LoginSignup
4
4

More than 5 years have passed since last update.

@sugimount(sugi mount)

Kubernetes1.11 + Calico3.1 NetworkPolicy設定方法解説

Posted at

はじめに

NetworkPolicyは比較的複雑で設定する方法を調べるのに多少時間がかかります。
今回は、実際のユースケースを想像しながらNetworkPolicyを設定する方法を解説して行きます。

前回、Kubernertes 1.11 + Calico 3.1 の環境を作成しました。
こちらの環境を使用していきます。

概要

2個のNamespaceを作成し、以下の観点でNetworkPolicyの動作を確認します

  • demo1 Namespace と demo2 Namespace 間の疎通
  • demo1 Namespace 内部の疎通

構成図

007.png

環境準備

Namespace作成

NetworkPolicyでNamespaceを指定する際に、Labelが必要なので、各Namespaceには付与します。任意のLabelで構いません

cat <<'EOF' > /root/manifests/namespace-demo1.yaml
apiVersion: v1
kind: Namespace
metadata:
  name: demo1
  labels:
    nsname: demo1
EOF

cat <<'EOF' > /root/manifests/namespace-demo2.yaml
apiVersion: v1
kind: Namespace
metadata:
  name: demo2
  labels:
    nsname: demo2
EOF

kubectl apply -f /root/manifests/namespace-demo1.yaml
kubectl apply -f /root/manifests/namespace-demo2.yaml

demo1とdemo2にそれぞれ、nginx Pod を作成

cat <<'EOF' > /root/manifests/nginx_demo1.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-test
  namespace: demo1
spec:
  selector:
    matchLabels:
      app: nginx-test
  replicas: 2
  template:
    metadata:
      labels:
        app: nginx-test
    spec:
      containers:
      - name: nginx
        image: nginx
        resources:
          requests:
            cpu: 100m
            memory: 100Mi
        ports:
        - containerPort: 80
      restartPolicy: Always
---
kind: Service
apiVersion: v1
metadata:
  labels:
    app: nginx-test
  name: nginx-test
  namespace: demo1
spec:
  type: NodePort
  ports:
  - port: 8080
    targetPort: 80
    nodePort: 32003
  selector:
    app: nginx-test
EOF

kubectl apply -f /root/manifests/nginx_demo1.yaml

cat <<'EOF' > /root/manifests/nginx_demo2.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-test
  namespace: demo2
spec:
  selector:
    matchLabels:
      app: nginx-test
  replicas: 2
  template:
    metadata:
      labels:
        app: nginx-test
    spec:
      containers:
      - name: nginx
        image: nginx
        resources:
          requests:
            cpu: 100m
            memory: 100Mi
        ports:
        - containerPort: 80
      restartPolicy: Always
---
kind: Service
apiVersion: v1
metadata:
  labels:
    app: nginx-test
  name: nginx-test
  namespace: demo2
spec:
  type: NodePort
  ports:
  - port: 8080
    targetPort: 80
    nodePort: 32004
  selector:
    app: nginx-test
EOF

