{"id":32641,"date":"2019-10-31T21:48:11","date_gmt":"2019-10-31T18:48:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/vvedenie-v-setevye-politiki-kubernetes-dlya-spetsialistov-po-bezopasnosti\/"},"modified":"2019-10-31T21:48:11","modified_gmt":"2019-10-31T18:48:11","slug":"vvedenie-v-setevye-politiki-kubernetes-dlya-spetsialistov-po-bezopasnosti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/vvedenie-v-setevye-politiki-kubernetes-dlya-spetsialistov-po-bezopasnosti","title":{"rendered":"Kubernetes'e v\u00f5rgupoliitikas tutvumine turvaekspertidele","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Kubernetes&#039;e v\u00f5rgupoliitikas tutvumine turvaekspertidele\" src=\"\/wp-content\/uploads\/2019\/04\/6972a1e1385463b1fcc723c09036a565.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i><b>M\u00e4rk. t\u00f5lge.<\/b>: Artikli autor Reuven Harrisonil on \u00fcle 20 aasta tarkvaraarenduse kogemust ning ta on praegu Tufini tehniline direktor ja kaasasutaja, mis loob turvapoliitikate haldamise lahendusi. Vaadates Kubernetes'e v\u00f5rgu poliitikaid kui piisavalt v\u00f5imekat vahendit v\u00f5rgu segmentimiseks klastris, peab ta samas neid praktikas rakendamiseks keerukateks. K\u00e4esolev materjal (p\u00e4ris mahukas) on m\u00f5eldud spetsialistide teadlikkuse t\u00f5stmiseks selles k\u00fcsimuses ja aitama neil luua vajalikke konfiguratsioone.<\/i><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>T\u00e4nap\u00e4eval valivad \u00fcha rohkem ettev\u00f5tteid Kubernetes'e oma rakenduste k\u00e4ivitamiseks. Huvi selle tarkvara vastu on nii suur, et osa inimesi nimetab Kubernetes'e 'uueks operatsioonis\u00fcsteemiks andmekeskustes'. Aja jooksul hakka Kubernetes (v\u00f5i k8s) olema tajutud kui kriitiliselt oluline osa \u00e4rist, mis vajab k\u00fcpsete \u00e4ri protsesside korraldamist, sealhulgas v\u00f5rgu turvalisuse tagamist.<\/p>\n<p>K\u00fcbergansside spetsialistidele v\u00f5ib Kubernetes'i platvormi vaikimisi poliitika, mis lubab k\u00f5ike, osutuda t\u00f5eliselt avardavaks.<\/p>\n<p>See juhend aitab m\u00f5ista v\u00f5rgu poliitikate sisemist toimimist; selgitades, kuidas need erinevad tavaliste tulem\u00fc\u00fcri reeglitega. Tutvustatakse ka m\u00f5ningaid l\u00f5kse ja antakse soovitusi, mis aitavad kaitsta rakendusi Kubernetes'is.<\/p>\n<h2>Kubernetes'i v\u00f5rgu poliitikad<\/h2>\n<p>\nKubernetes'i v\u00f5rgu poliitikate mehhanism v\u00f5imaldab hallata platvormil tegevuses olevate rakenduste vahelist suhtlemist v\u00f5rgutasemel (OSi mudeli kolmas tase). V\u00f5rgu poliitikad ei paku m\u00f5ningaid moodsate tulem\u00fc\u00fcride edasij\u00f5udnud funktsioone, nagu seitsmenda OSi tasandi kontroll ja ohu avastamine, kuid need tagavad p\u00f5hitaseme v\u00f5rgu turvalisuse, olles hea alguspunkt.<\/p>\n<h2>\u0421\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u044e\u0442 \u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u0438 \u043c\u0435\u0436\u0434\u0443 pod&#8217;\u0430\u043c\u0438<\/h2>\n<p>\n\u0420\u0430\u0431\u043e\u0447\u0438\u0435 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0432 Kubernetes \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u044e\u0442\u0441\u044f \u043f\u043e pod\u2019\u0430\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u043e\u0441\u0442\u043e\u044f\u0442 \u0438\u0437 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u043b\u0438 