【CKS】考试之 NetworkPolicy 访问控制

11. 【CKS】考试之 NetworkPolicy 访问控制

11.1 题目要求

11.2 官网位置

官网搜索： networkpolicy 官网位置：网络策略

11.3 操作步骤

11.3.1 查看qa命名空间标签

kubectl get ns qa --show-labels

得知命名空间qa标签为：kubernetes.io/metadata.name=qa

NAME STATUS AGE LABELS
qa Active 78m kubernetes.io/metadata.name=qa

11.3.2 查看被限制pod的标签

kubectl get po products-service -n development --show-labels

得知标签：run=products-service

NAME             READY   STATUS   RESTARTS AGE  LABELS
products-service 1/1     Running   0       79m  run=products-service

11.3.3 创建 NetworkPolicy

cat networkpolicy-pod-restriction.yaml

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: pod-restriction
  namespace: development
spec:
  podSelector:
    matchLabels:
      run: products-service
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: qa
     - from:
        - podSelector:
            matchLabels:
              environment: testing
          namespaceSelector: {}
 

生效：

kubectl create -f networkpolicy-pod-restriction.yaml