kubectl apply -f /root/manifests/nginx_demo2.yaml

以下のように作成されています

[root@calico-k8s-master01 ~(demo2 kubernetes-admin)]# kubectl get pods -o wide --all-namespaces
NAMESPACE     NAME                                               READY     STATUS    RESTARTS   AGE       IP                NODE
demo1         nginx-test-5cfdd88d5-4lb7n                         1/1       Running   0          1m        10.1.7.4          calico-k8s-node01.maas
demo1         nginx-test-5cfdd88d5-76mbd                         1/1       Running   0          1m        10.1.5.3          calico-k8s-node02.maas
demo2         nginx-test-5cfdd88d5-75sn9                         1/1       Running   0          24s       10.1.7.5          calico-k8s-node01.maas
demo2         nginx-test-5cfdd88d5-fvtdc                         1/1       Running   0          24s       10.1.5.4          calico-k8s-node02.maas
kube-system   calico-etcd-jc5st                                  1/1       Running   0          1d        192.168.204.100   calico-k8s-master01.maas
kube-system   calico-kube-controllers-84fd4db7cd-pxndj           1/1       Running   0          1d        192.168.204.100   calico-k8s-master01.maas
kube-system   calico-node-4wbfq                                  2/2       Running   0          1d        192.168.204.101   calico-k8s-node01.maas
kube-system   calico-node-8zwjd                                  2/2       Running   0          1d        192.168.204.102   calico-k8s-node02.maas
kube-system   calico-node-cqcvb                                  2/2       Running   0          1d        192.168.204.100   calico-k8s-master01.maas
kube-system   calicoctl                                          1/1       Running   0          1d        192.168.204.102   calico-k8s-node02.maas
kube-system   coredns-78fcdf6894-5m2qn                           1/1       Running   0          1d        10.1.6.64         calico-k8s-master01.maas
kube-system   coredns-78fcdf6894-k5tf4                           1/1       Running   0          1d        10.1.6.65         calico-k8s-master01.maas
kube-system   etcd-calico-k8s-master01.maas                      1/1       Running   0          1d        192.168.204.100   calico-k8s-master01.maas
kube-system   kube-apiserver-calico-k8s-master01.maas            1/1       Running   0          1d        192.168.204.100   calico-k8s-master01.maas
kube-system   kube-controller-manager-calico-k8s-master01.maas   1/1       Running   0          1d        192.168.204.100   calico-k8s-master01.maas
kube-system   kube-proxy-mrj59                                   1/1       Running   0          1d        192.168.204.102   calico-k8s-node02.maas
kube-system   kube-proxy-pvnk8                                   1/1       Running   0          1d        192.168.204.100   calico-k8s-master01.maas
kube-system   kube-proxy-rznnx                                   1/1       Running   0          1d        192.168.204.101   calico-k8s-node01.maas
kube-system   kube-scheduler-calico-k8s-master01.maas            1/1       Running   0          1d        192.168.204.100   calico-k8s-master01.maas
kube-system   kubernetes-dashboard-6d4bc79449-z6jdg              1/1       Running   0          1d        10.1.7.3          calico-k8s-node01.maas

アクセス確認のため、それぞれのNamespaceでCentOSのPodを建てます (busyboxとかでも良いです)

cat <<'EOF' > /root/manifests/centos_demo1.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: centos-deployment
  namespace: demo1
spec:
  selector:
    matchLabels:
      app: centos
  replicas: 1
  template:
    metadata:
      labels:
        app: centos
    spec:
      containers:
      - name: centos
        image: centos:latest
        command: [ "sleep", "360000000" ]
EOF

kubectl apply -f /root/manifests/centos_demo1.yaml

cat <<'EOF' > /root/manifests/centos_demo2.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: centos-deployment
  namespace: demo2
spec:
  selector:
    matchLabels:
      app: centos
  replicas: 1
  template:
    metadata:
      labels:
        app: centos
    spec:
      containers:
      - name: centos
        image: centos:latest
        command: [ "sleep", "360000000" ]
EOF

