OpenShift Security (12) - 用 RHACS 管理容器之间的网络访问策略（附视频）

《OpenShift 4.x HOL教程汇总》
本文在 OpenShift 4.11 + RHACS 3.71.0 环境中进行验证。

允许多个命名空间中的特定 Pod 相互访问

1. 部署测试应用资源。

oc new-project project1
oc label namespace project1 name=project1
oc new-project project2
oc label namespace project2 name=project2
oc new-project project3
oc label namespace project3 name=project3
  
oc new-app -n project1 openshiftroadshow/parksmap --name=db
oc new-app -n project1 openshiftroadshow/parksmap --name=web
oc new-app -n project1 openshiftroadshow/parksmap --name=api
oc new-app -n project1 openshiftroadshow/parksmap --name=api-proxy
 
oc new-app -n project2 openshiftroadshow/parksmap --name=mail
oc new-app -n project2 openshiftroadshow/parksmap --name=db
oc new-app -n project2 openshiftroadshow/parksmap --name=monitoring
 
oc new-app -n project3 openshiftroadshow/parksmap --name=api

2. 在 OpenShift 上运行以下 NetworkPolicy

---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: protect-db
  namespace: project1
spec:
  ingress:
  - from:
    - podSelector:
        matchExpressions:
          - {key: deployment, operator: In, values: [api]}
    - namespaceSelector:
        matchLabels:
          name: project2
      podSelector:
        matchLabels:
          deployment: monitoring
  podSelector:
    matchLabels:
      deployment: db
  policyTypes:
  - Ingress
  - Egress
 
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: protect-api
  namespace: project1
spec:
  ingress:
  - from:
    - podSelector:
        matchExpressions:
          - {key: deployment, operator: In, values: [api-proxy,web]}
    - namespaceSelector:
        matchLabels:
          name: project2
      podSelector:
        matchLabels:
          deployment: monitoring
  egress:
  - to:
    - podSelector:
        matchExpressions:
          - {key: deployment, operator: In, values: [db]}
    - namespaceSelector:
        matchLabels:
          name: project3
      podSelector:
        matchLabels:
          deployment: api
  podSelector:
    matchLabels:
      deployment: api
  policyTypes:
  - Ingress
  - Egress
 
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: protect-db
  namespace: project2
spec:
  ingress:
  - from:
    - podSelector:
        matchLabels:
          deployment: monitoring
    - podSelector:
        matchLabels:
          deployment: mail
  podSelector:
    matchLabels:
      deployment: db
  policyTypes:
  - Ingress
  - Egress
 
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: protect-api
  namespace: project3
spec:
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: project1
      podSelector:
        matchExpressions:
          - {key: deployment, operator: In, values: [api,web,api-proxy]}
    - namespaceSelector:
        matchLabels:
          name: project2
      podSelector:
        matchLabels:
          deployment: monitoring
  podSelector:
    matchLabels:
      deployment: api
  policyTypes:
  - Ingress

3. 在 RHACS 控制台的 Network Graph 中选中 PROJECT1 的 db，可以通过连线和箭头看出网络策略只允许从 PROJECT1 的 api 和 PROJECT2 的 monitoring 访问到PROJECT1 的 db。
   
4. 选中 PROJECT2 的 api，可以看到与之相关的进出网络策略，从箭头防线可以看出网络访问策略包括 3 进 2 出。
   
5. 可以执行以下命令在一个 Pod 中访问目标 Pod ，通过联通结果确认和网络访问策略匹配。

oc project project1
oc exec $(oc get pod --no-headers -o name | grep api) -- curl -sI db.project1.svc.cluster.local:8080
oc exec $(oc get pod --no-headers -o name | grep api) -- curl -sI api.project3.svc.cluster.local:8080
oc exec $(oc get pod --no-headers -o name | grep web) -- curl -sI db.project1.svc.cluster.local:8080

oc project project2
oc exec $(oc get pod --no-headers -o name | grep monitoring) -- curl -sI api.project3.svc.cluster.local:8080
oc exec $(oc get pod --no-headers -o name | grep mail) -- curl -sI api.project3.svc.cluster.local:8080

oc project project3
oc exec $(oc get pod --no-headers -o name | grep api) -- curl -sI mail.project2.svc.cluster.local:8080

oc exec deploy/api -n project1 -- curl -sI db.project1.svc.cluster.local:8080
oc exec deploy/web -n project1 -- curl -sI db.project1.svc.cluster.local:8080
oc exec deploy/api -n project1 -- curl -sI api.project3.svc.cluster.local:8080

oc exec deploy/monitoring -n project2 -- curl -sI api.project3.svc.cluster.local:8080
oc exec deploy/mail -n project2 -- curl -sI api.project3.svc.cluster.local:8080

oc exec deploy/api -n project3 -- curl -sI mail.project2.svc.cluster.local:8080

在一个命名空间中，只允许具有相同标签的 Pod 之间访问

1. 执行命令，创建测试应用

oc delete all --all
oc new-app --image=openshiftroadshow/parksmap --name=hello1 -l app.group=app-group-1
oc new-app --image=openshiftroadshow/parksmap --name=hello2 -l app.group=app-group-1
oc new-app --image=openshiftroadshow/parksmap --name=hello3 -l app.group=app-group-2
oc new-app --image=openshiftroadshow/parksmap --name=hello4 -l app.group=app-group-2

2. 根据以下配置，分别针对 app-group-1 和 app-group-2 创建网络策略，只能让 app.group 标签相同的 Pod 之间相互访问。
   

kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: app-group-1-policy
  namespace: project1
spec:
  podSelector:
    matchLabels:
      app.group: app-group-1
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app.group: app-group-1
  policyTypes:
    - Ingress
---
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: app-group-2-policy
  namespace: project1
spec:
  podSelector:
    matchLabels:
      app.group: app-group-2
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app.group: app-group-2
  policyTypes:
    - Ingress

3. 在 RHACS 的 Network Graph 中分别查看 hello1、hello2、hello3 和 hello4 能被哪些 Pod 访问。
   
4. 确认在 hello1 中只能访问 hello2

oc exec deploy/hello1 -n project1 -- curl -sI hello2:8080
oc exec deploy/hello1 -n project1 -- curl -sI hello3:8080
oc exec deploy/hello1 -n project1 -- curl -sI hello4:8080

5. 确认在 hello3 中只能访问 hello4

oc exec deploy/hello3 -n project1 -- curl -sI hello1:8080
oc exec deploy/hello3 -n project1 -- curl -sI hello2:8080
oc exec deploy/hello3 -n project1 -- curl -sI hello4:8080

演示视频

视频