Networkpolicy

 

https://kubernetes.io/ko/docs/concepts/services-networking/network-policies/

네트워크 정책

 

 

 

cat <<EOF > network-policy-pods.yaml

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: nginx
spec:
  replicas: 3
  serviceName: nginx
  podManagementPolicy: OrderedReady
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: http-go-v1
spec:
  selector:
    app: http-go-v1
  ports:
    - protocol: TCP
      port: 80
      targetPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: http-go-v2
spec:
  selector:
    app: http-go-v2
  ports:
    - protocol: TCP
      port: 80
      targetPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: http-go-v3
spec:
  selector:
    app: http-go-v3
  ports:
    - protocol: TCP
      port: 80
      targetPort: 80
EOF

 

cat <<EOF > network-policy-pods-np.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: nginx-0-ingress
  namespace: default
spec:
  podSelector:
    matchLabels:
      statefulset.kubernetes.io/pod-name: nginx-0
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          statefulset.kubernetes.io/pod-name: nginx-1
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: nginx-1-ingress
  namespace: default
spec:
  podSelector:
    matchLabels:
      statefulset.kubernetes.io/pod-name: nginx-1
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          statefulset.kubernetes.io/pod-name: nginx-2
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: nginx-2-ingress
  namespace: default
spec:
  podSelector:
    matchLabels:
      statefulset.kubernetes.io/pod-name: nginx-2
  policyTypes:
  - Ingress
EOF

 

 

 watch kubectl get pods,networkpolicy,statefulset,service -o wide

 

정책에 따라

nginx-2 에 접속하여 curl로 nginx-1의 index를 보려고 하면 잘 보여지나

 k exec pod/nginx-2 -it -- /bin/bash

 

다음과 같이 nginx-0을 보려고 하면 안보인다.

 nginx-2 to nginx-0 ingress가 허용돼있지 않기 때문.

 

 

하지만 이번엔

nginx-1에 접속하여 마찬가지로 nginx-0을 보면 잘 보인다.

nginx-1 to nginx-0 ingress가 허용돼있기 때문

k exec pod/nginx-1 -it -- /bin/bash

반면 nginx-2 는 모든 ingress를 허용하지 않은 상태 (ingress 정책만 수립 = 디폴트 모두 차단) 기 때문에 어디서 오든 차단