kubectl apply -f /root/manifests/centos_demo2.yaml

以下のPodが作成されています

[root@calico-k8s-master01 manifests(demo2 kubernetes-admin)]# kubectl get pods -o wide --all-namespaces
NAMESPACE     NAME                                               READY     STATUS    RESTARTS   AGE       IP                NODE
demo1         centos-deployment-7d7d7bcb56-thjvk                 1/1       Running   0          23s       10.1.5.5          calico-k8s-node02.maas
demo1         nginx-test-5cfdd88d5-4lb7n                         1/1       Running   0          5m        10.1.7.4          calico-k8s-node01.maas
demo1         nginx-test-5cfdd88d5-76mbd                         1/1       Running   0          5m        10.1.5.3          calico-k8s-node02.maas
demo2         centos-deployment-7d7d7bcb56-c57br                 1/1       Running   0          6s        10.1.7.6          calico-k8s-node01.maas
demo2         nginx-test-5cfdd88d5-75sn9                         1/1       Running   0          4m        10.1.7.5          calico-k8s-node01.maas
demo2         nginx-test-5cfdd88d5-fvtdc                         1/1       Running   0          4m        10.1.5.4          calico-k8s-node02.maas
kube-system   calico-etcd-jc5st                                  1/1       Running   0          1d        192.168.204.100   calico-k8s-master01.maas
kube-system   calico-kube-controllers-84fd4db7cd-pxndj           1/1       Running   0          1d        192.168.204.100   calico-k8s-master01.maas
kube-system   calico-node-4wbfq                                  2/2       Running   0          1d        192.168.204.101   calico-k8s-node01.maas
kube-system   calico-node-8zwjd                                  2/2       Running   0          1d        192.168.204.102   calico-k8s-node02.maas
kube-system   calico-node-cqcvb                                  2/2       Running   0          1d        192.168.204.100   calico-k8s-master01.maas
kube-system   calicoctl                                          1/1       Running   0          1d        192.168.204.102   calico-k8s-node02.maas
kube-system   coredns-78fcdf6894-5m2qn                           1/1       Running   0          1d        10.1.6.64         calico-k8s-master01.maas
kube-system   coredns-78fcdf6894-k5tf4                           1/1       Running   0          1d        10.1.6.65         calico-k8s-master01.maas
kube-system   etcd-calico-k8s-master01.maas                      1/1       Running   0          1d        192.168.204.100   calico-k8s-master01.maas
kube-system   kube-apiserver-calico-k8s-master01.maas            1/1       Running   0          1d        192.168.204.100   calico-k8s-master01.maas
kube-system   kube-controller-manager-calico-k8s-master01.maas   1/1       Running   0          1d        192.168.204.100   calico-k8s-master01.maas
kube-system   kube-proxy-mrj59                                   1/1       Running   0          1d        192.168.204.102   calico-k8s-node02.maas
kube-system   kube-proxy-pvnk8                                   1/1       Running   0          1d        192.168.204.100   calico-k8s-master01.maas
kube-system   kube-proxy-rznnx                                   1/1       Running   0          1d        192.168.204.101   calico-k8s-node01.maas
kube-system   kube-scheduler-calico-k8s-master01.maas            1/1       Running   0          1d        192.168.204.100   calico-k8s-master01.maas
kube-system   kubernetes-dashboard-6d4bc79449-z6jdg              1/1       Running   0          1d        10.1.7.3          calico-k8s-node01.maas

memo 各nginxpodに入り、Welcomeページを適宜書き換えます。
どのNamaspaceのpodへアクセスしているかわかるように。 body に from demo01-01 といった文字を追加します

cat <<'EOF' > /usr/share/nginx/html/index.html
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
    body {
        width: 35em;
        margin: 0 auto;
        font-family: Tahoma, Verdana, Arial, sans-serif;
    }
</style>
</head>
<body>
<h1>Welcome to nginx! from demo01-1</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>
EOF

初期状態確認

demo1のCentOSから疎通確認

DefaultはすべてのNamespaceのPod間で通信可能です。

同一Namespaceへの通信(demo1 → demo1)

[root@calico-k8s-master01 ~(demo1 kubernetes-admin)]# kubectl exec -it centos-deployment-7d7d7bcb56-thjvk curl http://10.1.7.7/
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
    body {
        width: 35em;
        margin: 0 auto;
        font-family: Tahoma, Verdana, Arial, sans-serif;
    }
</style>
</head>
<body>
<h1>Welcome to nginx! from demo01-1</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>

[root@calico-k8s-master01 ~(demo1 kubernetes-admin)]# kubectl exec -it centos-deployment-7d7d7bcb56-thjvk curl http://10.1.5.6/
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
    body {
        width: 35em;
        margin: 0 auto;
        font-family: Tahoma, Verdana, Arial, sans-serif;
    }
</style>
</head>
<body>
<h1>Welcome to nginx! from demo01-2</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>

異なるNamespaceへ通信(demo1 → demo2)

