资源：
https://docs.projectcalico.org/v3.2/getting-started/kubernetes/installation/flannel
基于pod
Egress 是Pod作为客户端(需要定义目标端口和目标地址)
ingress 是pod作为服务端(需要定义目标地址和pod自己的端口)
canel工作的默认网段是192.168.0.0/16的网段
官网：https://docs.projectcalico.org/v3.2/introduction/
参考地址：
https://docs.projectcalico.org/v3.2/getting-started/kubernetes/installation/flannel
分别运行：
kubectl apply -f \
https://docs.projectcalico.org/v3.2/getting-started/kubernetes/installation/hosted/canal/rbac.yaml
kubectl apply -f \
https://docs.projectcalico.org/v3.2/getting-started/kubernetes/installation/hosted/canal/canal.yaml
监控：
kubectl get pods -n kube-system -w [root@master ~]# kubectl get pods -n kube-system
NAME READY STATUS RESTARTS AGE
canal-98mcn / Running 3m
canal-gnp5r / Running 3m
coredns-78fcdf6894-27npt / Running 12d
coredns-78fcdf6894-mbg8n / Running 12d
etcd-master / Running 12d
kube-apiserver-master / Running 12d
kube-controller-manager-master / Running 12d
kube-flannel-ds-amd64-6ws6q / Running 1h
kube-flannel-ds-amd64-mg9sm / Running 1h
kube-flannel-ds-amd64-sq9wj / Running 1h
kube-proxy-g9n4d / Running 12d
kube-proxy-wrqt8 / Running 12d
kube-proxy-x7vc2 / Running 12d
kube-scheduler-master / Running 12d
kubernetes-dashboard-767dc7d4d-7rmp8 / Running 2d
查看帮助：
kubectl explain networkpolicy.spec
网络策略：
名称空间：
拒绝所有的出站，入站。
放行所有出站目标本名称空间内的所有Pod
ingress
创建名称空间
[root@master networkpolicy]# kubectl create namespace dev
namespace/dev created
[root@master networkpolicy]# kubectl create namespace prod
namespace/prod created 创建yaml文件
[root@master networkpolicy]# cat ingres-def.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: deny-all-ingress
#namespace: dev
spec:
podSelector: {} #空选择器代表名称空间所有的Pod
policyTypes:
- Ingress
#如果不写Ingress的话，默认都可以访问
#如果写上Ingress的话，默认都不能访问 [root@master networkpolicy]# kubectl apply -f ingres-def.yaml -n dev
networkpolicy.networking.k8s.io/deny-all-ingress created
-n 是指定的名称空间dev [root@master networkpolicy]# kubectl get netpol -n dev
NAME POD-SELECTOR AGE
deny-all-ingress <none> 39s 创建一个web yaml
[root@master networkpolicy]# vim pod-a.yaml
[root@master networkpolicy]# kubectl apply -f pod-a.yaml -n dev
pod/pod1 created
[root@master networkpolicy]# cat pod-a.yaml
apiVersion: v1
kind: Pod
metadata:
name: pod1
spec:
containers:
- name: myapp
image: ikubernetes/myapp:v1 [root@master networkpolicy]# kubectl get pods
No resources found.
[root@master networkpolicy]# kubectl get pods -n dev
NAME READY STATUS RESTARTS AGE
pod1 / Running 50s [root@master networkpolicy]# kubectl get pods -n dev -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE
pod1 / Running 1m 10.244.2.2 node2 <none>
[root@master networkpolicy]# curl 10.244.2.2 发现是访问不了的 更换一下名称空间：
[root@master networkpolicy]# kubectl apply -f pod-a.yaml -n prod
pod/pod1 created
[root@master networkpolicy]# kubectl get pods -n prod
NAME READY STATUS RESTARTS AGE
pod1 / Running 8s
[root@master networkpolicy]# kubectl get pods -n prod -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE
pod1 / Running 13s 10.244.1.2 node1 <none>
[root@master networkpolicy]# curl 10.244.1.2
Hello MyApp | Version: v1 | <a href="hostname.html">Pod Name</a>
发现是可以访问的
因为在dev中Ingress中定义了不能访问
[root@master networkpolicy]# kubectl get pods -n prod -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE
pod1 / Running 3m 10.244.1.2 node1 <none>
[root@master networkpolicy]# kubectl get pods -n dev -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE
pod1 / Running 7m 10.244.2.2 node2 <none>
可以看出，prod和dev不同的命名空间都有一个pods
[root@master networkpolicy]# curl 10.244.1.2 #可以
Hello MyApp | Version: v1 | <a href="hostname.html">Pod Name</a>
[root@master networkpolicy]# curl 10.244.2.2 #NO
^C
现在放行2.
dev是默认拒绝一切规则的，他可以请求别人
[root@master networkpolicy]# vim ingres-def.yaml
[root@master networkpolicy]# kubectl apply -f ingres-def.yaml -n dev
networkpolicy.networking.k8s.io/deny-all-ingress configured
[root@master networkpolicy]# cat ingres-def.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: deny-all-ingress
#namespace: dev
spec:
podSelector: {} #空选择器代表命苦空间所有的Pod
ingress:
- {} #允许所有的入栈规则
policyTypes:
- Ingress
#如果不写Ingress的话，默认都可以访问
#如果写上Ingress的话，默认都不能访问 再次访问：
[root@master networkpolicy]# curl 10.244.2.2
Hello MyApp | Version: v1 | <a href="hostname.html">Pod Name</a>
可以访问了
打一个标签，可以设置标签为myapp的特定访问
kubectl label pods pod1 app=myapp -n dev
[root@master networkpolicy]# kubectl label pods pod1 app=myapp -n dev
pod/pod1 labeled [root@master networkpolicy]# cat allow-netpol-demo.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-myapp-ingress
spec:
podSelector:
matchLabels:
app: myapp
ingress:
- from:
- ipBlock: #ip 网段
cidr: 10.244.0.0/ #允许的网段
except:
- 10.244.1.2/ #排除的网段
ports:
- protocol: TCP
port: [root@master networkpolicy]# kubectl apply -f allow-netpol-demo.yaml -n dev
networkpolicy.networking.k8s.io/allow-myapp-ingress created [root@master networkpolicy]# kubectl get netpol -n dev
NAME POD-SELECTOR AGE
allow-myapp-ingress app=myapp 2m
deny-all-ingress <none> 36m [root@master networkpolicy]# curl 10.244.2.2
Hello MyApp | Version: v1 | <a href="hostname.html">Pod Name</a>
生效了
[root@master networkpolicy]# curl 10.244.2.2:
会直接卡主，如果需要访问443，则在yaml文件中配置。
egress
#允许出战 [root@master networkpolicy]# vim egress-def.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: deny-all-egress
spec:
podSelector: {}
egress:
- {}
policyTypes:
- Egress #拒绝出站 [root@master networkpolicy]# vim egress-def.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: deny-all-egress
spec:
podSelector: {}
policyTypes:
- Egress