{"id":32641,"date":"2019-10-31T21:48:11","date_gmt":"2019-10-31T18:48:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/vvedenie-v-setevye-politiki-kubernetes-dlya-spetsialistov-po-bezopasnosti\/"},"modified":"2019-10-31T21:48:11","modified_gmt":"2019-10-31T18:48:11","slug":"vvedenie-v-setevye-politiki-kubernetes-dlya-spetsialistov-po-bezopasnosti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/vvedenie-v-setevye-politiki-kubernetes-dlya-spetsialistov-po-bezopasnosti","title":{"rendered":"\u00davod do s\u00ed\u0165ov\u00fdch politik Kubernetes pro odborn\u00edky na zabezpe\u010den\u00ed","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"\u00davod do s\u00ed\u0165ov\u00fdch politik Kubernetes pro odborn\u00edky na zabezpe\u010den\u00ed\" src=\"\/wp-content\/uploads\/2019\/04\/6972a1e1385463b1fcc723c09036a565.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i><b>Pozn. p\u0159ek.<\/b>: Autor \u010dl\u00e1nku \u2014 Reuven Harrison \u2014 m\u00e1 v\u00edce ne\u017e 20 let zku\u0161enost\u00ed ve v\u00fdvoji softwaru a v sou\u010dasn\u00e9 dob\u011b je technick\u00fdm \u0159editelem a spoluzakladatelem spole\u010dnosti Tufin, kter\u00e1 vytv\u00e1\u0159\u00ed \u0159e\u0161en\u00ed pro spr\u00e1vu bezpe\u010dnostn\u00edch politik. P\u0159i zva\u017eov\u00e1n\u00ed s\u00ed\u0165ov\u00fdch politik Kubernetes jako dostate\u010dn\u011b mocn\u00e9ho n\u00e1stroje pro segmentaci s\u00edt\u011b v clusteru z\u00e1rove\u0148 tvrd\u00ed, \u017ee jejich praktick\u00e9 uplatn\u011bn\u00ed nen\u00ed tak jednoduch\u00e9. Tento materi\u00e1l (pom\u011brn\u011b obs\u00e1hl\u00fd) m\u00e1 zlep\u0161it pov\u011bdom\u00ed odborn\u00edk\u016f v t\u00e9to oblasti a pomoci jim p\u0159i vytv\u00e1\u0159en\u00ed pot\u0159ebn\u00fdch konfigurac\u00ed.<\/i><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>Dnes mnoho spole\u010dnost\u00ed st\u00e1le \u010dast\u011bji vyb\u00edr\u00e1 Kubernetes pro nasazen\u00ed sv\u00fdch aplikac\u00ed. Z\u00e1jem o tento software je tak vysok\u00fd, \u017ee n\u011bkte\u0159\u00ed naz\u00fdvaj\u00ed Kubernetes \u201enov\u00fdm opera\u010dn\u00edm syst\u00e9mem pro datov\u00e1 centra\u201c. Postupn\u011b je Kubernetes (nebo k8s) vn\u00edm\u00e1n jako kritick\u00e1 sou\u010d\u00e1st podnik\u00e1n\u00ed, kter\u00e1 vy\u017eaduje organizaci zral\u00fdch obchodn\u00edch proces\u016f, v\u010detn\u011b zaji\u0161t\u011bn\u00ed s\u00ed\u0165ov\u00e9 bezpe\u010dnosti.<\/p>\n<p>Pro bezpe\u010dnostn\u00ed specialisty, kte\u0159\u00ed jsou zmaten\u00ed prac\u00ed s Kubernetes, m\u016f\u017ee b\u00fdt p\u0159ekvapen\u00edm v\u00fdchoz\u00ed politika t\u00e9to platformy: povolit v\u0161e.<\/p>\n<p>Tato p\u0159\u00edru\u010dka pom\u016f\u017ee pochopit vnit\u0159n\u00ed fungov\u00e1n\u00ed s\u00ed\u0165ov\u00fdch politik; poznat, jak se li\u0161\u00ed od pravidel b\u011b\u017en\u00fdch br\u00e1n firewall. Tak\u00e9 se pod\u00edv\u00e1me na n\u011bkter\u00e9 \u00faskal\u00ed a poskytneme doporu\u010den\u00ed, kter\u00e1 pomohou chr\u00e1nit aplikace v Kubernetes.<\/p>\n<h2>S\u00ed\u0165ov\u00e9 politiky Kubernetes<\/h2>\n<p>\nMechanismus s\u00ed\u0165ov\u00fdch politik Kubernetes umo\u017e\u0148uje \u0159\u00eddit vz\u00e1jemn\u00e9 interakce aplikac\u00ed nasazen\u00fdch na platform\u011b na s\u00ed\u0165ov\u00e9 \u00farovni (t\u0159et\u00ed \u00farove\u0148 modelu OSI). S\u00ed\u0165ov\u00e9 politiky postr\u00e1daj\u00ed n\u011bkter\u00e9 pokro\u010dil\u00e9 funkce modern\u00edch br\u00e1n firewall, jako je \u0159\u00edzen\u00ed na 7. \u00farovni OSI a detekce hrozeb, nicm\u00e9n\u011b zaji\u0161\u0165uj\u00ed z\u00e1kladn\u00ed \u00farove\u0148 s\u00ed\u0165ov\u00e9 bezpe\u010dnosti, co\u017e je dobr\u00fd v\u00fdchoz\u00ed bod.<\/p>\n<h2>S\u00ed\u0165ov\u00e9 politiky reguluj\u00ed komunikaci mezi pod'y.<\/h2>\n<p>\nZ\u00e1t\u011b\u017ee v Kubernetes jsou rozlo\u017eeny do pod'\u016f, kter\u00e9 se skl\u00e1daj\u00ed z jednoho nebo v\u00edce kontejner\u016f nasazen\u00fdch spole\u010dn\u011b. Kubernetes p\u0159id\u011bluje ka\u017ed\u00e9mu pod'u IP adresu, kter\u00e1 je p\u0159\u00edstupn\u00e1 z jin\u00fdch pod'\u016f. S\u00ed\u0165ov\u00e9 politiky Kubernetes ur\u010duj\u00ed p\u0159\u00edstupov\u00e1 pr\u00e1va pro skupiny pod'\u016f stejn\u00fdm zp\u016fsobem, jak\u00fdm se pou\u017e\u00edvaj\u00ed bezpe\u010dnostn\u00ed skupiny v cloudu k \u0159\u00edzen\u00ed p\u0159\u00edstupu k instanc\u00edm virtu\u00e1ln\u00edch stroj\u016f.<\/p>\n<h2>Definice s\u00ed\u0165ov\u00fdch politik<\/h2>\n<p>\nJako v\u0161echny ostatn\u00ed zdroje Kubernetes se s\u00ed\u0165ov\u00e9 politiky definuj\u00ed v jazyce YAML. V n\u00e1sleduj\u00edc\u00edm p\u0159\u00edkladu je aplikaci <code>balance<\/code> p\u0159\u00edstup otev\u0159en k <code>Postgres<\/code>:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.postgres\n  namespace: default\nspec:\n  podSelector:\n    matchLabels:\n      app: postgres\n  ingress:\n  - from:\n    - podSelector:\n        matchLabels:\n          app: balance\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do s\u00ed\u0165ov\u00fdch politik Kubernetes pro odborn\u00edky na zabezpe\u010den\u00ed\" src=\"\/wp-content\/uploads\/2019\/04\/ff5857af2641e62558b035bab9c413dc.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>(<b>Pozn. p\u0159ek.<\/b>: tento sn\u00edmek obrazovky, stejn\u011b jako v\u0161echny n\u00e1sleduj\u00edc\u00ed podobn\u00e9, byl vytvo\u0159en pomoc\u00ed n\u00e1stroje Tufin Orca, jeho\u017e v\u00fdvoj stoj\u00ed za autorem p\u016fvodn\u00edho \u010dl\u00e1nku, kter\u00fd je zm\u00edn\u011bn na konci materi\u00e1lu.<\/i><\/p>\n<p>Pro definici vlastn\u00ed s\u00ed\u0165ov\u00e9 politiky budete pot\u0159ebovat z\u00e1kladn\u00ed znalosti YAML. Tento jazyk je zalo\u017een na odsazen\u00edch (ur\u010den\u00fdch mezerami, nikoli tabul\u00e1tory). Element s odsazen\u00edm n\u00e1le\u017e\u00ed nejbli\u017e\u0161\u00edmu prvku s odsazen\u00edm nad n\u00edm. Nov\u00fd prvek seznamu za\u010d\u00edn\u00e1 poml\u010dkou, v\u0161echny ostatn\u00ed prvky maj\u00ed podobu <i>kl\u00ed\u010d-hodnota<\/i>.<\/p>\n<p>Po popisu politiky v YAML pou\u017eijte <noindex><a rel=\"nofollow\" href=\"https:\/\/kubernetes.io\/docs\/reference\/kubectl\/kubectl\/\">kubectl<\/a><\/noindex>, abyste ji vytvo\u0159ili v klastru:<\/p>\n<pre><code class=\"bash\">kubectl create -f policy.yaml<\/code><\/pre>\n<p><\/p>\n<h2>Specifikace s\u00ed\u0165ov\u00e9 politiky<\/h2>\n<p>\nSpecifikace s\u00ed\u0165ov\u00e9 politiky Kubernetes zahrnuje \u010dty\u0159i prvky:<\/p>\n<ol>\n<li> <code>podSelector<\/code>: ur\u010duje pod'y, kter\u00e9 se touto politikou dot\u00fdkaj\u00ed (c\u00edle) \u2014 povinn\u00e9;<\/li>\n<li> <code>policyTypes<\/code>: uv\u00e1d\u00ed, jak\u00e9 typy politik jsou zahrnuty v t\u00e9to: ingress a\/nebo egress \u2014 nepovinn\u00e9, doporu\u010duji v\u0161ak jej jasn\u011b uv\u00e1d\u011bt ve v\u0161ech p\u0159\u00edpadech;<\/li>\n<li> <code>ingress<\/code>: ur\u010duje povolen\u00fd <b>p\u0159\u00edchoz\u00ed<\/b> provoz do c\u00edlov\u00fdch pod'\u016f \u2014 nepovinn\u00e9;<\/li>\n<li> <code>egress<\/code>: ur\u010duje povolen\u00fd <b>odchoz\u00ed<\/b> provoz z c\u00edlov\u00fdch pod'\u016f \u2014 nepovinn\u00e9.