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432, \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u0442\u044b\u0445 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e. Kubernetes \u043f\u0440\u0438\u0441\u0432\u0430\u0438\u0432\u0430\u0435\u0442 \u043a\u0430\u0436\u0434\u043e\u043c\u0443 pod\u2019\u0443 IP-\u0430\u0434\u0440\u0435\u0441, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0439 \u0438\u0437 \u0434\u0440\u0443\u0433\u0438\u0445 pod&#8217;\u043e\u0432. \u0421\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 Kubernetes \u0437\u0430\u0434\u0430\u044e\u0442 \u043f\u0440\u0430\u0432\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0434\u043b\u044f \u0433\u0440\u0443\u043f\u043f pod&#8217;\u043e\u0432 \u0442\u0430\u043a\u0438\u043c \u0436\u0435 \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u043a\u0430\u043a \u0433\u0440\u0443\u043f\u043f\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432 \u043e\u0431\u043b\u0430\u043a\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u043a \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u0430\u043c \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d.<\/p>\n<h2>V\u00f5rgu poliitikate m\u00e4\u00e4ratlemine<\/h2>\n<p>\nNagu k\u00f5ik muud Kubernetes'i ressursid, m\u00e4\u00e4ratakse v\u00f5rgu poliitikad YAML keeles. J\u00e4rgnevas n\u00e4ites rakendusele <code>balance<\/code> antakse juurdep\u00e4\u00e4s <code>postgres<\/code>:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.postgres\n  namespace: default\nspec:\n  podSelector:\n    matchLabels:\n      app: postgres\n  ingress:\n  - from:\n    - podSelector:\n        matchLabels:\n          app: balance\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Kubernetes&#039;e v\u00f5rgupoliitikas tutvumine turvaekspertidele\" src=\"\/wp-content\/uploads\/2019\/04\/ff5857af2641e62558b035bab9c413dc.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>(<b>M\u00e4rk. t\u00f5lge.<\/b>: see ekraanipilt, nagu ka k\u00f5ik j\u00e4rgmised sarnased, on loodud mitte Kubernetes'i natiivsete vahenditega, vaid t\u00f6\u00f6riista Tufin Orca abil, mille arendamise taga on ettev\u00f5te, kes on originaali autori ning mis mainitakse materjali l\u00f5pus.<\/i><\/p>\n<p>Oma v\u00f5rgu poliitika m\u00e4\u00e4ratlemiseks on vajalik p\u00f5hiteadmised YAML-ist. See keel p\u00f5hineb sisu jaotamisel (mille m\u00e4\u00e4ravad t\u00fchikud, mitte tabulaatorid). Idendi t\u00e4hendusega elemendi alluvus tuleneb l\u00e4himast sama taseme elemendist. Uus loendi element algab kriipsuga, k\u00f5ik teised elemendid on kujul. <i>v\u00f5ti-v\u00e4\u00e4rtus<\/i>.<\/p>\n<p>YAML-is poliitika kirjeldamisel kasutage <noindex><a rel=\"nofollow\" href=\"https:\/\/kubernetes.io\/docs\/reference\/kubectl\/kubectl\/\">kubectl<\/a><\/noindex>, et luua see klusteris:<\/p>\n<pre><code class=\"bash\">kubectl create -f policy.yaml<\/code><\/pre>\n<p><\/p>\n<h2>V\u00f5rgu poliitika spetsifikatsioon<\/h2>\n<p>\nKubernetes'i v\u00f5rgu poliitika spetsifikatsioon h\u00f5lmab nelja elementi:<\/p>\n<ol>\n<li> <code>podSelector<\/code>: \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u0435\u0442 pod&#8217;\u044b, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u044d\u0442\u043e\u0439 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u043e\u0439 (\u0446\u0435\u043b\u0438) \u2014 \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0439;<\/li>\n<li> <code>policyTypes<\/code>: n\u00e4itab, milliseid poliitikate t\u00fc\u00fcpe see h\u00f5lmab: ingress ja\/v\u00f5i egress \u2014 valikuline, kuid soovitan seda k\u00f5igis juhtudel selgelt m\u00e4rgata;<\/li>\n<li> <code>ingress<\/code>: m\u00e4\u00e4ratleb lubatud <b>sissevoolu<\/b> \u0442\u0440\u0430\u0444\u0438\u043a \u0432 \u0446\u0435\u043b\u0435\u0432\u044b\u0435 pod&#8217;\u044b \u2014 \u043d\u0435\u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0439;<\/li>\n<li> <code>egress<\/code>: m\u00e4\u00e4ratleb lubatud <b>v\u00e4ljaminev<\/b> \u0442\u0440\u0430\u0444\u0438\u043a \u0438\u0437 \u0446\u0435\u043b\u0435\u0432\u044b\u0445 pod&#8217;\u043e\u0432 \u2014 \u043d\u0435\u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0439.<\/li>\n<\/ol>\n<p>\nN\u00e4ide, mis on laenatud Kubernetes'i saidilt (ma asendasin <code>role<\/code> j\u00e4rgnevaga <code>app<\/code>), n\u00e4itab, kuidas kasutatakse k\u00f5ik neli elementi:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: test-network-policy\n  namespace: default\nspec:\n  podSelector:    # &lt;&lt;&lt;&lt;\n    matchLabels:\n      app: db\n  policyTypes:    # &lt;&lt;&lt;&lt;\n  - Ingress\n  - Egress\n  ingress:        # &lt;&lt;&lt;&lt;\n  - from:\n    - ipBlock:\n        cidr: 172.17.0.0\/16\n        except:\n        - 172.17.1.0\/24\n    - namespaceSelector:\n        matchLabels:\n          project: myproject\n    - podSelector:\n        matchLabels:\n          role: frontend\n    ports:\n    - protocol: TCP\n      port: 6379\n  egress:         # &lt;&lt;&lt;&lt;\n  - to:\n    - ipBlock:\n        cidr: 10.0.0.0\/24\n    ports:\n    - protocol: TCP\n      port: 5978<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Kubernetes&#039;e v\u00f5rgupoliitikas tutvumine turvaekspertidele\" src=\"\/wp-content\/uploads\/2019\/04\/f01e748410564756d6272095093e52e2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<img decoding=\"async\" alt=\"Kubernetes&#039;e v\u00f5rgupoliitikas tutvumine turvaekspertidele\" src=\"\/wp-content\/uploads\/2019\/04\/997282073ee6b5c4d6b7af45cdc11295.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPange t\u00e4hele, et k\u00f5igi nelja elementi kaasamine ei ole kohustuslik. Kohustuslik on ainult <code>podSelector<\/code>, \u00fclej\u00e4\u00e4nud parameetreid v\u00f5ib kasutada vastavalt soovile.<\/p>\n<p>Kui j\u00e4tta v\u00e4lja <code>policyTypes<\/code>, t\u00f5lgendatakse poliitikat j\u00e4rgmiselt:<\/p>\n<ul>\n<li> Eeldatakse, et see m\u00e4\u00e4ratleb ingress-poole. Kui poliitikas ei ole selgeid juhiseid, loetakse, et kogu liiklus on keelatud.<\/li>\n<li> Egress-poole k\u00e4itumist m\u00e4\u00e4ratakse vastava egress-parameetri olemasolu v\u00f5i puudumisega.<\/li>\n<\/ul>\n<p>\nVigade v\u00e4ltimiseks soovitan <b>alati selgelt n\u00e4idata <code>policyTypes<\/code><\/b>.<\/p>\n<p>\u00dclaltoodud loogika kohaselt, kui parameetrid <code>ingress<\/code> ja\/v\u00f5i <code>egress<\/code> j\u00e4etakse v\u00e4lja, keelab poliitika kogu liikluse (vt \"Koristamisreeglit\" allpool).