Kubernetes Network Policy

Network Policy介紹

• 網絡政策（NetworkPolicy）是一種關于 Pod 間及與其他Network Endpoints間所允許的通信規則的規範。
• NetworkPolicy 資源使用 标簽 選擇 Pod，并定義標明 Pod 所允許的通信規則。
• 網絡政策通過網絡插件來實作。要使用網絡政策，使用者必須使用支援 NetworkPolicy 的網絡解決方案。
• 預設情況下，Pod間是非隔離的，它們接受任何來源的流量。
• Pod 可以通過相關的網絡政策進行隔離。一旦命名空間中有網絡政策選擇了特定的 Pod，該 Pod 會拒絕網絡政策所不允許的連接配接。(命名空間下其他未被網絡政策所選擇的 Pod 會繼續接收所有的流量)
• 網絡政策不會沖突，它們是附加的。如果任何一個或多個政策選擇了一個 Pod, 則該 Pod 受限于這些政策的 ingress/egress 規則的并集。是以政策的順序并不會影響政策的結果。

Network Policy 簡單例子

首先分别在兩個namespace建立pod：

apiVersion: v1
kind: Namespace
metadata:
  name: network-policy-1
---
apiVersion: v1
kind: Namespace
metadata:
  name: network-policy-2
---
apiVersion: v1
kind: Pod
metadata:
  name: busybox-1
  namespace: network-policy-1
  labels:
      name: busybox-1
spec:
    containers:
        - name: busybox
          image: busybox:1.28
          command: ['sh','-c','sleep 3600']
          imagePullPolicy: IfNotPresent
---
apiVersion: v1
kind: Pod
metadata:
  name: busybox-2
  namespace: network-policy-2
  labels:
      name: busybox-2
spec:
    containers:
        - name: busybox
          image: busybox:1.28
          command: ['sh','-c','sleep 3600']
          imagePullPolicy: IfNotPresent      

未部署NetworkPolicy之前，兩個不同namespace的pod是可以互相通信的。

busybox-2   1/1     Running   0          23s   10.244.139.253   k8s-calico-node02   <none>           <none>
❯ kubectl get pod -n network-policy-1 -o wide
NAME        READY   STATUS    RESTARTS   AGE   IP              NODE                NOMINATED NODE   READINESS GATES
busybox-1   1/1     Running   0          26s   10.244.195.91   k8s-calico-master   <none>           <none>
#剛開始busybox-1和busybox-2是可以互相通路的
❯ kubectl exec -n network-policy-1 busybox-1 -- ping 10.244.139.253
PING 10.244.139.253 (10.244.139.253): 56 data bytes
64 bytes from 10.244.139.253: seq=0 ttl=62 time=1.220 ms
64 bytes from 10.244.139.253: seq=1 ttl=62 time=1.079 ms
64 bytes from 10.244.139.253: seq=2 ttl=62 time=1.093 ms
64 bytes from 10.244.139.253: seq=3 ttl=62 time=1.044 ms
❯ kubectl exec -n network-policy-2 busybox-2 -- ping 10.244.195.91
PING 10.244.195.91 (10.244.195.91): 56 data bytes
64 bytes from 10.244.195.91: seq=0 ttl=62 time=0.998 ms
64 bytes from 10.244.195.91: seq=1 ttl=62 time=1.230 ms      

預設拒絕所有入口流量

部署一條NetworkPolicy，作用在namespace為network-policy-1的pod上，禁止入訪流量:

---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
  namespace: network-policy-1 #networkPolicy配置在busybox-1的namespace,不允許外部流量主動通路
spec:
  podSelector: {}
  #policyType寫了Ingress,在Ingress裡沒寫内容，表示拒絕所有ingress流量
  policyTypes:
  - Ingress      

#busybox-1可以通路busybox-2
❯ kubectl exec -n network-policy-1 busybox-1 -- ping 10.244.139.253
PING 10.244.139.253 (10.244.139.253): 56 data bytes
64 bytes from 10.244.139.253: seq=0 ttl=62 time=2.895 ms
64 bytes from 10.244.139.253: seq=1 ttl=62 time=0.605 ms
#busybox-2無法通路busybox-1
❯ kubectl exec -n network-policy-2 busybox-2 -- ping 10.244.195.91
^C      

