kubernetes networkpolicy

1.首先创建namespace隔离策略为DefaultDeny

kind: Namespace
apiVersion: v1
metadata:
name: testingnp
annotations:
net.beta.kubernetes.io/network-policy: |
{
"ingress": {
"isolation": "DefaultDeny"
}
}

或者通过命令行对已有namesapce操作

kubectl annotate ns testingnp "net.beta.kubernetes.io/network-policy={\"ingress\": {\"isolation\": \"DefaultDeny\"}}"

通过spec.podSelector.matchLabels 制定操作的pod对象

spec.ingress from/ports来制定允许访问的pod和端口

2.在开启isolation的namespace运行、暴漏服务

kubectl run nginx --image=nginx --replicas=2 --namespace=testingnp
kubectl expose deployment nginx --port=80  --namespace=testingnp

3.测试连接状态

kubectl run busybox --rm -ti --image=busybox /bin/sh --namespace=testingnp

wget nginx 发现是无法访问的

4.添加networkpolicy

echo '
kind: NetworkPolicy
apiVersion: extensions/v1beta1
metadata:
name: access-nginx
namespace: testingnp
spec:
podSelector:
matchLabels:
run: nginx
ingress:
- from:
- podSelector:
matchLabels:
access: "true"
' | kubectl create  -f -
kubectl get networkpolicies --namespace=testingnp

5.再次验证

制定容器label

kubectl run busybox --rm -ti --labels="access=true" --image=busybox /bin/sh --namespace=testingnp 

wget nginx 可以正常获取资源