<\/p>\n<h2>Vaikimisi poliitika \u2014 lubada<\/h2>\n<p>\n\u0415\u0441\u043b\u0438 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u043d\u0435 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u044b, Kubernetes \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u0435\u0442 \u0432\u0435\u0441\u044c \u0442\u0440\u0430\u0444\u0438\u043a. \u0412\u0441\u0435 pod&#8217;\u044b \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e \u043c\u043e\u0433\u0443\u0442 \u043e\u0431\u043c\u0435\u043d\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0435\u0439 \u043c\u0435\u0436\u0434\u0443 \u0441\u043e\u0431\u043e\u0439. \u0421 \u0442\u043e\u0447\u043a\u0438 \u0437\u0440\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u044d\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u044c\u0441\u044f \u043d\u0435\u043b\u043e\u0433\u0438\u0447\u043d\u044b\u043c, \u043d\u043e \u0432\u0441\u043f\u043e\u043c\u043d\u0438\u0442\u0435 \u043e \u0442\u043e\u043c, \u0447\u0442\u043e Kubernetes \u0438\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u043b\u0441\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c\u0438 \u0441 \u0446\u0435\u043b\u044c\u044e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0442\u044c \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439. \u0421\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u0431\u044b\u043b\u0438 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u044b \u043f\u043e\u0437\u0436\u0435.<\/p>\n<h2>Nimekirjad<\/h2>\n<p>\nNimekirjad (Namespaces) on Kubernetes\u2019i koost\u00f6\u00f6 mehhanism. Need on ette n\u00e4htud loogiliste keskkondade \u00fcksteisest eristamiseks, samal ajal kui andmevahetus nimekirjade vahel on vaikimisi lubatud.<\/p>\n<p>Nagu enamus Kubernetes\u2019i komponente, elavad v\u00f5rgupoliitikad teatud nimekirjas. Plokis <code>metadata<\/code> saab m\u00e4\u00e4rata, millisele nimekirjale poliitika kuulub:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: test-network-policy\n  namespace: my-namespace  # &lt;&lt;&lt;\nspec:\n...<\/code><\/pre>\n<p>\nKui nimekirja metainformatsioonis ei ole selgelt m\u00e4\u00e4ratud, kasutab s\u00fcsteem kubectl\u2019is m\u00e4rgitud nimekirja (vaikimisi <code>namespace=default<\/code>):<\/p>\n<pre><code class=\"bash\">kubectl apply -n my-namespace -f namespace.yaml<\/code><\/pre>\n<p>\nSoovitan <b>selgelt m\u00e4\u00e4rata nimekirja<\/b>, kui te ei kirjuta poliitikat, mis on m\u00f5eldud kohe mitmele nimede ruumile.<\/p>\n<p><b>Peamine<\/b> element <code>podSelector<\/code> \u0432 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0435 \u0431\u0443\u0434\u0435\u0442 \u0432\u044b\u0431\u0438\u0440\u0430\u0442\u044c pod\u2019\u044b \u0438\u0437 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u0438\u043c\u0435\u043d, \u043a \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u043f\u0440\u0438\u043d\u0430\u0434\u043b\u0435\u0436\u0438\u0442 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430 (\u043e\u043d \u043b\u0438\u0448\u0435\u043d \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a pod&#8217;\u0430\u043c \u0438\u0437 \u0434\u0440\u0443\u0433\u043e\u0433\u043e \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u0438\u043c\u0451\u043d).<\/p>\n<p>\u0410\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c podSelector&#8217;\u044b <b>ingress ja egress plokkides<\/b> v\u00f5ivad valida pod'e ainult oma nimede ruumist, v\u00e4lja arvatud juhul, kui te \u00fchendate need <code>namespaceSelector'iga<\/code> (\u043e\u0431 \u044d\u0442\u043e\u043c \u043f\u043e\u0439\u0434\u0435\u0442 \u0440\u0435\u0447\u044c \u0432 \u0440\u0430\u0437\u0434\u0435\u043b\u0435 \u00ab\u0424\u0438\u043b\u044c\u0442\u0440 \u043f\u043e \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430\u043c \u0438\u043c\u0435\u043d \u0438 pod&#8217;\u0430\u043c\u00bb).