[root@calico-k8s-master01 ~(demo1 kubernetes-admin)]# kubectl exec -it centos-deployment-7d7d7bcb56-thjvk curl http://10.1.7.5/
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
    body {
        width: 35em;
        margin: 0 auto;
        font-family: Tahoma, Verdana, Arial, sans-serif;
    }
</style>
</head>
<body>
<h1>Welcome to nginx! from demo02-1</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>
[root@calico-k8s-master01 ~(demo1 kubernetes-admin)]# 
[root@calico-k8s-master01 ~(demo1 kubernetes-admin)]# kubectl exec -it centos-deployment-7d7d7bcb56-thjvk curl http://10.1.5.4/
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
    body {
        width: 35em;
        margin: 0 auto;
        font-family: Tahoma, Verdana, Arial, sans-serif;
    }
</style>
</head>
<body>
<h1>Welcome to nginx! from demo02-2</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>

同一NamespaceのNodePortをClusterIPとして通信(demo1 → demo1)

[root@centos-deployment-7d7d7bcb56-thjvk /]# curl http://10.1.3.63:8080/
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
    body {
        width: 35em;
        margin: 0 auto;
        font-family: Tahoma, Verdana, Arial, sans-serif;
    }
</style>
</head>
<body>
<h1>Welcome to nginx! from demo01-2</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>

異なるNamespaceのNodePortをClusterIPとして通信(demo1 → demo2)

[root@centos-deployment-7d7d7bcb56-thjvk /]# curl http://10.1.0.92:8080/
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
    body {
        width: 35em;
        margin: 0 auto;
        font-family: Tahoma, Verdana, Arial, sans-serif;
    }
</style>
</head>
<body>
<h1>Welcome to nginx! from demo02-1</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>

NetworkPolicyの設定

DefaultNetworkPolicyの設定

Namespaceを作成した直後は、以下のように NetworkPolicy が何も設定されていない状態です
以下の例は demo1 Namespace で実行しています。prompt に Namespace名を表示させています

[root@calico-k8s-master01 ~(demo1 kubernetes-admin)]# kubectl get networkpolicies
No resources found.

Namespace 内になんらかのNetworkPolicyを作成したタイミングで、作成したNetworkPolicyに該当しないパケットはすべて遮断されます。
言い換えると、Namespace内に一番初めに作成したポリシーがDefaultPolicyという考え方になると思います。

今回は、全て遮断する All Deny ポリシー(何のパケットルールも付与しない)を作成します。

  • spec.podSelector : {} を指定することにより、全てのPodが該当する
  • spec.policyTypes.Ingress : 何もルールを指定しないので、このNetworkPolicyのTypeを指定します。何もルールが存在しないため、全てのパケットがルールに合致しない結果、Ingress方向(外側 to Pod)への通信が全て遮断される。なお、Egress側は何も指定していないので、all allow の状態となっている。
cat <<'EOF' > /root/manifests/default-deny-demo1.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny
  namespace: demo1
spec:
  podSelector: {}
  policyTypes:
  - Ingress
EOF

kubectl apply -f /root/manifests/default-deny-demo1.yaml

以下のように作成されたことを確認できます

[root@calico-k8s-master01 manifests(demo1 kubernetes-admin)]# kubectl get networkpolicies
NAME           POD-SELECTOR   AGE
default-deny   <none>         11s
[root@calico-k8s-master01 manifests(demo1 kubernetes-admin)]# 
[root@calico-k8s-master01 manifests(demo1 kubernetes-admin)]# kubectl get networkpolicies -o wide
NAME           POD-SELECTOR   AGE
default-deny   <none>         30s
[root@calico-k8s-master01 manifests(demo1 kubernetes-admin)]# kubectl describe networkpolicies default-deny 
Name:         default-deny
Namespace:    demo1
Created on:   2018-07-15 18:51:58 +0900 JST
Labels:       <none>
Annotations:  kubectl.kubernetes.io/last-applied-configuration={"apiVersion":"networking.k8s.io/v1","kind":"NetworkPolicy","metadata":{"annotations":{},"name":"default-deny","namespace":"demo1"},"spec":{"podSelecto...
Spec:
  PodSelector:     <none> (Allowing the specific traffic to all pods in this namespace)
  Allowing ingress traffic:
    <none> (Selected pods are isolated for ingress connectivity)
  Allowing egress traffic:
    <none> (Selected pods are isolated for egress connectivity)
  Policy Types: Ingress

