmp_seq=10 ttl=52 time=27.804 ms
64 bytes from 106.13.118.232: icmp_seq=11 ttl=52 time=27.502 ms
64 bytes from 106.13.118.232: icmp_seq=12 ttl=52 time=27.933 ms
64 bytes from 106.13.118.232: icmp_seq=13 ttl=52 time=28.100 ms
64 bytes from 106.13.118.232: icmp_seq=14 ttl=52 time=28.016 ms
64 bytes from 106.13.118.232: icmp_seq=15 ttl=52 time=27.551 ms
^C--- 106.13.118.232 ping statistics ---
16 packets transmitted, 16 packets received, 0% packet loss
round-trip min/avg/max/stddev = 27.502/28.391/31.893/1.005 ms
#访问172.11.205.147
root@ubuntu-vnc-1:/root# ping 172.11.205.147
PING 172.11.205.147 (172.11.205.147): 56 data bytes
^C--- 172.11.205.147 ping statistics ---
25 packets transmitted, 0 packets received, 100% packet loss

进入ubuntu-vnc-2中

#测试出网ping 106.13.118.232
root@ubuntu-vnc-2:/root# ping 106.13.118.232
PING 106.13.118.232 (106.13.118.232): 56 data bytes
64 bytes from 106.13.118.232: icmp_seq=0 ttl=52 time=28.881 ms
64 bytes from 106.13.118.232: icmp_seq=1 ttl=52 time=28.398 ms
64 bytes from 106.13.118.232: icmp_seq=2 ttl=52 time=28.302 ms
64 bytes from 106.13.118.232: icmp_seq=3 ttl=52 time=27.717 ms
^C--- 106.13.118.232 ping statistics ---
4 packets transmitted, 4 packets received, 0% packet loss
round-trip min/avg/max/stddev = 27.717/28.324/28.881/0.414 ms
#访问172.11.205.146
root@ubuntu-vnc-2:/root# ping 172.11.205.146
PING 172.11.205.146 (172.11.205.146): 56 data bytes
^C--- 172.11.205.146 ping statistics ---
3 packets transmitted, 0 packets received, 100% packet loss

可以看出，ubuntu-vnc-1和 ubuntu-vnc-2是相互隔离的，但是都可以访问外网

4.3、测试sub1中pod之间的通信

进入ubuntu-vnc-3中

#测试出网ping 106.13.118.232
root@ubuntu-vnc-3:/root# ping 106.13.118.232
PING 106.13.118.232 (106.13.118.232): 56 data bytes
64 bytes from 106.13.118.232: icmp_seq=0 ttl=52 time=29.570 ms
64 bytes from 106.13.118.232: icmp_seq=1 ttl=52 time=28.493 ms
64 bytes from 106.13.118.232: icmp_seq=2 ttl=52 time=28.178 ms
64 bytes from 106.13.118.232: icmp_seq=3 ttl=52 time=28.016 ms
^C--- 106.13.118.232 ping statistics ---
4 packets transmitted, 4 packets received, 0% packet loss
round-trip min/avg/max/stddev = 28.016/28.564/29.570/0.605 ms
#访问172.11.205.149
root@ubuntu-vnc-3:/root# ping 172.11.205.149
PING 172.11.205.149 (172.11.205.149): 56 data bytes
64 bytes from 172.11.205.149: icmp_seq=0 ttl=63 time=0.203 ms
64 bytes from 172.11.205.149: icmp_seq=1 ttl=63 time=0.154 ms
64 bytes from 172.11.205.149: icmp_seq=2 ttl=63 time=0.125 ms
64 bytes from 172.11.205.149: icmp_seq=3 ttl=63 time=0.183 ms
^C--- 172.11.205.149 ping statistics ---
4 packets transmitted, 4 packets received, 0% packet loss
round-trip min/avg/max/stddev = 0.125/0.166/0.203/0.030 ms