<\/li>\n<\/ol>\n<p>\nP\u0159\u00edklad p\u0159evzat\u00fd z webu Kubernetes (nahradil jsem <code>role<\/code> na <code>app<\/code>), ukazuje, jak jsou pou\u017e\u00edv\u00e1ny v\u0161echny \u010dty\u0159i prvky:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: test-network-policy\n  namespace: default\nspec:\n  podSelector:    # &lt;&lt;&lt;\n    matchLabels:\n      app: db\n  policyTypes:    # &lt;&lt;&lt;\n  - Ingress\n  - Egress\n  ingress:        # &lt;&lt;&lt;\n  - from:\n    - ipBlock:\n        cidr: 172.17.0.0\/16\n        except:\n        - 172.17.1.0\/24\n    - namespaceSelector:\n        matchLabels:\n          project: myproject\n    - podSelector:\n        matchLabels:\n          role: frontend\n    ports:\n    - protocol: TCP\n      port: 6379\n  egress:         # &lt;&lt;&lt;\n  - to:\n    - ipBlock:\n        cidr: 10.0.0.0\/24\n    ports:\n    - protocol: TCP\n      port: 5978<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do s\u00ed\u0165ov\u00fdch politik Kubernetes pro odborn\u00edky na zabezpe\u010den\u00ed\" src=\"\/wp-content\/uploads\/2019\/04\/f01e748410564756d6272095093e52e2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<img decoding=\"async\" alt=\"\u00davod do s\u00ed\u0165ov\u00fdch politik Kubernetes pro odborn\u00edky na zabezpe\u010den\u00ed\" src=\"\/wp-content\/uploads\/2019\/04\/997282073ee6b5c4d6b7af45cdc11295.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nV\u0161imn\u011bte si, \u017ee nen\u00ed nutn\u00e9 zahrnout v\u0161echny \u010dty\u0159i prvky. Povinn\u00fd je pouze <code>podSelector<\/code>, ostatn\u00ed parametry mohou b\u00fdt pou\u017eity dle pot\u0159eby.<\/p>\n<p>Pokud se vynech\u00e1 <code>policyTypes<\/code>, bude politiku interpretovat n\u00e1sledovn\u011b:<\/p>\n<ul>\n<li> Ve v\u00fdchoz\u00edm nastaven\u00ed se p\u0159edpokl\u00e1d\u00e1, \u017ee definuje ingress stranu. Pokud politika neobsahuje \u017e\u00e1dn\u00e9 jasn\u00e9 pokyny v tomto smyslu, syst\u00e9m bude pova\u017eovat, \u017ee ve\u0161ker\u00fd provoz je zak\u00e1z\u00e1n.<\/li>\n<li> Chov\u00e1n\u00ed na egress stran\u011b bude ur\u010deno p\u0159\u00edtomnost\u00ed nebo nep\u0159\u00edtomnost\u00ed odpov\u00eddaj\u00edc\u00edho egress parametru.<\/li>\n<\/ul>\n<p>\nAbychom se vyhnuli chyb\u00e1m, doporu\u010duji <b>v\u017edy jasn\u011b uv\u00e9st <code>policyTypes<\/code><\/b>.<\/p>\n<p>V souladu s v\u00fd\u0161e uvedenou logikou, pokud jsou parametry <code>ingress<\/code> a\/nebo <code>egress<\/code> vynech\u00e1ny, politika bude zakazovat ve\u0161ker\u00fd provoz (viz \u201ePravidlo \u010di\u0161t\u011bn\u00ed\u201c n\u00ed\u017ee).<\/p>\n<h2>V\u00fdchoz\u00ed politika \u2014 povolit<\/h2>\n<p>\nPokud nejsou politiky definov\u00e1ny, Kubernetes ve v\u00fdchoz\u00edm nastaven\u00ed povoluje ve\u0161ker\u00fd provoz. V\u0161echny pod'y si mohou mezi sebou voln\u011b vym\u011b\u0148ovat informace. Z hlediska bezpe\u010dnosti se to m\u016f\u017ee zd\u00e1t nelogick\u00e9, ale pamatujte, \u017ee Kubernetes byl p\u016fvodn\u011b vytvo\u0159en v\u00fdvoj\u00e1\u0159i s c\u00edlem zajistit interakci aplikac\u00ed. S\u00ed\u0165ov\u00e9 politiky byly p\u0159id\u00e1ny pozd\u011bji.<\/p>\n<h2>Prostor jmen<\/h2>\n<p>\nProstory jmen (Namespaces) jsou mechanismem kolektivn\u00ed pr\u00e1ce Kubernetes. Jsou ur\u010deny k izolaci logick\u00fdch prost\u0159ed\u00ed od sebe, p\u0159i\u010dem\u017e v\u00fdm\u011bna dat mezi prostory je ve v\u00fdchoz\u00edm nastaven\u00ed povolena.<\/p>\n<p>Stejn\u011b jako v\u011bt\u0161ina komponent Kubernetes, s\u00ed\u0165ov\u00e9 politiky se nach\u00e1zej\u00ed v ur\u010dit\u00e9m prostoru jmen. V bloku <code>metadata<\/code> m\u016f\u017eete uv\u00e9st, kter\u00e9mu prostoru n\u00e1le\u017e\u00ed politika:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: test-network-policy\n  namespace: my-namespace  # &lt;&lt;&lt;\nspec:\n...<\/code><\/pre>\n<p>\nPokud nen\u00ed prostor jmen v metadatech jasn\u011b uveden, syst\u00e9m pou\u017eije namespace uveden\u00e9 v kubectl (ve v\u00fdchoz\u00edm nastaven\u00ed <code>namespace=default<\/code>):<\/p>\n<pre><code class=\"bash\">kubectl apply -n my-namespace -f namespace.yaml<\/code><\/pre>\n<p>\nDoporu\u010duji <b>jasn\u011b uv\u00e9st namespace<\/b>, pokud nep\u00ed\u0161ete politiku ur\u010denou pro v\u00edce prostor\u016f n\u00e1zv\u016f sou\u010dasn\u011b.<\/p>\n<p><b>Hlavn\u00ed<\/b> prvek <code>podSelector<\/code> v politice se vyb\u00edraj\u00ed pod'y z n\u00e1zvov\u00e9ho prostoru, ke kter\u00e9mu politika pat\u0159\u00ed (nem\u00e1 p\u0159\u00edstup k pod'\u016fm z jin\u00e9ho n\u00e1zvov\u00e9ho prostoru).<\/p>\n<p>Podobn\u011b podSelector'y <b>v bloc\u00edch ingress a egress<\/b> mohou vyb\u00edrat pod\u2019y pouze ze sv\u00e9ho prostoru n\u00e1zv\u016f, pokud je samoz\u0159ejm\u011b nesdru\u017e\u00edte pomoc\u00ed <code>namespaceSelector<\/code> (o tom bude \u0159e\u010d v sekci 'Filtr podle n\u00e1zvov\u00fdch prostor\u016f a pod'\u016f').<\/p>\n<h2>Pravidla pojmenov\u00e1n\u00ed politik<\/h2>\n<p>\nN\u00e1zvy politik jsou jedine\u010dn\u00e9 v r\u00e1mci jednoho prostoru n\u00e1zv\u016f. Dv\u011b politiky se stejn\u00fdm n\u00e1zvem v jednom prostoru nemohou existovat, ale mohou existovat politiky se stejn\u00fdmi n\u00e1zvy v r\u016fzn\u00fdch prostorech. Je to u\u017eite\u010dn\u00e9, kdy\u017e chcete znovu pou\u017e\u00edt jednu a tut\u00e9\u017e politiku na n\u011bkolika prostorech.<\/p>\n<p>Zvl\u00e1\u0161\u0165 se mi l\u00edb\u00ed jeden z n\u00e1vrh\u016f pojmenov\u00e1n\u00ed. Spo\u010d\u00edv\u00e1 v tom, \u017ee se spojuje n\u00e1zev prostoru n\u00e1zv\u016f s c\u00edlov\u00fdmi pod\u2019y. Nap\u0159\u00edklad:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.postgres  # &lt;&lt;&lt;\n  namespace: default\nspec:\n  podSelector:\n    matchLabels:\n      app: postgres\n  ingress:\n  - from:\n    - podSelector:\n        matchLabels:\n          app: admin\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do s\u00ed\u0165ov\u00fdch politik Kubernetes pro odborn\u00edky na zabezpe\u010den\u00ed\" src=\"\/wp-content\/uploads\/2019\/04\/18318c320d6e37eeb01c51f251550639.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>\u0160t\u00edtky<\/h2>\n<p>\nK objekt\u016fm Kubernetes, jako jsou pod\u2019y a prostory n\u00e1zv\u016f, lze p\u0159ipojovat vlastn\u00ed \u0161t\u00edtky. \u0160t\u00edtky (<i>labels<\/i> \u2014 zna\u010dky) jsou ekvivalentem tag\u016f v cloudu. S\u00ed\u0165ov\u00e9 politiky Kubernetes pou\u017e\u00edvaj\u00ed \u0161t\u00edtky k v\u00fdb\u011bru <b>pod'\u016f<\/b>, na kter\u00e9 se vztahuj\u00ed:<\/p>\n<pre><code class=\"plaintext\">podSelector:\n  matchLabels:\n    role: db<\/code><\/pre>\n<p>\n\u2026 nebo <b>prostor\u016f n\u00e1zv\u016f<\/b>, na kter\u00e9 se vztahuj\u00ed. V tomto p\u0159\u00edkladu jsou vybr\u00e1ny v\u0161echny pod'y v n\u00e1zvov\u00fdch prostorech s odpov\u00eddaj\u00edc\u00edmi \u0161t\u00edtky:<\/p>\n<pre><code class=\"plaintext\">namespaceSelector:\n  matchLabels:\n    project: myproject<\/code><\/pre>\n<p>\nJedno varov\u00e1n\u00ed: p\u0159i pou\u017eit\u00ed <code>namespaceSelector<\/code> <b>se ujist\u011bte, \u017ee vybran\u00e9 prostory n\u00e1zv\u016f obsahuj\u00ed po\u017eadovan\u00fd \u0161t\u00edtek<\/b>. M\u011bjte na pam\u011bti, \u017ee vestav\u011bn\u00e9 prostory n\u00e1zv\u016f, jako je <code>default<\/code> a <code>kube-system<\/code>, ve v\u00fdchoz\u00edm nastaven\u00ed neobsahuj\u00ed \u0161t\u00edtky.<\/p>\n<p>\u0160t\u00edtek k prostoru se d\u00e1 p\u0159idat n\u00e1sleduj\u00edc\u00edm zp\u016fsobem:<\/p>\n<pre><code class=\"bash\">kubectl label namespace default namespace=default<\/code><\/pre>\n<p>\nP\u0159itom namespace v \u010d\u00e1sti <code>metadata<\/code> by m\u011bl odkazovat na skute\u010dn\u00e9 jm\u00e9no prostoru, a ne na \u0161t\u00edtek:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: test-network-policy\n  namespace: default   # &lt;&lt;&lt;\nspec:\n...<\/code><\/pre>\n<p><\/p>\n<h2>Zdroj a adres\u00e1t<\/h2>\n<p>\nPolitiky pro firewally se skl\u00e1daj\u00ed z pravidel s p\u016fvodci a adres\u00e1ty. S\u00ed\u0165ov\u00e9 politiky Kubernetes se definuj\u00ed pro c\u00edlovou skupinu \u2014 sadu pod'\u016f, na kter\u00e9 se vztahuj\u00ed, a pot\u00e9 stanovuj\u00ed pravidla pro p\u0159\u00edchoz\u00ed (ingress) a\/nebo odchoz\u00ed (egress) provoz. V na\u0161em p\u0159\u00edkladu bude c\u00edlem politiky v\u0161ech pod'\u016f v n\u00e1zvov\u00e9m prostoru <code>default<\/code> s ozna\u010den\u00edm s kl\u00ed\u010dem <code>app<\/code> a hodnotou <code>db<\/code>:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: test-network-policy\n  namespace: default\nspec:\n  podSelector:\n    matchLabels:\n      app: db   # &lt;&lt;&lt;\n  policyTypes:\n  - Ingress\n  - Egress\n  ingress:\n  - from:\n    - ipBlock:\n        cidr: 172.17.0.0\/16\n        except:\n        - 172.17.1.0\/24\n    - namespaceSelector:\n        matchLabels:\n          project: myproject\n    - podSelector:\n        matchLabels:\n          role: frontend\n    ports:\n    - protocol: TCP\n      port: 6379\n  egress:\n  - to:\n    - ipBlock:\n        cidr: 10.0.0.0\/24\n    ports:\n    - protocol: TCP\n      port: 5978<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do s\u00ed\u0165ov\u00fdch politik Kubernetes pro odborn\u00edky na zabezpe\u010den\u00ed\" src=\"\/wp-content\/uploads\/2019\/04\/5fcb3f78e26ae1ed5635541ad69ef69f.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<img decoding=\"async\" alt=\"\u00davod do s\u00ed\u0165ov\u00fdch politik Kubernetes pro odborn\u00edky na zabezpe\u010den\u00ed\" src=\"\/wp-content\/uploads\/2019\/04\/c753f559ecc3ba54f8b55e29851428c4.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPodrobnost <code>ingress<\/code> v t\u00e9to politice otev\u00edr\u00e1 p\u0159\u00edchoz\u00ed provoz pro c\u00edlov\u00e9 pody. Jin\u00fdmi slovy, ingress je zdrojem, zat\u00edmco c\u00edl je p\u0159\u00edslu\u0161n\u00fdm p\u0159\u00edjemcem. Podobn\u011b egress je p\u0159\u00edjemcem, zat\u00edmco c\u00edl je jeho zdrojem.<\/p>\n<p><img decoding=\"async\" alt=\"\u00davod do s\u00ed\u0165ov\u00fdch politik Kubernetes pro odborn\u00edky na zabezpe\u010den\u00ed\" src=\"\/wp-content\/uploads\/2019\/04\/a0d865de57a7620849074424770832cd.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>To odpov\u00edd\u00e1 dv\u011bma pravidl\u016fm pro firewall: Ingress \u2192 C\u00edl; C\u00edl \u2192 Egress.<\/i><\/p>\n<h2>Egress a DNS (d\u016fle\u017eit\u00e9!)<\/h2>\n<p>\nOmezen\u00edm odchoz\u00edho provozu, <b>v\u011bnujte zvl\u00e1\u0161tn\u00ed pozornost DNS<\/b> \u2014 Kubernetes pou\u017e\u00edv\u00e1 tuto slu\u017ebu pro mapov\u00e1n\u00ed slu\u017eeb na IP adresy. Nap\u0159\u00edklad n\u00e1sleduj\u00edc\u00ed politika nebude fungovat, proto\u017ee jste nepovolili aplikaci <code>balance<\/code> p\u0159\u00edstup k DNS:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.balance\n  namespace: default\nspec:\n  podSelector:\n    matchLabels:\n      app: balance\n  egress:\n  - to:\n    - podSelector:\n        matchLabels:\n          app: postgres\n  policyTypes:\n  - Egress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do s\u00ed\u0165ov\u00fdch politik Kubernetes pro odborn\u00edky na zabezpe\u010den\u00ed\" src=\"\/wp-content\/uploads\/2019\/04\/5857a44cc5e06de708f0d3b5b0f49628.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nOpravit to lze otev\u0159en\u00edm p\u0159\u00edstupu k DNS slu\u017eb\u011b:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.balance\n  namespace: default\nspec:\n  podSelector:\n    matchLabels:\n      app: balance\n  egress:\n  - to:\n    - podSelector:\n        matchLabels:\n          app: postgres\n  - to:               # &lt;&lt;&lt;\n    ports:            # &lt;&lt;&lt;\n    - protocol: UDP   # &lt;&lt;&lt;\n      port: 53        # &lt;&lt;&lt;\n  policyTypes:\n  - Egress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do s\u00ed\u0165ov\u00fdch politik Kubernetes pro odborn\u00edky na zabezpe\u010den\u00ed\" src=\"\/wp-content\/uploads\/2019\/04\/a396bb2ae94fca94c3b62aef2cb07552.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPosledn\u00ed prvek <code>to<\/code> \u2014 pr\u00e1zdn\u00fd, a proto nep\u0159\u00edmo vyb\u00edr\u00e1 <b>v\u0161echny pod'y ve v\u0161ech n\u00e1zvov\u00fdch prostorech<\/b>, co\u017e umo\u017e\u0148uje <code>balance<\/code> odes\u00edlat DNS dotazy na p\u0159\u00edslu\u0161nou slu\u017ebu Kubernetes (obvykle b\u011b\u017e\u00ed v prostoru <code>kube-system<\/code>).<\/p>\n<p>Tento p\u0159\u00edstup funguje, nicm\u00e9n\u011b je <b>p\u0159\u00edli\u0161 povoluj\u00edc\u00ed a nebezpe\u010dn\u00fd<\/b>, proto\u017ee umo\u017e\u0148uje, aby DNS dotazy sm\u011b\u0159ovaly mimo cluster.<\/p>\n<p>Vylep\u0161it to lze t\u0159emi po sob\u011b jdouc\u00edmi kroky.<\/p>\n<p>1. Povolte DNS dotazy pouze <b>uvnit\u0159<\/b> na cluster p\u0159id\u00e1n\u00edm <code>namespaceSelector<\/code>:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.balance\n  namespace: default\nspec:\n  podSelector:\n    matchLabels:\n      app: balance\n  egress:\n  - to:\n    - podSelector:\n        matchLabels:\n          app: postgres\n  - to:\n    - namespaceSelector: {} # &lt;&lt;&lt;\n    ports:\n    - protocol: UDP\n      port: 53\n  policyTypes:\n  - Egress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do s\u00ed\u0165ov\u00fdch politik Kubernetes pro odborn\u00edky na zabezpe\u010den\u00ed\" src=\"\/wp-content\/uploads\/2019\/04\/5920a043229676e0780d691d302c5ade.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n2. Umo\u017en\u011bte DNS dotazy pouze v r\u00e1mci jmenn\u00e9ho prostoru <code>kube-system<\/code>.<\/p>\n<p>K tomu je pot\u0159eba p\u0159idat \u0161t\u00edtek do jmenn\u00e9ho prostoru <code>kube-system<\/code>: <code>kubectl label namespace kube-system namespace=kube-system<\/code> \u2014 a zapsat ho do politiky prost\u0159ednictv\u00edm <code>namespaceSelector<\/code>:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.balance\n  namespace: default\nspec:\n  podSelector:\n    matchLabels:\n      app: balance\n  egress:\n  - to:\n    - podSelector:\n        matchLabels:\n          app: postgres\n  - to:\n    - namespaceSelector:         # &lt;&lt;&lt;\n        matchLabels:             # &lt;&lt;&lt;\n          namespace: kube-system # &lt;&lt;&lt;\n    ports:\n    - protocol: UDP\n      port: 53\n  policyTypes:\n  - Egress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do s\u00ed\u0165ov\u00fdch politik Kubernetes pro odborn\u00edky na zabezpe\u010den\u00ed\" src=\"\/wp-content\/uploads\/2019\/04\/2a1dd0975c58e6d277baffc7c3ac6e48.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n3. Paranoici mohou j\u00edt je\u0161t\u011b d\u00e1l a omezit DNS dotazy na konkr\u00e9tn\u00ed DNS slu\u017ebu v <code>kube-system<\/code>. V sekci 'Filtr podle n\u00e1zvov\u00fdch prostor\u016f a pod'\u016f' se dozv\u00edte, jak toho dos\u00e1hnout.<\/p>\n<p>Dal\u0161\u00ed mo\u017enost\u00ed je povolit DNS na \u00farovni jmenn\u00e9ho prostoru. V tomto p\u0159\u00edpad\u011b ho nebude nutn\u00e9 otev\u00edrat pro ka\u017edou slu\u017ebu:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.dns\n  namespace: default\nspec:\n  podSelector: {} # &lt;&lt;&lt;\n  egress:\n  - to:\n    - namespaceSelector: {}\n    ports:\n    - protocol: UDP\n      port: 53\n  policyTypes:\n  - Egress<\/code><\/pre>\n<p>\nPr\u00e1zdn\u00fd <code>podSelector<\/code> vyb\u00edr\u00e1 v\u0161echny pody v jmenn\u00e9m prostoru.<\/p>\n<p><img decoding=\"async\" alt=\"\u00davod do s\u00ed\u0165ov\u00fdch politik Kubernetes pro odborn\u00edky na zabezpe\u010den\u00ed\" src=\"\/wp-content\/uploads\/2019\/04\/5d6b627b69da980477b3910fbf4de6c1.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Prvn\u00ed z\u00e1pas a po\u0159ad\u00ed pravidel<\/h2>\n<p>\nVe standardn\u00edch firewallech se akce (\u201ePovolit\u201c nebo \u201eZamezit\u201c) na paket ur\u010duje prvn\u00edm pravidlem, kter\u00e9 vyhovuje. <b>V Kubernetes nem\u00e1 po\u0159ad\u00ed politik \u017e\u00e1dn\u00fd v\u00fdznam.<\/b><\/p>\n<p>Ve v\u00fdchoz\u00edm nastaven\u00ed, kdy\u017e nejsou politiky nastaveny, je komunikace mezi pod'y povolena a mohou si voln\u011b vym\u011b\u0148ovat informace. Jakmile za\u010dnete formulovat politiky, ka\u017ed\u00fd pod dot\u010den\u00fd alespo\u0148 jednou z nich se st\u00e1v\u00e1 izolovan\u00fdm podle disjunkce (logick\u00e9ho NEBO) v\u0161ech politik, kter\u00e9 ho vybraly. Pod'y, kter\u00e9 nejsou ovlivn\u011bny \u017e\u00e1dnou politikou, z\u016fst\u00e1vaj\u00ed otev\u0159en\u00e9.<\/p>\n<p>Toto chov\u00e1n\u00ed lze zm\u011bnit pomoc\u00ed pravidla vy\u0159azen\u00ed.<\/p>\n<h2>Pravidlo vy\u0159azen\u00ed (\u201eZamezit\u201c)<\/h2>\n<p>\nPolitiky firewallu obvykle zamezuj\u00ed jak\u00e9mukoli v\u00fdslovn\u011b nepovolen\u00e9mu provozu.<\/p>\n<p><b>V Kubernetes neexistuje akce \u201ezamezit\u201c (deny),<\/b>, av\u0161ak podobn\u00e9ho efektu lze dos\u00e1hnout s b\u011b\u017enou (povolenou) politikou t\u00edm, \u017ee vyberete pr\u00e1zdnou skupinu pod\u016f zdroj\u016f (ingress):<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: deny-all\n  namespace: default\nspec:\n  podSelector: {}\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do s\u00ed\u0165ov\u00fdch politik Kubernetes pro odborn\u00edky na zabezpe\u010den\u00ed\" src=\"\/wp-content\/uploads\/2019\/04\/8b3ced50ec5a1de70940d53f467966fe.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTato politika vyb\u00edr\u00e1 v\u0161echny pody ve jmenn\u00e9m prostoru a nech\u00e1v\u00e1 ingress neur\u010den\u00fd, zakazuj\u00edc\u00ed ve\u0161ker\u00fd p\u0159\u00edchoz\u00ed provoz.<\/p>\n<p>Podobn\u00fdm zp\u016fsobem lze omezit ve\u0161ker\u00fd odchoz\u00ed provoz z prostor\u016f jmen:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: deny-all-egress\n  namespace: default\nspec:\n  podSelector: {}\n  policyTypes:\n  - Egress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do s\u00ed\u0165ov\u00fdch politik Kubernetes pro odborn\u00edky na zabezpe\u010den\u00ed\" src=\"\/wp-content\/uploads\/2019\/04\/be22e11efef0098f2665331c09d748f2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nM\u011bjte na pam\u011bti, \u017ee <b>jak\u00e9koli dal\u0161\u00ed politiky, kter\u00e9 povoluj\u00ed provoz k pod\u016fm ve jmenn\u00e9m prostoru, budou m\u00edt p\u0159ednost p\u0159ed t\u00edmto pravidlem<\/b> (analogicky k p\u0159id\u00e1n\u00ed povoluj\u00edc\u00edho pravidla p\u0159ed zak\u00e1zaj\u00edc\u00ed v konfiguraci firewallu).<\/p>\n<h2>Povolit v\u0161e (Any-Any-Any-Allow)<\/h2>\n<p>\nChcete-li vytvo\u0159it politiku \u201ePovolit v\u0161e\u201c, mus\u00edte doplnit uvedenou zakazuj\u00edc\u00ed politiku pr\u00e1zdn\u00fdm prvkem <code>ingress<\/code>:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: allow-all\n  namespace: default\nspec:\n  podSelector: {}\n  ingress: # &lt;&lt;&lt;\n  - {}     # &lt;&lt;&lt;\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do s\u00ed\u0165ov\u00fdch politik Kubernetes pro odborn\u00edky na zabezpe\u010den\u00ed\" src=\"\/wp-content\/uploads\/2019\/04\/7322351493211388fe772b8dc270108d.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nOtev\u00edr\u00e1 p\u0159\u00edstup ze <b>v\u0161ech pod\u016f ve v\u0161ech jmenn\u00fdch prostorech (a v\u0161ech IP) k jak\u00e9mukoli podu ve jmenn\u00e9m prostoru <code>default<\/code><\/b>. Takov\u00e9 chov\u00e1n\u00ed je ve v\u00fdchoz\u00edm nastaven\u00ed povoleno, tak\u017ee obvykle nen\u00ed pot\u0159eba ho dodate\u010dn\u011b ur\u010dovat. Nicm\u00e9n\u011b n\u011bkdy m\u016f\u017ee b\u00fdt pot\u0159eba do\u010dasn\u011b zak\u00e1zat n\u011bkter\u00e1 konkr\u00e9tn\u00ed povolen\u00ed pro diagnostiku probl\u00e9mu.<\/p>\n<p>Pravidlo lze z\u00fa\u017eit a povolit p\u0159\u00edstup pouze k <b>ur\u010dit\u00e9 skupin\u011b pod\u016f<\/b> (<code>app:balance<\/code>) v prostoru jmen <code>default<\/code>:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: allow-all-to-balance\n  namespace: default\nspec:\n  podSelector:\n    matchLabels:\n      app: balance\n  ingress: \n  - {}\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do s\u00ed\u0165ov\u00fdch politik Kubernetes pro odborn\u00edky na zabezpe\u010den\u00ed\" src=\"\/wp-content\/uploads\/2019\/04\/d8c9cb85003f489acec815d1c2b53497.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nN\u00e1sleduj\u00edc\u00ed politika povoluje ve\u0161ker\u00fd p\u0159\u00edchoz\u00ed (ingress) a odchoz\u00ed (egress) provoz, v\u010detn\u011b p\u0159\u00edstupu k libovoln\u00e9 IP mimo cluster:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: allow-all\nspec:\n  podSelector: {}\n  ingress:\n  - {}\n  egress:\n  - {}\n  policyTypes:\n  - Ingress\n  - Egress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do s\u00ed\u0165ov\u00fdch politik Kubernetes pro odborn\u00edky na zabezpe\u010den\u00ed\" src=\"\/wp-content\/uploads\/2019\/04\/2477f18d3d228f80bc5169d9ec3be2fc.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<img decoding=\"async\" alt=\"\u00davod do s\u00ed\u0165ov\u00fdch politik Kubernetes pro odborn\u00edky na zabezpe\u010den\u00ed\" src=\"\/wp-content\/uploads\/2019\/04\/3502b892713cdac8850e812b2eff3ea3.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Kombinace n\u011bkolika politik<\/h2>\n<p>\nPolitiky se kombinuj\u00ed pomoc\u00ed logick\u00e9ho NEBO na t\u0159ech \u00farovn\u00edch; povolen\u00ed ka\u017ed\u00e9ho podu se ur\u010duje podle disjunkce v\u0161ech politik, kter\u00e9 se ho dot\u00fdkaj\u00ed:<\/p>\n<p>1. V pol\u00edch <code>from<\/code> a <code>to<\/code> m\u016f\u017eete definovat t\u0159i typy prvk\u016f (v\u0161echny se kombinuj\u00ed pomoc\u00ed OR):<\/p>\n<ul>\n<li> <code>namespaceSelector<\/code> \u2014 vyb\u00edr\u00e1 cel\u00e9 jm\u00e9no prostoru;<\/li>\n<li> <code>podSelector<\/code> \u2014 vyb\u00edr\u00e1 pody;<\/li>\n<li> <code>ipBlock<\/code> \u2014 vyb\u00edr\u00e1 pods\u00ed\u0165.<\/li>\n<\/ul>\n<p>\nP\u0159itom po\u010det prvk\u016f (i stejn\u00fdch) v pod\u0159\u00edzen\u00fdch <code>from<\/code>\/<code>to<\/code> nen\u00ed omezen. V\u0161echny budou slou\u010deny logick\u00fdm OR.<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.postgres\n  namespace: default\nspec:\n  ingress:\n  - from:\n    - podSelector:\n        matchLabels:\n          app: indexer\n    - podSelector:\n        matchLabels:\n          app: admin\n  podSelector:\n    matchLabels:\n      app: postgres\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do s\u00ed\u0165ov\u00fdch politik Kubernetes pro odborn\u00edky na zabezpe\u010den\u00ed\" src=\"\/wp-content\/uploads\/2019\/04\/717e745720f39260a8508fb2b2bb6f65.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n2. Uvnit\u0159 politiky odd\u00edl <code>ingress<\/code> m\u016f\u017ee m\u00edt mnoho prvk\u016f <code>from<\/code> (kombinuj\u00ed se logick\u00fdm NEBO). Podobn\u011b odd\u00edl <code>egress<\/code> m\u016f\u017ee zahrnovat mnoho prvk\u016f <code>to<\/code> (tak\u00e9 se kombinuj\u00ed disjunktivn\u011b):<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.postgres\n  namespace: default\nspec:\n  ingress:\n  - from:\n    - podSelector:\n        matchLabels:\n          app: indexer\n  - from:\n    - podSelector:\n        matchLabels:\n          app: admin\n  podSelector:\n    matchLabels:\n      app: postgres\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do s\u00ed\u0165ov\u00fdch politik Kubernetes pro odborn\u00edky na zabezpe\u010den\u00ed\" src=\"\/wp-content\/uploads\/2019\/04\/b579e1f4b97acd92fb38cd6703aa1983.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n3. R\u016fzn\u00e9 politiky se tak\u00e9 kombinuj\u00ed logick\u00fdm NEBO<\/p>\n<p>Ale p\u0159i jejich kombinaci existuje jedno omezen\u00ed, na kter\u00e9 <noindex><a rel=\"nofollow\" href=\"https:\/\/medium.com\/sainsburys-engineering\/considerations-with-k8s-networkpolicy-cee7eacf5469\">uvedl<\/a><\/noindex> <noindex><a rel=\"nofollow\" href=\"https:\/\/medium.com\/@chriscooney\">Chris Cooney<\/a><\/noindex>: Kubernetes m\u016f\u017ee kombinovat politiky pouze s r\u016fzn\u00fdmi <code>policyTypes<\/code> (<code>Ingress<\/code> nebo <code>Egress<\/code>). Politiky definuj\u00edc\u00ed ingress (nebo egress) si vz\u00e1jemn\u011b p\u0159eepisuj\u00ed.<\/p>\n<h2>Spojen\u00ed mezi pracovn\u00edmi prostory<\/h2>\n<p>\nVe v\u00fdchoz\u00edm nastaven\u00ed je komunikace mezi pracovn\u00edmi prostory povolena. To lze zm\u011bnit pomoc\u00ed restriktivn\u00ed politiky, kter\u00e1 omezuje odchoz\u00ed a\/nebo p\u0159\u00edchoz\u00ed provoz do pracovn\u00edho prostoru (viz \"\u010cist\u00edc\u00ed pravidlo\" v\u00fd\u0161e).<\/p>\n<p>Zablokov\u00e1n\u00edm p\u0159\u00edstupu do pracovn\u00edho prostoru (viz \"\u010cist\u00edc\u00ed pravidlo\" v\u00fd\u0161e) m\u016f\u017eete ud\u011blat v\u00fdjimku v restriktivn\u00ed politice, povolen\u00edm p\u0159ipojen\u00ed z ur\u010dit\u00e9ho pracovn\u00edho prostoru pomoc\u00ed <code>namespaceSelector<\/code>:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: database.postgres\n  namespace: database\nspec:\n  podSelector:\n    matchLabels:\n      app: postgres\n  ingress:\n  - from:\n    - namespaceSelector: # &lt;&lt;&lt;\n        matchLabels:\n          namespace: default\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do s\u00ed\u0165ov\u00fdch politik Kubernetes pro odborn\u00edky na zabezpe\u010den\u00ed\" src=\"\/wp-content\/uploads\/2019\/04\/5a3d2baed1ff9b813ef0651fe500ad8a.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nV d\u016fsledku toho budou v\u0161echny pod\u2019y v pracovn\u00edm prostoru <code>default<\/code> budou m\u00edt p\u0159\u00edstup k pod\u016fm <code>Postgres<\/code> v jmenn\u00e9m prostoru <code>database<\/code>. Ale co kdy\u017e chcete otev\u0159\u00edt p\u0159\u00edstup pouze konkr\u00e9tn\u00edm pod\u2019m v pracovn\u00edm prostoru <code>Postgres<\/code> pouze konkr\u00e9tn\u00edm pod\u016fm ve jmenn\u00e9m prostoru <code>default<\/code>?<\/p>\n<h2>Filtr podle jmenn\u00fdch prostor\u016f a pod\u016f<\/h2>\n<p>\npomoc\u00ed logick\u00e9ho A. Vypad\u00e1 to n\u00e1sledovn\u011b: <code>namespaceSelector<\/code> a <code>podSelector<\/code> apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: database.postgres\n  namespace: database\nspec:\n  podSelector:\n    matchLabels:\n      app: postgres\n  ingress:\n  - from:\n    - namespaceSelector:\n        matchLabels:\n          namespace: default\n      podSelector: # &lt;&lt;&lt;\n        matchLabels:\n          app: admin\n  policyTypes:\n  - Ingress<\/p>\n<pre><code class=\"plaintext\">Pro\u010d je to interpretov\u00e1no jako A m\u00edsto obvykl\u00e9ho NEBO?<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do s\u00ed\u0165ov\u00fdch politik Kubernetes pro odborn\u00edky na zabezpe\u010den\u00ed\" src=\"\/wp-content\/uploads\/2019\/04\/e933e449d9f9c10505e45930d1477b2c.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nneza\u010d\u00edn\u00e1 poml\u010dkou. V YAML to znamen\u00e1, \u017ee<\/p>\n<p>V\u0161imn\u011bte si, \u017ee <code>podSelector<\/code> a to, co je p\u0159ed n\u00edm <code>podSelector<\/code> se vztahuj\u00ed na stejn\u00fd prvek seznamu. Proto se kombinuj\u00ed logick\u00fdm A. <code>namespaceSelector<\/code> P\u0159id\u00e1n\u00ed poml\u010dky p\u0159ed<\/p>\n<p>P\u0159id\u00e1n\u00ed poml\u010dky p\u0159ed <code>podSelector<\/code> povede k vytvo\u0159en\u00ed nov\u00e9ho prvku seznamu, kter\u00fd se bude kombinovat s p\u0159edchoz\u00edm <code>namespaceSelector<\/code> pomoc\u00ed logick\u00e9ho NEBO.<\/p>\n<p>Aby bylo mo\u017en\u00e9 vybrat pody se specifick\u00fdm \u0161t\u00edtkem <b>ve v\u0161ech prostor\u00e1ch n\u00e1zv\u016f<\/b>, zadejte pr\u00e1zdn\u00fd <code>namespaceSelector<\/code>:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: database.postgres\n  namespace: database\nspec:\n  podSelector:\n    matchLabels:\n      app: postgres\n  ingress:\n  - from:\n    - namespaceSelector: {}\n      podSelector:\n        matchLabels:\n          app: admin\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do s\u00ed\u0165ov\u00fdch politik Kubernetes pro odborn\u00edky na zabezpe\u010den\u00ed\" src=\"\/wp-content\/uploads\/2019\/04\/e79e4a8067fa254f85fa8be105c3ad34.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>V\u00edcen\u00e1sobn\u00e9 zna\u010dky se kombinuj\u00ed s A<\/h2>\n<p>\nPravidla pro firewall se spoustou objekt\u016f (hostitel\u00e9, s\u00edt\u011b, skupiny) se kombinuj\u00ed pomoc\u00ed logick\u00e9ho NEBO. N\u00e1sleduj\u00edc\u00ed pravidlo se spust\u00ed, pokud zdroj paketu odpov\u00edd\u00e1 <code>Host_1<\/code> NEBO <code>Host_2<\/code>:<\/p>\n<pre><code class=\"plaintext\">| Source | Destination | Service | Action |\n| ----------------------------------------|\n| Host_1 | Subnet_A    | HTTPS   | Allow  |\n| Host_2 |             |         |        |\n| ----------------------------------------|<\/code><\/pre>\n<p>\nNaopak, v Kubernetes se r\u016fzn\u00e9 zna\u010dky v <code>podSelector<\/code> nebo <code>namespaceSelector<\/code> kombinuj\u00ed logick\u00fdm A. Nap\u0159\u00edklad n\u00e1sleduj\u00edc\u00ed pravidlo vybere pod\u2019y, kter\u00e9 maj\u00ed ob\u011b zna\u010dky, <code>role=db<\/code> A <code>version=v2<\/code>:<\/p>\n<pre><code class=\"plaintext\">podSelector:\n  matchLabels:\n    role: db\n    version: v2<\/code><\/pre>\n<p>\nStejn\u00e1 logika se aplikuje na v\u0161echny typy oper\u00e1tor\u016f: selektory c\u00edlov\u00fdch politik, selektory pod\u016f a selektory jmenn\u00fdch prostor\u016f.<\/p>\n<h2>Podniky a IP adresy (IPBlocks)<\/h2>\n<p>\nPro segmentaci s\u00edt\u011b firewally pou\u017e\u00edvaj\u00ed VLAN, IP adresy a pods\u00edt\u011b.<\/p>\n<p>V Kubernetes jsou IP adresy p\u0159id\u011blov\u00e1ny pod\u016fm automaticky a mohou se \u010dasto m\u011bnit, proto se pro v\u00fdb\u011br pod\u016f a jmenn\u00fdch prostor\u016f v s\u00ed\u0165ov\u00fdch politik\u00e1ch pou\u017e\u00edvaj\u00ed \u0161t\u00edtky.<\/p>\n<p>Pods\u00edt\u011b (<code>ipBlocks<\/code>) se pou\u017e\u00edvaj\u00ed p\u0159i \u0159\u00edzen\u00ed p\u0159\u00edchoz\u00edch (ingress) nebo odchoz\u00edch (egress) extern\u00edch (North-South) p\u0159ipojen\u00ed. Nap\u0159\u00edklad tato politika otev\u00edr\u00e1 v\u0161em pod\u016fm z jmenn\u00e9ho prostoru <code>default<\/code> k DNS slu\u017eb\u011b Google:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: egress-dns\n  namespace: default\nspec:\n  podSelector: {}\n  policyTypes:\n  - Egress\n  egress:\n  - to:\n    - ipBlock:\n        cidr: 8.8.8.8\/32\n    ports:\n    - protocol: UDP\n      port: 53<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do s\u00ed\u0165ov\u00fdch politik Kubernetes pro odborn\u00edky na zabezpe\u010den\u00ed\" src=\"\/wp-content\/uploads\/2019\/04\/42e1194e28331e667a094f19c88e0934.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPr\u00e1zdn\u00fd selektor pod\u016f v tomto p\u0159\u00edkladu znamen\u00e1 \u201evybrat v\u0161echny pody ve jmenn\u00e9m prostoru\u201c.<\/p>\n<p>Tato politika otev\u00edr\u00e1 p\u0159\u00edstup pouze k 8.8.8.8; p\u0159\u00edstup k jak\u00e9koli jin\u00e9 IP je zak\u00e1z\u00e1n. T\u00edmto zp\u016fsobem jste v podstat\u011b zablokovali p\u0159\u00edstup k intern\u00ed slu\u017eb\u011b DNS Kubernetes. Pokud ji v\u0161ak chcete otev\u0159\u00edt, uve\u010fte to v\u00fdslovn\u011b.<\/p>\n<p>Obvykle <code>ipBlocks<\/code> a <code>podSelectors<\/code> jsou vz\u00e1jemn\u011b exkluzivn\u00ed, proto\u017ee intern\u00ed IP adresy pod\u016f se nepou\u017e\u00edvaj\u00ed v <code>ipBlocks<\/code>. Uveden\u00edm <b>intern\u00ed IP pod\u016f<\/b>, ve skute\u010dnosti povol\u00edte p\u0159ipojen\u00ed k\/od pod\u016f s t\u011bmito adresami. V praxi nebudete v\u011bd\u011bt, kterou IP adresu pou\u017e\u00edt, a proto by se nem\u011bly pou\u017e\u00edvat k v\u00fdb\u011bru pod\u016f.<\/p>\n<p>Jako protiklad tato politika zahrnuje v\u0161echny IP a t\u00edm p\u00e1dem povoluje p\u0159\u00edstup ke v\u0161em ostatn\u00edm pod\u016fm:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: egress-any\n  namespace: default\nspec:\n  podSelector: {}\n  policyTypes:\n  - Egress\n  egress:\n  - to:\n    - ipBlock:\n        cidr: 0.0.0.0\/0<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do s\u00ed\u0165ov\u00fdch politik Kubernetes pro odborn\u00edky na zabezpe\u010den\u00ed\" src=\"\/wp-content\/uploads\/2019\/04\/d99dfdead1c96b071b1643cb5c572878.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nM\u016f\u017eete povolit p\u0159\u00edstup pouze k extern\u00edm IP, s vylou\u010den\u00edm intern\u00edch IP adres pod\u016f. Nap\u0159\u00edklad pokud je pods\u00ed\u0165 va\u0161eho podu 10.16.0.0\/14:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: egress-any\n  namespace: default\nspec:\n  podSelector: {}\n  policyTypes:\n  - Egress\n  egress:\n  - to:\n    - ipBlock:\n        cidr: 0.0.0.0\/0\n        except:\n        - 10.16.0.0\/14<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do s\u00ed\u0165ov\u00fdch politik Kubernetes pro odborn\u00edky na zabezpe\u010den\u00ed\" src=\"\/wp-content\/uploads\/2019\/04\/b157cfe0f1cd4677cf0defd9fdfa8a13.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Porty a protokoly<\/h2>\n<p>\nObvykle pody naslouchaj\u00ed jednomu portu. To znamen\u00e1, \u017ee nen\u00ed nutn\u00e9 uv\u00e1d\u011bt \u010d\u00edsla port\u016f v politik\u00e1ch a nechat v\u0161e jako v\u00fdchoz\u00ed. Nicm\u00e9n\u011b, politiky by m\u011bly b\u00fdt co nejv\u00edce restriktivn\u00ed, tak\u017ee v n\u011bkter\u00fdch p\u0159\u00edpadech m\u016f\u017ee b\u00fdt p\u0159esto u\u017eite\u010dn\u00e9 uv\u00e1d\u011bt porty:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.postgres\n  namespace: default\nspec:\n  ingress:\n  - from:\n    - podSelector:\n        matchLabels:\n          app: indexer\n    - podSelector:\n        matchLabels:\n          app: admin\n    ports:             # &lt;&lt;&lt;\n      - port: 443      # &lt;&lt;&lt;\n        protocol: TCP  # &lt;&lt;&lt;\n      - port: 80       # &lt;&lt;&lt;\n        protocol: TCP  # &lt;&lt;&lt;\n  podSelector:\n    matchLabels:\n      app: postgres\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do s\u00ed\u0165ov\u00fdch politik Kubernetes pro odborn\u00edky na zabezpe\u010den\u00ed\" src=\"\/wp-content\/uploads\/2019\/04\/4c778cd46c54e2ae0f4527ffa9e1e740.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nV\u0161imn\u011bte si, \u017ee selektor <code>ports<\/code> se aplikuje na v\u0161echny prvky v bloku <code>to<\/code> nebo <code>from<\/code>, ve kter\u00e9m se nach\u00e1z\u00ed. Abyste uvedli r\u016fzn\u00e9 porty pro r\u016fzn\u00e9 sady prvk\u016f, rozd\u011blte <code>ingress<\/code> nebo <code>egress<\/code> na n\u011bkolik podoblast\u00ed s <code>to<\/code> nebo <code>from<\/code> a v ka\u017ed\u00e9 uve\u010fte sv\u00e9 porty:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.postgres\n  namespace: default\nspec:\n  ingress:\n  - from:\n    - podSelector:\n        matchLabels:\n          app: indexer\n    ports:             # &lt;&lt;&lt;\n     - port: 443       # &lt;&lt;&lt;\n       protocol: TCP   # &lt;&lt;&lt;\n  - from:\n    - podSelector:\n        matchLabels:\n          app: admin\n    ports:             # &lt;&lt;&lt;\n     - port: 80        # &lt;&lt;&lt;\n       protocol: TCP   # &lt;&lt;&lt;\n  podSelector:\n    matchLabels:\n      app: postgres\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do s\u00ed\u0165ov\u00fdch politik Kubernetes pro odborn\u00edky na zabezpe\u010den\u00ed\" src=\"\/wp-content\/uploads\/2019\/04\/b9ac1d8af491e992cac0be184005a278.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nFunkce port\u016f podle v\u00fdchoz\u00edho nastaven\u00ed:<\/p>\n<ul>\n<li> Pokud zcela vynech\u00e1te definici port\u016f (<code>ports<\/code>), znamen\u00e1 to v\u0161echny protokoly a v\u0161echny porty;<\/li>\n<li> Pokud vynech\u00e1te definici protokolu (<code>protocol<\/code>), znamen\u00e1 to TCP;<\/li>\n<li> Pokud vynech\u00e1te definici portu (<code>port<\/code>), znamen\u00e1 to v\u0161echny porty.<\/li>\n<\/ul>\n<p>\nNejlep\u0161\u00ed praxe: nespolehejte se na v\u00fdchoz\u00ed hodnoty, zadejte, co pot\u0159ebujete, jasn\u011b.<\/p>\n<p>V\u0161imn\u011bte si, \u017ee je t\u0159eba pou\u017e\u00edvat porty pod\u016f, nikoli slu\u017eeb (v\u00edce o tom v n\u00e1sleduj\u00edc\u00edm odstavci).<\/p>\n<h2>Jsou politiky definov\u00e1ny pro pady nebo slu\u017eby?<\/h2>\n<p>\nObvykle se pady v Kubernetes navz\u00e1jem oslovuj\u00ed p\u0159es slu\u017eby \u2014 virtu\u00e1ln\u00ed vyrovn\u00e1va\u010de z\u00e1t\u011b\u017ee, kter\u00e9 p\u0159esm\u011brov\u00e1vaj\u00ed provoz na pody, kter\u00e9 slu\u017ebu implementuj\u00ed. M\u016f\u017eete si myslet, \u017ee s\u00ed\u0165ov\u00e9 politiky omezuj\u00ed p\u0159\u00edstup k slu\u017eb\u00e1m, ale to tak nen\u00ed. <b>S\u00ed\u0165ov\u00e9 politiky Kubernetes pracuj\u00ed s porty pod\u016f, nikoli slu\u017eeb.<\/b><\/p>\n<p>Nap\u0159\u00edklad pokud slu\u017eba naslouch\u00e1 na portu 80, ale p\u0159esm\u011brov\u00e1v\u00e1 provoz na port 8080 sv\u00fdch pod\u016f, je v s\u00ed\u0165ov\u00e9 politice t\u0159eba uv\u00e9st pr\u00e1v\u011b 8080.<\/p>\n<p>Takov\u00fd mechanismus je t\u0159eba pova\u017eovat za suboptim\u00e1ln\u00ed: p\u0159i zm\u011bn\u00e1ch v intern\u00ed struktu\u0159e slu\u017eby (porty, kter\u00e9 naslouchaj\u00ed pady) bude nutn\u00e9 aktualizovat s\u00ed\u0165ov\u00e9 politiky.<\/p>\n<p>Nov\u00fd architektonick\u00fd p\u0159\u00edstup pomoc\u00ed Service Mesh <i>(nap\u0159\u00edklad viz Istio n\u00ed\u017ee \u2014 pozn. p\u0159ekl.)<\/i> umo\u017e\u0148uje tuto problematiku vy\u0159e\u0161it.<\/p>\n<h2>Je t\u0159eba specifikovat jak Ingress, tak Egress?<\/h2>\n<p>\nKr\u00e1tk\u00e1 odpov\u011b\u010f \u2014 ano, aby se pod A mohl spojit s pod B, je t\u0159eba mu povolit vytv\u00e1\u0159en\u00ed v\u00fdstupn\u00edho spojen\u00ed (k tomu je nutn\u00e9 nastavit egress politiku), a pod B mus\u00ed m\u00edt mo\u017enost p\u0159ij\u00edmat p\u0159\u00edchoz\u00ed spojen\u00ed (k tomu je zapot\u0159eb\u00ed ingress politika).<\/p>\n<p>V praxi se v\u0161ak m\u016f\u017eete spolehnout na v\u00fdchoz\u00ed politiku, kter\u00e1 povoluje spojen\u00ed v jednom nebo obou sm\u011brech.<\/p>\n<p>Pokud je ur\u010dit\u00fd pod<b>zdroj<\/b> vybr\u00e1n jednou nebo v\u00edce <b>egress<\/b>-politiky, budou omezen\u00ed na n\u011bj uvalen\u00e1 ur\u010dena jejich disjunkc\u00ed. V tomto p\u0159\u00edpad\u011b je t\u0159eba explicitn\u011b povolit p\u0159ipojen\u00ed k podu-<b>adres\u00e1tovi<\/b>. Pokud pod nen\u00ed vybr\u00e1n \u017e\u00e1dnou politikou, jeho v\u00fdstupn\u00ed (egress) provoz je ve v\u00fdchoz\u00edm nastaven\u00ed povolen.<\/p>\n<p>Podobn\u00fdm zp\u016fsobem bude osud pod\u016f-<b>adres\u00e1ta<\/b>, vybran\u00e9ho jednou nebo v\u00edce <b>ingress<\/b>-politiky ur\u010dovat jejich disjunkce. V tomto p\u0159\u00edpad\u011b je t\u0159eba v\u00fdslovn\u011b povolit p\u0159\u00edstup k provozu z podu-zdroje. Pokud nen\u00ed pod vybr\u00e1n \u017e\u00e1dnou politikou, je ve\u0161ker\u00fd p\u0159\u00edchoz\u00ed (ingress) provoz pro n\u011bj ve v\u00fdchoz\u00edm nastaven\u00ed povolen.<\/p>\n<p>Viz bod \u201eStateful nebo Stateless\u201c n\u00ed\u017ee.<\/p>\n<h2>Logy<\/h2>\n<p>\nS\u00ed\u0165ov\u00e9 politiky Kubernetes neum\u00ed logovat provoz. To komplikuje ur\u010den\u00ed, zda politika funguje spr\u00e1vn\u011b, a zna\u010dn\u011b zt\u011b\u017euje anal\u00fdzu v oblasti bezpe\u010dnosti.<\/p>\n<h2>Kontrola nad provozem k extern\u00edm slu\u017eb\u00e1m<\/h2>\n<p>\nKubernetes s\u00ed\u0165ov\u00e9 politiky neumo\u017e\u0148uj\u00ed uv\u00e9st plnohodnotn\u00e9 dom\u00e9nov\u00e9 jm\u00e9no (DNS) v sekc\u00edch egress. Tento fakt zp\u016fsobuje zna\u010dn\u00e9 pot\u00ed\u017ee p\u0159i pokusu o omezen\u00ed provozu na extern\u00ed adres\u00e1ty bez pevn\u00e9 IP adresy (nap\u0159\u00edklad aws.com).<\/p>\n<h2>Kontrola politiky<\/h2>\n<p>\nFirewall v\u00e1s upozorn\u00ed nebo dokonce odm\u00edtne p\u0159ijmout chybovou politiku. Kubernetes tak\u00e9 prov\u00e1d\u00ed ur\u010ditou verifikaci. P\u0159i zad\u00e1v\u00e1n\u00ed s\u00ed\u0165ov\u00e9 politiky p\u0159es kubectl m\u016f\u017ee Kubernetes prohl\u00e1sit, \u017ee je \u0161patn\u00e1, a odm\u00edtnout ji p\u0159ijmout. V jin\u00fdch p\u0159\u00edpadech Kubernetes politiku p\u0159ijme a dopln\u00ed ji o chyb\u011bj\u00edc\u00ed detaily. Ty lze zobrazit pomoc\u00ed p\u0159\u00edkazu:<\/p>\n<pre><code class=\"plaintext\">kubernetes get networkpolicy  -o yaml<\/code><\/pre>\n<p>\nM\u011bjte na pam\u011bti, \u017ee syst\u00e9m kontroly Kubernetes nen\u00ed neomyln\u00fd a m\u016f\u017ee propustit n\u011bkter\u00e9 typy chyb.<\/p>\n<h2>Prov\u00e1d\u011bn\u00ed<\/h2>\n<p>\nKubernetes sama s\u00ed\u0165ov\u00e9 politiky neimplementuje, ale slou\u017e\u00ed jako API br\u00e1na, kter\u00e1 p\u0159en\u00e1\u0161\u00ed n\u00e1ro\u010dnou pr\u00e1ci na \u0159\u00edzen\u00ed na podkladov\u00fd syst\u00e9m zvan\u00fd Container Networking Interface (CNI). Nastaven\u00ed politik v clusterech Kubernetes bez p\u0159i\u0159azen\u00ed odpov\u00eddaj\u00edc\u00edho CNI je podobn\u00e9 jako vytv\u00e1\u0159en\u00ed politik na spr\u00e1vce firewallu bez jejich n\u00e1sledn\u00e9 instalace do firewall\u016f. Mus\u00edte se sami ujistit o p\u0159\u00edtomnosti kvalitn\u00edho CNI nebo, v p\u0159\u00edpad\u011b cloudov\u00fdch Kubernetes platforem, <i>(se seznamem poskytovatel\u016f m\u016f\u017eete sezn\u00e1mit <noindex>zde<\/noindex> \u2014 pozn. p\u0159.)<\/i>, aktivovat s\u00ed\u0165ov\u00e9 politiky, kter\u00e9 CNI nastav\u00ed za v\u00e1s.<\/p>\n<p>V\u0161imn\u011bte si, \u017ee Kubernetes v\u00e1s neupozorn\u00ed, pokud nastav\u00edte s\u00ed\u0165ovou politiku bez odpov\u00eddaj\u00edc\u00edho pomocn\u00e9ho CNI.<\/p>\n<h3>Stavov\u00fd nebo stateless?<\/h3>\n<p>\nV\u0161echny CNI Kubernetes, se kter\u00fdmi jsem se setkal, uchov\u00e1vaj\u00ed stav (nap\u0159\u00edklad Calico pou\u017e\u00edv\u00e1 Linux conntrack). To umo\u017e\u0148uje podu z\u00edsk\u00e1vat odpov\u011bdi na TCP spojen\u00ed, kter\u00e9 inicioval, ani\u017e by bylo nutn\u00e9 jej znovu navazovat. P\u0159itom nev\u00edm o \u017e\u00e1dn\u00e9m standardu Kubernetes, kter\u00fd by zaru\u010doval uchov\u00e1v\u00e1n\u00ed stavu.<\/p>\n<h2>Pokro\u010dil\u00e9 \u0159\u00edzen\u00ed bezpe\u010dnostn\u00ed politiky<\/h2>\n<p>\nZde je n\u011bkolik zp\u016fsob\u016f, jak zv\u00fd\u0161it efektivitu prov\u00e1d\u011bn\u00ed bezpe\u010dnostn\u00ed politiky v Kubernetes:<\/p>\n<ol>\n<li> Architektonick\u00fd vzor Service Mesh vyu\u017e\u00edv\u00e1 sidecar kontejnery k zaji\u0161t\u011bn\u00ed podrobn\u00e9 telemetrie a kontroly provozu na \u00farovni slu\u017eeb. P\u0159\u00edkladem m\u016f\u017ee b\u00fdt <noindex><a rel=\"nofollow\" href=\"https:\/\/istio.io\/\">Istio<\/a><\/noindex>.<\/li>\n<li> N\u011bkte\u0159\u00ed poskytovatel\u00e9 CNI roz\u0161\u00ed\u0159ili sv\u00e9 n\u00e1stroje tak, aby p\u0159es\u00e1hly r\u00e1mec s\u00ed\u0165ov\u00fdch politik Kubernetes.<\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.tufin.com\/products\/tufin-orca\">Tufin Orca<\/a><\/noindex> zaru\u010duje transparentnost a automatizaci s\u00ed\u0165ov\u00fdch politik Kubernetes.<\/li>\n<\/ol>\n<p>\nBal\u00ed\u010dek Tufin Orca spravuje s\u00ed\u0165ov\u00e9 politiky Kubernetes (a slou\u017e\u00ed jako zdroj obrazovek, kter\u00e9 byly uvedeny v\u00fd\u0161e).<\/p>\n<h2>Dal\u0161\u00ed informace<\/h2>\n<p><\/p>\n<ul>\n<li> <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/ahmetb\/kubernetes-network-policy-recipes\">P\u0159\u00edklady s\u00ed\u0165ov\u00fdch politik p\u0159ipraven\u00fdch Ahmetem Alpem Balkanem z GKE<\/a><\/noindex>;<\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"https:\/\/kubernetes.io\/docs\/concepts\/services-networking\/network-policies\/\">Dokumentace z ofici\u00e1ln\u00edch str\u00e1nek Kubernetes<\/a><\/noindex>;<\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"https:\/\/sookocheff.com\/post\/kubernetes\/understanding-kubernetes-networking-model\/\">P\u0159\u00edru\u010dka k s\u00ed\u0165ov\u00e9mu modelu Kubernetes<\/a><\/noindex>;<\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/Tufin\/test-network-policies\">Skript pro kontrolu s\u00ed\u0165ov\u00fdch politik<\/a><\/noindex>.<\/li>\n<\/ul>\n<p><\/p>\n<h2>Z\u00e1v\u011br<\/h2>\n<p>\nS\u00ed\u0165ov\u00e9 politiky Kubernetes nab\u00edzej\u00ed slu\u0161nou sadu n\u00e1stroj\u016f pro segmentaci cluster\u016f, ale jsou intuitivn\u011b nesrozumiteln\u00e9 a maj\u00ed mnoho nuanc\u00ed. Domn\u00edv\u00e1m se, \u017ee kv\u016fli t\u00e9to slo\u017eitosti obsahuje mnoho existuj\u00edc\u00edch cluster\u016f chyby. Mo\u017en\u00fdmi \u0159e\u0161en\u00edmi t\u00e9to situace jsou automatizace definic politik nebo pou\u017eit\u00ed jin\u00fdch prost\u0159edk\u016f segmentace.<\/p>\n<p>Douf\u00e1m, \u017ee tato p\u0159\u00edru\u010dka pom\u016f\u017ee objasnit n\u011bkter\u00e9 ot\u00e1zky a vy\u0159e\u0161it probl\u00e9my, se kter\u00fdmi se m\u016f\u017eete setkat.<\/p>\n<h2>P.S. od p\u0159ekladatele<\/h2>\n<p>\nP\u0159e\u010dt\u011bte si tak\u00e9 n\u00e1\u0161 blog:<\/p>\n<ul>\n<li> \u201eZp\u011bt k mikroslu\u017eb\u00e1m s Istio\u201c: <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/438426\/\">\u010d\u00e1st 1 (sezn\u00e1men\u00ed se s hlavn\u00edmi funkcemi)<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/440378\/\">\u010d\u00e1st 2 (sm\u011brov\u00e1n\u00ed, spr\u00e1va provozu)<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/443668\/\">\u010d\u00e1st 3 (bezpe\u010dnost)<\/a><\/noindex>;<\/li>\n<li> \u010d\u00e1st 1 a 2 (s\u00ed\u0165ov\u00fd model, overlay s\u00edt\u011b) <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/346304\/\">\u010d\u00e1st 3 (slu\u017eby a zpracov\u00e1n\u00ed provozu)<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/433382\/\">V aplikaci Play Store byla p\u0159id\u00e1na podpora pro tmav\u00fd re\u017eim<\/a><\/noindex>;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/440504\/\">Docker a Kubernetes v prost\u0159ed\u00edch citliv\u00fdch na bezpe\u010dnost<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/436300\/\">9 nejlep\u0161\u00edch praktik pro zaji\u0161t\u011bn\u00ed bezpe\u010dnosti v Kubernetes<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/417905\/\">11 zp\u016fsob\u016f, jak (ne)se st\u00e1t ob\u011bt\u00ed hacknut\u00ed v Kubernetes<\/a><\/noindex>\u00bb.<\/li>\n<\/ul>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/443190\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u0438\u043c. \u043f\u0435\u0440\u0435\u0432.: \u0410\u0432\u0442\u043e\u0440 \u0441\u0442\u0430\u0442\u044c\u0438 \u2014 Reuven Harrison \u2014 \u0438\u043c\u0435\u0435\u0442 \u0431\u043e\u043b\u0435\u0435 20 \u043b\u0435\u0442 \u043e\u043f\u044b\u0442\u0430 \u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f, \u0430 \u043d\u0430 \u0441\u0435\u0433\u043e\u0434\u043d\u044f\u0448\u043d\u0438\u0439 \u0434\u0435\u043d\u044c \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u043c \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u043e\u043c \u0438 \u0441\u043e\u0443\u0447\u0440\u0435\u0434\u0438\u0442\u0435\u043b\u0435\u043c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Tufin, \u0441\u043e\u0437\u0434\u0430\u044e\u0449\u0435\u0439 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430\u043c\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0420\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u044f \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 Kubernetes \u043a\u0430\u043a \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043c\u043e\u0449\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e \u0434\u043b\u044f \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0438 \u0432 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0435, \u043e\u043d \u0432 \u0442\u043e \u0436\u0435 \u0432\u0440\u0435\u043c\u044f \u0441\u0447\u0438\u0442\u0430\u0435\u0442, \u0447\u0442\u043e \u043e\u043d\u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":24432,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-32641","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0440\u0438\u043c.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/vvedenie-v-setevye-politiki-kubernetes-dlya-spetsialistov-po-bezopasnosti\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0432 \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 Kubernetes \u0434\u043b\u044f \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u043e\u0432 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0440\u0438\u043c.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/vvedenie-v-setevye-politiki-kubernetes-dlya-spetsialistov-po-bezopasnosti\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:48:11+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:48:11+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u00davod do s\u00ed\u0165ov\u00fdch politik Kubernetes pro bezpe\u010dnostn\u00ed specialisty | ProHoster","description":"Pozn.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/vvedenie-v-setevye-politiki-kubernetes-dlya-spetsialistov-po-bezopasnosti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0432 \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 Kubernetes \u0434\u043b\u044f \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u043e\u0432 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 | ProHoster","og:description":"\u041f\u0440\u0438\u043c.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/vvedenie-v-setevye-politiki-kubernetes-dlya-spetsialistov-po-bezopasnosti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:48:11+00:00","article:modified_time":"2019-10-31T18:48:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"32641","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 11:53:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:55:23","updated":"2026-01-21 11:53:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/32641","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=32641"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/32641\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/24432"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=32641"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=32641"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=32641"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}