疎通確認

DefaultはすべてのNamespaceのPod間で通信可能です。

同一Namespaceへの通信(demo1 → demo1)

疎通できません。curlコマンドが通信出来ないため、Ctrl + C で SIGINTシグナル を出して止めています

[root@calico-k8s-master01 manifests(demo1 kubernetes-admin)]# kubectl exec -it centos-deployment-7d7d7bcb56-thjvk curl http://10.1.7.7/
^Ccommand terminated with exit code 130

[root@calico-k8s-master01 manifests(demo1 kubernetes-admin)]# kubectl exec -it centos-deployment-7d7d7bcb56-thjvk curl http://10.1.5.6/
^Ccommand terminated with exit code 130

異なるNamespaceへ通信(demo1 → demo2)

demo2 側は、NetworkPolicyを設定していないため、引き続きアクセス可能です

[root@calico-k8s-master01 ~(demo1 kubernetes-admin)]# kubectl exec -it centos-deployment-7d7d7bcb56-thjvk curl http://10.1.7.5/
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
    body {
        width: 35em;
        margin: 0 auto;
        font-family: Tahoma, Verdana, Arial, sans-serif;
    }
</style>
</head>
<body>
<h1>Welcome to nginx! from demo02-1</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>

[root@calico-k8s-master01 ~(demo1 kubernetes-admin)]# kubectl exec -it centos-deployment-7d7d7bcb56-thjvk curl http://10.1.5.4/
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
    body {
        width: 35em;
        margin: 0 auto;
        font-family: Tahoma, Verdana, Arial, sans-serif;
    }
</style>
</head>
<body>
<h1>Welcome to nginx! from demo02-2</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>

同一NamespaceのNodePortをClusterIPとして通信(demo1 → demo1)

こちらもdemo1は通信できません

[root@calico-k8s-master01 manifests(demo1 kubernetes-admin)]# kubectl exec -it centos-deployment-7d7d7bcb56-thjvk curl http://10.1.3.63:8080/
^Ccommand terminated with exit code 130

異なるNamespaceのNodePortをClusterIPとして通信(demo1 → demo2)

こちらもdemo2側は通信可能です

[root@calico-k8s-master01 manifests(demo1 kubernetes-admin)]# kubectl exec -it centos-deployment-7d7d7bcb56-thjvk curl http://10.1.0.92:8080/
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
    body {
        width: 35em;
        margin: 0 auto;
        font-family: Tahoma, Verdana, Arial, sans-serif;
    }
</style>
</head>
<body>
<h1>Welcome to nginx! from demo02-1</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>

demo1 Namespace のCentOSのみ許可設定

  • spec.podSelector.matchLabels : ここで指定するLabelに該当するPodが、このNetworkPolicyの設定の対象となる
  • spec.policyTypes : IngressのTypeと指定 (Podの外側 to 該当Podへの通信)
  • spec.ingress.from : fromの条件を指定。app=centos ラベルが該当しているPodが、TCP80の通信を許可する。なお、ここのTCPポートの番号は、Deploymentを作成した時に指定したPod側のcontainerPortを指定する。ClusterIPやNodePortのPortではない。
  • spec.ingress.from.namespaceSelector : この値を指定していないので、demo1 のNamespaceが指定されるように自動認識される (と思う)
cat <<'EOF' > /root/manifests/default-allowcentos-demo1.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-centos
  namespace: demo1
spec:
  podSelector:
    matchLabels:
      app: nginx-test
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: centos
    ports:
    - protocol: TCP
      port: 80
EOF

kubectl apply -f /root/manifests/default-allowcentos-demo1.yaml

確認

[root@calico-k8s-master01 manifests(demo1 kubernetes-admin)]# kubectl describe networkpolicies allow-centos 
Name:         allow-centos
Namespace:    demo1
Created on:   2018-07-15 19:22:03 +0900 JST
Labels:       <none>
Annotations:  kubectl.kubernetes.io/last-applied-configuration={"apiVersion":"networking.k8s.io/v1","kind":"NetworkPolicy","metadata":{"annotations":{},"name":"allow-centos","namespace":"demo1"},"spec":{"ingress":[...
Spec:
  PodSelector:     app=nginx-test
  Allowing ingress traffic:
    To Port: 80/TCP
    From:
      PodSelector: app=centos
  Allowing egress traffic:
    <none> (Selected pods are isolated for egress connectivity)
  Policy Types: Ingress

疎通確認

同一Namespaceへの通信(demo1 → demo1)

通信を許可したため、接続出来るようになりました

[root@calico-k8s-master01 manifests(demo1 kubernetes-admin)]# kubectl exec -it centos-deployment-7d7d7bcb56-thjvk curl http://10.1.7.7/
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
    body {
        width: 35em;
        margin: 0 auto;
        font-family: Tahoma, Verdana, Arial, sans-serif;
    }
</style>
</head>
<body>
<h1>Welcome to nginx! from demo01-1</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>

[root@calico-k8s-master01 manifests(demo1 kubernetes-admin)]# kubectl exec -it centos-deployment-7d7d7bcb56-thjvk curl http://10.1.5.6/
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
    body {
        width: 35em;
        margin: 0 auto;
        font-family: Tahoma, Verdana, Arial, sans-serif;
    }
</style>
</head>
<body>
<h1>Welcome to nginx! from demo01-2</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>

異なるNamespaceへ通信(demo1 → demo2)

demo2 側への通信は、NetworkPolicyを設定していないため、引き続きアクセス可能です

[root@calico-k8s-master01 ~(demo1 kubernetes-admin)]# kubectl exec -it centos-deployment-7d7d7bcb56-thjvk curl http://10.1.7.5/
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
    body {
        width: 35em;
        margin: 0 auto;
        font-family: Tahoma, Verdana, Arial, sans-serif;
    }
</style>
</head>
<body>
<h1>Welcome to nginx! from demo02-1</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>

[root@calico-k8s-master01 ~(demo1 kubernetes-admin)]# kubectl exec -it centos-deployment-7d7d7bcb56-thjvk curl http://10.1.5.4/
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
    body {
        width: 35em;
        margin: 0 auto;
        font-family: Tahoma, Verdana, Arial, sans-serif;
    }
</style>
</head>
<body>
<h1>Welcome to nginx! from demo02-2</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>

同一NamespaceのNodePortをClusterIPとして通信(demo1 → demo1)

通信を許可したため、接続出来るようになりました

[root@calico-k8s-master01 manifests(demo1 kubernetes-admin)]# kubectl exec -it centos-deployment-7d7d7bcb56-thjvk curl http://10.1.3.63:8080/
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
    body {
        width: 35em;
        margin: 0 auto;
        font-family: Tahoma, Verdana, Arial, sans-serif;
    }
</style>
</head>
<body>
<h1>Welcome to nginx! from demo01-1</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>

異なるNamespaceのNodePortをClusterIPとして通信(demo1 → demo2)

こちらもdemo2側へは通信可能です

[root@calico-k8s-master01 manifests(demo1 kubernetes-admin)]# kubectl exec -it centos-deployment-7d7d7bcb56-thjvk curl http://10.1.0.92:8080/
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
    body {
        width: 35em;
        margin: 0 auto;
        font-family: Tahoma, Verdana, Arial, sans-serif;
    }
</style>
</head>
<body>
<h1>Welcome to nginx! from demo02-1</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>

異なるNamespaceから通信(demo2 → demo1)

demo2側のcentosのpodは Label に app=centos が設定されていますが、Namespaceが違うので通信することが出来ません

[root@calico-k8s-master01 manifests(demo1 kubernetes-admin)]# kubectl exec -n demo2 -it centos-deployment-7d7d7bcb56-c57br curl http://10.1.7.7/
^Ccommand terminated with exit code 130

[root@calico-k8s-master01 manifests(demo1 kubernetes-admin)]# kubectl exec -n demo2 -it centos-deployment-7d7d7bcb56-c57br curl http://10.1.5.6/
^Ccommand terminated with exit code 130

demo2 Namespace のCentOSを許可設定

cat <<'EOF' > /root/manifests/default-allowcentos-demo2.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-from-demo2-centos
  namespace: demo1
spec:
  podSelector:
    matchLabels:
      app: nginx-test
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: centos
    - namespaceSelector:
        matchLabels:
          nsname: demo2
    ports:
    - protocol: TCP
      port: 80
EOF

kubectl apply -f /root/manifests/default-allowcentos-demo2.yaml

疎通確認

異なるNamespaceから通信(demo2 → demo1)

demo2から通信できるように変更したため、通信が出来ます

[root@calico-k8s-master01 manifests(demo1 kubernetes-admin)]# kubectl exec -n demo2 -it centos-deployment-7d7d7bcb56-c57br curl http://10.1.7.7/
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
    body {
        width: 35em;
        margin: 0 auto;
        font-family: Tahoma, Verdana, Arial, sans-serif;
    }
</style>
</head>
<body>
<h1>Welcome to nginx! from demo01-1</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>

[root@calico-k8s-master01 manifests(demo1 kubernetes-admin)]# kubectl exec -n demo2 -it centos-deployment-7d7d7bcb56-c57br curl http://10.1.5.6/
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
    body {
        width: 35em;
        margin: 0 auto;
        font-family: Tahoma, Verdana, Arial, sans-serif;
    }
</style>
</head>
<body>
<h1>Welcome to nginx! from demo01-2</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>

一度 NetworkPolicyを全削除

[root@calico-k8s-master01 ~(demo1 kubernetes-admin)]# kubectl get networkpolicies
NAME                      POD-SELECTOR     AGE
allow-centos              app=nginx-test   40m
allow-from-demo2-centos   app=nginx-test   2m
default-deny              <none>           1h

kubectl delete networkpolicies allow-centos allow-from-demo2-centos default-deny

NamespaceごとのNetworkPolicy通信設定

設定

今までのPolicy設定は、PodのLabel毎に allow を付与していくので、割と面倒な設定となります。
また、複雑になるので、運用を考えると厳しい部分もあるかもしれません。

1個の設定でNamespace間の通信を全て遮断する設定を確認して行きます

cat <<'EOF' > /root/manifests/deny-between-namespaces-demo1.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-between-namespaces-demo1
  namespace: demo1
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          nsname: demo1
EOF

kubectl apply -f /root/manifests/deny-between-namespaces-demo1.yaml

cat <<'EOF' > /root/manifests/deny-between-namespaces-demo2.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-between-namespaces-demo2
  namespace: demo2
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          nsname: demo2
EOF

kubectl apply -f /root/manifests/deny-between-namespaces-demo2.yaml

疎通確認

同一Namespaceへの通信(demo1 → demo1)

同一 namespace へのアクセスは全て許可しているので、正常にアクセスできます

[root@calico-k8s-master01 manifests(demo1 kubernetes-admin)]# kubectl exec -it centos-deployment-7d7d7bcb56-thjvk curl http://10.1.7.7/
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
    body {
        width: 35em;
        margin: 0 auto;
        font-family: Tahoma, Verdana, Arial, sans-serif;
    }
</style>
</head>
<body>
<h1>Welcome to nginx! from demo01-1</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>

[root@calico-k8s-master01 manifests(demo1 kubernetes-admin)]# kubectl exec -it centos-deployment-7d7d7bcb56-thjvk curl http://10.1.5.6/
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
    body {
        width: 35em;
        margin: 0 auto;
        font-family: Tahoma, Verdana, Arial, sans-serif;
    }
</style>
</head>
<body>
<h1>Welcome to nginx! from demo01-2</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>