預設允許所有入口流量

在前面那條NetworkPolicy不删除的同時，添加一條允許所有入訪流量的networkPolicy，流量最終會允許。可以看到隻要流量能夠比對到一條滿足放行的NetworkPolicy，則流量就會被放行。

---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-all-ingress
  namespace: network-policy-1
spec:
  podSelector: {}
  #policyType寫了Ingress,在ingress寫了{}，表示放行所有ingress流量
  ingress:
  - {}
  policyTypes:
  - Ingress      

#兩條networkPolicy同時存在
❯ kubectl get -n network-policy-1  networkpolicies.networking.k8s.io
NAME                   POD-SELECTOR   AGE
allow-all-ingress      <none>         27s
default-deny-ingress   <none>         94s
#busybox-2重新可以通路busybox-1了
❯ kubectl exec -n network-policy-2 busybox-2 -- ping 10.244.195.91
PING 10.244.195.91 (10.244.195.91): 56 data bytes
64 bytes from 10.244.195.91: seq=0 ttl=62 time=1.057 ms
64 bytes from 10.244.195.91: seq=1 ttl=62 time=0.872 ms      

Network Policy 綜合例子

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: network-policy-cidr
  namespace: network-policy-1
spec:
  podSelector:
    matchLabels:
      name: centos-1  #隻有pod的label為name=centos-1的pod才會收到下面的policy的限制
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
           project: centos-2
    - podSelector:
         matchLabels:
            name: centos-2
    - ipBlock:
        cidr: 10.244.0.0/16 #隻允許源是10.244.0.0/16的網段來通路
        except:
        - 10.244.195.0/24  #源是10.244.195.0/24的網段不允許來通路
    ports:
      - protocol: TCP
        port: 80  #隻有80端口允許被通路      

檢視生成的具體規則

❯ kubectl describe -n network-policy-1 networkpolicies.
Name:         network-policy-cidr
Namespace:    network-policy-1
Created on:   2020-05-19 21:01:49 +0800 CST
Labels:       <none>
Annotations:  kubectl.kubernetes.io/last-applied-configuration:
                {"apiVersion":"networking.k8s.io/v1","kind":"NetworkPolicy","metadata":{"annotations":{},"name":"network-policy-cidr","namespace":"network...
Spec:
  PodSelector:     name=centos-1
  Allowing ingress traffic:
    To Port: 80/TCP
    From:
      NamespaceSelector: project=centos-2
    From:
      PodSelector: name=centos-2
    From:
      IPBlock:
        CIDR: 10.244.0.0/16
        Except: 10.244.195.0/24      

現在嘗試在不同條件下（namespace label，pod label，pod ip位址）去通路名為centos-1的pod，以下表格為整理出的不同條件下的通路結果：（這裡的政策是或的關系，隻要滿足一個就放行）

以下黑色字型加粗的為不滿足要求的條件：

namespace label	pod label	pod CIDR	通路centos1的80端口	ping
project=centos-2	name=centos-2	10.244.139.0/24	可以	不可以
		10.244.195.0/24
	無

Network Policy 與和或的關系

這個政策表示放行namespace label為project=centos2這個命名空間中的pod，或者pod label為name=centos2的pod：

ingress:
  - from:
    - namespaceSelector:
        matchLabels:
           project: centos-2
    - podSelector:
         matchLabels:
            name: centos-2      

注意觀察，

podSelector

前面沒有

-

，此時namespaceSelector和podSelector是與的關系，表示放行的是在namespace label為project=centos2這個命名空間中，并且pod的label為name=centos2的pod。

ingress:
  - from:
    - namespaceSelector:
        matchLabels:
           project: centos-2
      podSelector:
         matchLabels:
            name: centos-2      

NetworkPolicy可視化展示

通過

https://orca.tufin.io/netpol/

網站上可以對networkPolicy做可視化展示：

ingress:

egress: