《OpenShift 4.x HOL教程汇总》
本文在 OpenShift 4.11 + RHACS 3.71.0 环境中进行验证。
允许多个命名空间中的特定 Pod 相互访问
- 部署测试应用资源。
oc new-project project1
oc label namespace project1 name=project1
oc new-project project2
oc label namespace project2 name=project2
oc new-project project3
oc label namespace project3 name=project3
oc new-app -n project1 openshiftroadshow/parksmap --name=db
oc new-app -n project1 openshiftroadshow/parksmap --name=web
oc new-app -n project1 openshiftroadshow/parksmap --name=api
oc new-app -n project1 openshiftroadshow/parksmap --name=api-proxy
oc new-app -n project2 openshiftroadshow/parksmap --name=mail
oc new-app -n project2 openshiftroadshow/parksmap --name=db
oc new-app -n project2 openshiftroadshow/parksmap --name=monitoring
oc new-app -n project3 openshiftroadshow/parksmap --name=api
- 在 OpenShift 上运行以下 NetworkPolicy
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: protect-db
namespace: project1
spec:
ingress:
- from:
- podSelector:
matchExpressions:
- {key: deployment, operator: In, values: [api]}
- namespaceSelector:
matchLabels:
name: project2
podSelector:
matchLabels:
deployment: monitoring
podSelector:
matchLabels:
deployment: db
policyTypes:
- Ingress
- Egress
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: protect-api
namespace: project1
spec:
ingress:
- from:
- podSelector:
matchExpressions:
- {key: deployment, operator: In, values: [api-proxy,web]}
- namespaceSelector:
matchLabels:
name: project2
podSelector:
matchLabels:
deployment: monitoring
egress:
- to:
- podSelector:
matchExpressions:
- {key: deployment, operator: In, values: [db]}
- namespaceSelector:
matchLabels:
name: project3
podSelector:
matchLabels:
deployment: api
podSelector:
matchLabels:
deployment: api
policyTypes:
- Ingress
- Egress
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: protect-db
namespace: project2
spec:
ingress:
- from:
- podSelector:
matchLabels:
deployment: monitoring
- podSelector:
matchLabels:
deployment: mail
podSelector:
matchLabels:
deployment: db
policyTypes:
- Ingress
- Egress
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: protect-api
namespace: project3
spec:
ingress:
- from:
- namespaceSelector:
matchLabels:
name: project1
podSelector:
matchExpressions:
- {key: deployment, operator: In, values: [api,web,api-proxy]}
- namespaceSelector:
matchLabels:
name: project2
podSelector:
matchLabels:
deployment: monitoring
podSelector:
matchLabels:
deployment: api
policyTypes:
- Ingress
- 在 RHACS 控制台的 Network Graph 中选中 PROJECT1 的 db,可以通过连线和箭头看出网络策略只允许从 PROJECT1 的 api 和 PROJECT2 的 monitoring 访问到PROJECT1 的 db。
- 选中 PROJECT2 的 api,可以看到与之相关的进出网络策略,从箭头防线可以看出网络访问策略包括 3 进 2 出。
- 可以执行以下命令在一个 Pod 中访问目标 Pod ,通过联通结果确认和网络访问策略匹配。
oc project project1
oc exec $(oc get pod --no-headers -o name | grep api) -- curl -sI db.project1.svc.cluster.local:8080
oc exec $(oc get pod --no-headers -o name | grep api) -- curl -sI api.project3.svc.cluster.local:8080
oc exec $(oc get pod --no-headers -o name | grep web) -- curl -sI db.project1.svc.cluster.local:8080
oc project project2
oc exec $(oc get pod --no-headers -o name | grep monitoring) -- curl -sI api.project3.svc.cluster.local:8080
oc exec $(oc get pod --no-headers -o name | grep mail) -- curl -sI api.project3.svc.cluster.local:8080
oc project project3
oc exec $(oc get pod --no-headers -o name | grep api) -- curl -sI mail.project2.svc.cluster.local:8080
oc exec deploy/api -n project1 -- curl -sI db.project1.svc.cluster.local:8080
oc exec deploy/web -n project1 -- curl -sI db.project1.svc.cluster.local:8080
oc exec deploy/api -n project1 -- curl -sI api.project3.svc.cluster.local:8080
oc exec deploy/monitoring -n project2 -- curl -sI api.project3.svc.cluster.local:8080
oc exec deploy/mail -n project2 -- curl -sI api.project3.svc.cluster.local:8080
oc exec deploy/api -n project3 -- curl -sI mail.project2.svc.cluster.local:8080
在一个命名空间中,只允许具有相同标签的 Pod 之间访问
- 执行命令,创建测试应用
oc delete all --all
oc new-app --image=openshiftroadshow/parksmap --name=hello1 -l app.group=app-group-1
oc new-app --image=openshiftroadshow/parksmap --name=hello2 -l app.group=app-group-1
oc new-app --image=openshiftroadshow/parksmap --name=hello3 -l app.group=app-group-2
oc new-app --image=openshiftroadshow/parksmap --name=hello4 -l app.group=app-group-2
- 根据以下配置,分别针对 app-group-1 和 app-group-2 创建网络策略,只能让 app.group 标签相同的 Pod 之间相互访问。
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
name: app-group-1-policy
namespace: project1
spec:
podSelector:
matchLabels:
app.group: app-group-1
ingress:
- from:
- podSelector:
matchLabels:
app.group: app-group-1
policyTypes:
- Ingress
---
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
name: app-group-2-policy
namespace: project1
spec:
podSelector:
matchLabels:
app.group: app-group-2
ingress:
- from:
- podSelector:
matchLabels:
app.group: app-group-2
policyTypes:
- Ingress
- 在 RHACS 的 Network Graph 中分别查看 hello1、hello2、hello3 和 hello4 能被哪些 Pod 访问。
- 确认在 hello1 中只能访问 hello2
oc exec deploy/hello1 -n project1 -- curl -sI hello2:8080
oc exec deploy/hello1 -n project1 -- curl -sI hello3:8080
oc exec deploy/hello1 -n project1 -- curl -sI hello4:8080
- 确认在 hello3 中只能访问 hello4
oc exec deploy/hello3 -n project1 -- curl -sI hello1:8080
oc exec deploy/hello3 -n project1 -- curl -sI hello2:8080
oc exec deploy/hello3 -n project1 -- curl -sI hello4:8080