異なるNamespaceから通信(demo2 → demo1)

異なるNamespaceから通信を行うことが出来ません

[root@calico-k8s-master01 manifests(demo1 kubernetes-admin)]# kubectl exec -n demo2 -it centos-deployment-7d7d7bcb56-c57br curl http://10.1.7.7/
^Ccommand terminated with exit code 130

[root@calico-k8s-master01 manifests(demo1 kubernetes-admin)]# kubectl exec -n demo2 -it centos-deployment-7d7d7bcb56-c57br curl http://10.1.5.6/
^Ccommand terminated with exit code 130

同一のNamespaceへ通信(demo2→demo2)

[root@calico-k8s-master01 ~(demo1 kubernetes-admin)]# kubectl exec -n demo2 -it centos-deployment-7d7d7bcb56-c57br curl http://10.1.7.5/
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
    body {
        width: 35em;
        margin: 0 auto;
        font-family: Tahoma, Verdana, Arial, sans-serif;
    }
</style>
</head>
<body>
<h1>Welcome to nginx! from demo02-1</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>

[root@calico-k8s-master01 ~(demo1 kubernetes-admin)]# kubectl exec -n demo2 -it centos-deployment-7d7d7bcb56-c57br curl http://10.1.5.4/
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
    body {
        width: 35em;
        margin: 0 auto;
        font-family: Tahoma, Verdana, Arial, sans-serif;
    }
</style>
</head>
<body>
<h1>Welcome to nginx! from demo02-2</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>

異なるNamespaceへ通信(demo1 → demo2)

異なるNamespaceから通信を行うことが出来ません

[root@calico-k8s-master01 ~(demo1 kubernetes-admin)]# kubectl exec -n demo1 -it centos-deployment-7d7d7bcb56-thjvk curl http://10.1.7.5/
^Ccommand terminated with exit code 130

[root@calico-k8s-master01 ~(demo1 kubernetes-admin)]# kubectl exec -n demo1 -it centos-deployment-7d7d7bcb56-thjvk curl http://10.1.5.4/
^Ccommand terminated with exit code 130

この設定であれば、楽に設定・把握できるので、良いかもしれません

外部公開用のNetworkPolicy設定

単純にNamespace内のみ許可すると、NodePortなどのServiceを使用してアクセスすることが出来ません。
公開する必要のあるPodのみ、外部公開するようにしましょう

  • ingress.from.ports とのみ指定しているので、どこからでも80Portへアクセス可能です
cat <<'EOF' > /root/manifests/allow-demo1-nodeport.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-demo1-nodeport
  namespace: demo1
spec:
  podSelector:
    matchLabels:
      app: nginx-test
  policyTypes:
  - Ingress
  ingress:
  - from:
    ports:
    - protocol: TCP
      port: 80
EOF

kubectl apply -f /root/manifests/allow-demo1-nodeport.yaml

参考URL

Kubernetes.io
https://kubernetes.io/docs/concepts/services-networking/network-policies/
https://kubernetes.io/docs/tasks/administer-cluster/declare-network-policy/

Calico公式
https://docs.projectcalico.org/v3.1/reference/calicoctl/resources/globalnetworkpolicy
https://docs.projectcalico.org/v3.1/reference/calicoctl/resources/networkpolicy
https://docs.projectcalico.org/v3.1/getting-started/kubernetes/tutorials/simple-policy
https://dev-project-calico.pantheonsite.io/calico-network-policy-comes-to-kubernetes/
https://www.projectcalico.org/securing-namespaces-and-services-in-kubernetes/

日本語情報
https://www.n-novice.com/entry/2018/05/09/215831
https://qiita.com/hirsim/items/972d12c2f7b0f5b6652d

4
4
0

Register as a new user and use Qiita more conveniently

  1. You get articles that match your needs
  2. You can efficiently read back useful information
  3. You can use dark theme
What you can do with signing up
Sign upLogin
4
4