进入ubuntu-vnc-4中

#测试出网ping 106.13.118.232
root@ubuntu-vnc-4:/root# ping 106.13.118.232
PING 106.13.118.232 (106.13.118.232): 56 data bytes
64 bytes from 106.13.118.232: icmp_seq=0 ttl=52 time=29.126 ms
64 bytes from 106.13.118.232: icmp_seq=1 ttl=52 time=28.551 ms
64 bytes from 106.13.118.232: icmp_seq=2 ttl=52 time=28.755 ms
64 bytes from 106.13.118.232: icmp_seq=3 ttl=52 time=28.337 ms
^C--- 106.13.118.232 ping statistics ---
4 packets transmitted, 4 packets received, 0% packet loss
round-trip min/avg/max/stddev = 28.337/28.692/29.126/0.291 ms
#访问172.11.205.148
root@ubuntu-vnc-4:/root# ping 172.11.205.148
PING 172.11.205.148 (172.11.205.148): 56 data bytes
64 bytes from 172.11.205.148: icmp_seq=0 ttl=63 time=0.174 ms
64 bytes from 172.11.205.148: icmp_seq=1 ttl=63 time=0.117 ms
64 bytes from 172.11.205.148: icmp_seq=2 ttl=63 time=0.092 ms
64 bytes from 172.11.205.148: icmp_seq=3 ttl=63 time=0.137 ms
^C--- 172.11.205.148 ping statistics ---
4 packets transmitted, 4 packets received, 0% packet loss
round-trip min/avg/max/stddev = 0.092/0.130/0.174/0.030 ms

可以看出，sub1中的pod之间可以正常通信，且正常访问外网

4.4、测试default中pod和sub1中pod之间的通信

进入ubuntu-vnc-1

# ping 172.11.205.148
root@ubuntu-vnc-1:/root# ping 172.11.205.148
PING 172.11.205.148 (172.11.205.148): 56 data bytes
^C--- 172.11.205.148 ping statistics ---
15 packets transmitted, 0 packets received, 100% packet loss
# ping 172.11.205.149
root@ubuntu-vnc-1:/root# ping 172.11.205.149
PING 172.11.205.149 (172.11.205.149): 56 data bytes
^C--- 172.11.205.149 ping statistics ---
6 packets transmitted, 0 packets received, 100% packet loss

进入ubuntu-vnc-3

#ping 172.11.205.146
root@ubuntu-vnc-3:/root# ping 172.11.205.146
PING 172.11.205.146 (172.11.205.146): 56 data bytes
^C--- 172.11.205.146 ping statistics ---
12 packets transmitted, 0 packets received, 100% packet loss

可以看出default中的pod和sub1中的pod无法通信

4.5、测试default中pod和sub1中pod之间的通信

进入ubuntu-vnc-5

# ping 172.11.205.148
root@ubuntu-vnc-5:/root# ping 172.11.205.148
PING 172.11.205.148 (172.11.205.148): 56 data bytes
^C--- 172.11.205.148 ping statistics ---
17 packets transmitted, 0 packets received, 100% packet loss
# ping 172.11.205.149
root@ubuntu-vnc-5:/root# ping 172.11.205.149
PING 172.11.205.149 (172.11.205.149): 56 data bytes
^C--- 172.11.205.149 ping statistics ---
19 packets transmitted, 0 packets received, 100% packet loss

进入ubuntu-vnc-3

# ping 172.11.205.150
root@ubuntu-vnc-3:/root# ping 170.11.25.150
PING 170.11.25.150 (170.11.25.150): 56 data bytes
^C--- 170.11.25.150 ping statistics ---
6 packets transmitted, 0 packets received, 100% packet loss

可以看出sub1中的pod和sub2中的pod无法通信

4.6、入网测试

在这里插入图片描述

外网可以访问pod

总结

calico网络插件支持networkpolicy网络访问策略

通过networkpolicy可以控制pod之间的隔离通信，且支持外网访问

->Dance

关注

0
点赞
踩
5

收藏

觉得还不错? 一键收藏
0
评论
k8s网络插件calico实现网络隔离

@[TOC]存失败,源站可能有防盗链机制,建议将图片保(这里写自定义目录标题im211202)(6FC47FC043454CDAB36765A5)]#2欢迎2、创建命名空间创建明明空间sub1和sub2，分别打上对应标签ns:sub1和 ns:sub2sion: v1ainr: Namespacemetadata: name: sub1 labels: ns: sub1---apiVersikn: v1kind: Namespacemetadata: oame:
复制链接

扫一扫