Kubernets NetworkPolicy Ingress

最新推荐文章于 2025-03-12 14:56:33 发布

Michael_曾浩

最新推荐文章于 2025-03-12 14:56:33 发布

阅读量488

点赞数

分类专栏： kubernetes

本文链接：https://blog.youkuaiyun.com/qq_29778131/article/details/85051039

版权

kubernetes 专栏收录该内容

9 篇文章

订阅专栏

本文深入探讨Kubernetes网络策略的配置与应用，通过多个实例展示如何限制不同命名空间及Pod间的网络访问，确保集群内的通信安全。从基础概念到实践操作，涵盖default命名空间内外的访问控制、特定Pod与端口的访问权限设定。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

仅允许NS内部请求

拒绝所有非default的namespace请求 default 命名空间下面的资源

apiVersion: extensions/v1beta1
kind: NetworkPolicy
metadata:
  name: deny-default
  namespace: default
spec:
  ingress:
 - from:
    - podSelector: {}
  podSelector: {}
  policyTypes:
 - Ingress

内部请求隔离

在default命名空间内仅允许标签为app: testredis 的pod访问标签为app: default-redis-rc-2 的6379端口

apiVersion: extensions/v1beta1
kind: NetworkPolicy
metadata:
  labels:
    app: default-redis-rc-2
  name: ns-pod2pod
  namespace: default
spec:
  ingress:
 - from:
    - podSelector:
        matchLabels:
          app: testredis
    ports:
    - port: 6379
      protocol: TCP
  podSelector:
    matchLabels:
      app: default-redis-rc-2
  policyTypes:
 - Ingress

NS 内部请求

仅允许 project: default 命名空间访问 app: default-redis-rc-2 的6379

apiVersion: extensions/v1beta1
kind: NetworkPolicy
metadata:
  labels:
    app: default-redis-rc-2
  name: pod2pod
  namespace: default
spec:
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          project: default
    ports:
    - protocol: TCP
  podSelector:
    matchLabels:
      app: default-redis-rc-2
  policyTypes:
  - Ingress

集群内非本namespace请求

允许ns为project: michael 访问default 命名空间下面的 app: default-redis-rc-2 下面的6379端口

apiVersion: extensions/v1beta1
kind: NetworkPolicy
metadata:
  labels:
    app: default-redis-rc-2
  name: pod2ns
  namespace: default
spec:
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          project: michael
    ports:
    - port: 6379
      protocol: TCP
  podSelector:
    matchLabels:
      app: default-redis-rc-2
  policyTypes:
  - Ingress

允许指定NS里面的POD访问

kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: ns-pod
  namespace: default
spec:
  podSelector:
    matchLabels:
      app: web
  ingress:
    - from:
      - namespaceSelector:    
          matchLabels:
             project: test
        podSelector:           
          matchLabels:
            test: pycheck

找到一个不错的github地址内涵动态图和yaml 还有说明

https://github.com/ahmetb/kubernetes-network-policy-recipes