<\/p>\n<h2>Poliitikate nimetamise reeglid<\/h2>\n<p>\nPoliitikate nimed on \u00fches nimede ruumis ainulaadsed. Kahel poliitikal ei saa olla sama nime \u00fches ruumis, kuid erinevates ruumides v\u00f5ivad olla poliitikad sama nimega. See on mugav, kui soovite sama poliitikat mitu korda rakendada.<\/p>\n<p>Mulle meeldib eriti \u00fcks nimetamisviis. See seisneb nimede ruumi ja sihip\u00e4raste pod'ide \u00fchendamises. N\u00e4iteks:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.postgres  # &lt;&lt;&lt;\n  namespace: default\nspec:\n  podSelector:\n    matchLabels:\n      app: postgres\n  ingress:\n  - from:\n    - podSelector:\n        matchLabels:\n          app: admin\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Kubernetes&#039;e v\u00f5rgupoliitikas tutvumine turvaekspertidele\" src=\"\/wp-content\/uploads\/2019\/04\/18318c320d6e37eeb01c51f251550639.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Sildid<\/h2>\n<p>\nKubernetesi objektidele, nagu pod-id ja nimed, saab lisada kohandatud silte. Sildid (<i>labels<\/i> \u2014 etiketid) on sarnased p\u00e4istele pilves. Kubernetesi v\u00f5rgupoliitikad kasutavad silte valimiseks <b>pod&#8217;\u043e\u0432<\/b>, millele need rakendatakse:<\/p>\n<pre><code class=\"plaintext\">podSelector:\n  matchLabels:\n    role: db<\/code><\/pre>\n<p>\n\u2026 v\u00f5i <b>nimed<\/b>, \u043a \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u043e\u043d\u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u044e\u0442\u0441\u044f. \u0412 \u044d\u0442\u043e\u043c \u043f\u0440\u0438\u043c\u0435\u0440\u0435 \u0432\u044b\u0431\u0438\u0440\u0430\u044e\u0442\u0441\u044f \u0432\u0441\u0435 pod&#8217;\u044b \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430\u0445 \u0438\u043c\u0435\u043d \u0441 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u043c\u0438 \u043b\u0435\u0439\u0431\u043b\u0430\u043c\u0438:<\/p>\n<pre><code class=\"plaintext\">namespaceSelector:\n  matchLabels:\n    project: myproject<\/code><\/pre>\n<p>\n\u00dcks hoiatus: kasutamisel <code>namespaceSelector'iga<\/code> <b>veenduge, et valitud nimed sisaldavad vajalikke silte<\/b>. Pidage meeles, et vaikimisi nimed, nagu <code>default<\/code> ja <code>kube-system<\/code>, ei sisalda endas silte.<\/p>\n<p>Nime lisamiseks nimele v\u00f5ite teha j\u00e4rgmist:<\/p>\n<pre><code class=\"bash\">kubectl label namespace default namespace=default<\/code><\/pre>\n<p>\nSiiski peab nimi jaotises <code>metadata<\/code> viitama tegelikule nimele, mitte sildile:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: test-network-policy\n  namespace: default   # &lt;&lt;&lt;\nspec:\n...<\/code><\/pre>\n<p><\/p>\n<h2>Allikas ja adressaat<\/h2>\n<p>\n\u041f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u0434\u043b\u044f \u0431\u0440\u0430\u043d\u0434\u043c\u0430\u0443\u044d\u0440\u043e\u0432 \u0441\u043e\u0441\u0442\u043e\u044f\u0442 \u0438\u0437 \u043f\u0440\u0430\u0432\u0438\u043b \u0441 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430\u043c\u0438 \u0438 \u0430\u0434\u0440\u0435\u0441\u0430\u0442\u0430\u043c\u0438. \u0421\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 Kubernetes \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u044e\u0442\u0441\u044f \u0434\u043b\u044f \u0446\u0435\u043b\u0438 \u2014 \u043d\u0430\u0431\u043e\u0440\u0430 \u0438\u0437 pod&#8217;\u043e\u0432, \u043a \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u043e\u043d\u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u044e\u0442\u0441\u044f, \u0430 \u0437\u0430\u0442\u0435\u043c \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u044e\u0442 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0434\u043b\u044f \u0432\u0445\u043e\u0434\u044f\u0449\u0435\u0433\u043e (ingress) \u0438\/\u0438\u043b\u0438 \u0438\u0441\u0445\u043e\u0434\u044f\u0449\u0435\u0433\u043e (egress) \u0442\u0440\u0430\u0444\u0438\u043a\u0430. \u0412 \u043d\u0430\u0448\u0435\u043c \u043f\u0440\u0438\u043c\u0435\u0440\u0435 \u0446\u0435\u043b\u044c\u044e \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u0431\u0443\u0434\u0443\u0442 \u0432\u0441\u0435 pod\u2019\u044b \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u0438\u043c\u0435\u043d <code>default<\/code> m\u00e4rgisega, mille v\u00f5tme <code>app<\/code> ja v\u00e4\u00e4rtusega <code>db<\/code>:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: test-network-policy\n  namespace: default\nspec:\n  podSelector:\n    matchLabels:\n      app: db   # &lt;&lt;&lt;\n  policyTypes:\n  - Ingress\n  - Egress\n  ingress:\n  - from:\n    - ipBlock:\n        cidr: 172.17.0.0\/16\n        except:\n        - 172.17.1.0\/24\n    - namespaceSelector:\n        matchLabels:\n          project: myproject\n    - podSelector:\n        matchLabels:\n          role: frontend\n    ports:\n    - protocol: TCP\n      port: 6379\n  egress:\n  - to:\n    - ipBlock:\n        cidr: 10.0.0.0\/24\n    ports:\n    - protocol: TCP\n      port: 5978<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Kubernetes&#039;e v\u00f5rgupoliitikas tutvumine turvaekspertidele\" src=\"\/wp-content\/uploads\/2019\/04\/5fcb3f78e26ae1ed5635541ad69ef69f.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<img decoding=\"async\" alt=\"Kubernetes&#039;e v\u00f5rgupoliitikas tutvumine turvaekspertidele\" src=\"\/wp-content\/uploads\/2019\/04\/c753f559ecc3ba54f8b55e29851428c4.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAlam <code>ingress<\/code> selles poliitikas avab sissetulev liiklus sihitud pod'idesse. Teisis\u00f5nu, ingress on allikas, samas kui sihtm\u00e4rk on vastav sihtkoht. Sarnaselt on egress sihtkoht, samas kui sihtm\u00e4rk on selle allikas.<\/p>\n<p><img decoding=\"async\" alt=\"Kubernetes&#039;e v\u00f5rgupoliitikas tutvumine turvaekspertidele\" src=\"\/wp-content\/uploads\/2019\/04\/a0d865de57a7620849074424770832cd.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>See on ekvivalent kahe reegliga tulem\u00fc\u00fcrile: Ingress \u2192 Sihtm\u00e4rk; Sihtm\u00e4rk \u2192 Egress.<\/i><\/p>\n<h2>Egress ja DNS (t\u00e4htis!)<\/h2>\n<p>\nPiirates v\u00e4ljuvat liiklust, <b>p\u00f6\u00f6rake erilist t\u00e4helepanu DNS-ile<\/b> \u2014 Kubernetes kasutab seda teenust teenuste sidumiseks IP-aadressidega. N\u00e4iteks j\u00e4rgmine poliitika ei t\u00f6\u00f6ta, kuna te ei ole lubanud rakendusel <code>balance<\/code> P\u00f6\u00f6rduda DNS-i poole:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.balance\n  namespace: default\nspec:\n  podSelector:\n    matchLabels:\n      app: balance\n  egress:\n  - to:\n    - podSelector:\n        matchLabels:\n          app: postgres\n  policyTypes:\n  - Egress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Kubernetes&#039;e v\u00f5rgupoliitikas tutvumine turvaekspertidele\" src=\"\/wp-content\/uploads\/2019\/04\/5857a44cc5e06de708f0d3b5b0f49628.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSeda saab parandada, avades juurdep\u00e4\u00e4su DNS-teenusele:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.balance\n  namespace: default\nspec:\n  podSelector:\n    matchLabels:\n      app: balance\n  egress:\n  - to:\n    - podSelector:\n        matchLabels:\n          app: postgres\n  - to:               # &lt;&lt;&lt;\n    ports:            # &lt;&lt;&lt;\n    - protocol: UDP   # &lt;&lt;&lt;\n      port: 53        # &lt;&lt;&lt;\n  policyTypes:\n  - Egress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Kubernetes&#039;e v\u00f5rgupoliitikas tutvumine turvaekspertidele\" src=\"\/wp-content\/uploads\/2019\/04\/a396bb2ae94fca94c3b62aef2cb07552.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nViimane element <code>to<\/code> \u2014 t\u00fchi, ja seet\u00f5ttu valib see kaudset <b>\u0432\u0441\u0435 pod&#8217;\u044b \u0432\u043e \u0432\u0441\u0435\u0445 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430\u0445 \u0438\u043c\u0435\u043d<\/b>, lubades <code>balance<\/code> saata DNS-p\u00e4ringud vastavasse Kubernetes teenusesse (tavaliselt t\u00f6\u00f6tab see ruumis <code>kube-system<\/code>).<\/p>\n<p>See l\u00e4henemine t\u00f6\u00f6tab, kuid see <b>on \u00fclem\u00e4\u00e4ra lubav ja ebaturvaline<\/b>, kuna v\u00f5imaldab suunata DNS-p\u00e4ringud klastrist v\u00e4lja.<\/p>\n<p>Seda saab t\u00e4iustada kolme j\u00e4rjestikuse sammuga.<\/p>\n<p>1. Lubada DNS-p\u00e4ringud ainult <b>sisemine<\/b> klastri, lisades <code>namespaceSelector'iga<\/code>:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.balance\n  namespace: default\nspec:\n  podSelector:\n    matchLabels:\n      app: balance\n  egress:\n  - to:\n    - podSelector:\n        matchLabels:\n          app: postgres\n  - to:\n    - namespaceSelector: {} # &lt;&lt;&lt;\n    ports:\n    - protocol: UDP\n      port: 53\n  policyTypes:\n  - Egress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Kubernetes&#039;e v\u00f5rgupoliitikas tutvumine turvaekspertidele\" src=\"\/wp-content\/uploads\/2019\/04\/5920a043229676e0780d691d302c5ade.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n2. Lubage DNS-p\u00e4ringud ainult nimede ruumis <code>kube-system<\/code>.<\/p>\n<p>Selleks tuleb lisada silt nime ruumi <code>kube-system<\/code>: <code>kubectl label namespace kube-system namespace=kube-system<\/code> \u2014 ja m\u00e4\u00e4rata see poliitikasse kasutades <code>namespaceSelector'iga<\/code>:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.balance\n  namespace: default\nspec:\n  podSelector:\n    matchLabels:\n      app: balance\n  egress:\n  - to:\n    - podSelector:\n        matchLabels:\n          app: postgres\n  - to:\n    - namespaceSelector:         # &lt;&lt;&lt;\n        matchLabels:             # &lt;&lt;&lt;\n          namespace: kube-system # &lt;&lt;&lt;\n    ports:\n    - protocol: UDP\n      port: 53\n  policyTypes:\n  - Egress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Kubernetes&#039;e v\u00f5rgupoliitikas tutvumine turvaekspertidele\" src=\"\/wp-content\/uploads\/2019\/04\/2a1dd0975c58e6d277baffc7c3ac6e48.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n3. Paranoikud v\u00f5ivad minna veelgi kaugemale ja piirata DNS-p\u00e4ringuid konkreetse DNS-teenusega <code>kube-system<\/code>. \u0412 \u0440\u0430\u0437\u0434\u0435\u043b\u0435 \u00ab\u0424\u0438\u043b\u044c\u0442\u0440 \u043f\u043e \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430\u043c \u0438\u043c\u0435\u043d \u0418 pod&#8217;\u0430\u043c\u00bb \u0431\u0443\u0434\u0435\u0442 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043d\u043e, \u043a\u0430\u043a \u044d\u0442\u043e\u0433\u043e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f.<\/p>\n<p>Teine v\u00f5imalus on lubada DNS nime ruumi tasemel. Sel juhul ei pea seda avama iga teenuse jaoks:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.dns\n  namespace: default\nspec:\n  podSelector: {} # &lt;&lt;&lt;\n  egress:\n  - to:\n    - namespaceSelector: {}\n    ports:\n    - protocol: UDP\n      port: 53\n  policyTypes:\n  - Egress<\/code><\/pre>\n<p>\nT\u00fchi <code>podSelector<\/code> valib k\u00f5ik pod'id nimede ruumis.<\/p>\n<p><img decoding=\"async\" alt=\"Kubernetes&#039;e v\u00f5rgupoliitikas tutvumine turvaekspertidele\" src=\"\/wp-content\/uploads\/2019\/04\/5d6b627b69da980477b3910fbf4de6c1.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Esimene vastavus ja reeglite j\u00e4rjekord<\/h2>\n<p>\nTavalistes tulem\u00fc\u00fcrides m\u00e4\u00e4rab paketi tegevuse (\"Lubada\" v\u00f5i \"Keelata\") esimene reegel, millele see vastab. <b>Kuberneteses ei oma poliitikate j\u00e4rjekord mingit t\u00e4htsust.<\/b><\/p>\n<p>\u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, \u043a\u043e\u0433\u0434\u0430 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u043d\u0435 \u0437\u0430\u0434\u0430\u043d\u044b, \u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u0438 \u043c\u0435\u0436\u0434\u0443 pod&#8217;\u0430\u043c\u0438 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u044b \u0438 \u043e\u043d\u0438 \u043c\u043e\u0433\u0443\u0442 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e \u043e\u0431\u043c\u0435\u043d\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0435\u0439. \u041a\u0430\u043a \u0442\u043e\u043b\u044c\u043a\u043e \u0432\u044b \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442\u0435 \u0444\u043e\u0440\u043c\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438, \u043a\u0430\u0436\u0434\u044b\u0439 pod, \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0439 \u0445\u043e\u0442\u044f \u0431\u044b \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u043d\u0438\u0445, \u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u0441\u044f \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0432 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0438 \u0441 \u0434\u0438\u0437\u044a\u044e\u043d\u043a\u0446\u0438\u0435\u0439 (\u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0438\u043c \u0418\u041b\u0418) \u0432\u0441\u0435\u0445 \u043f\u043e\u043b\u0438\u0442\u0438\u043a, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0435\u0433\u043e \u0432\u044b\u0431\u0440\u0430\u043b\u0438. Pod\u2019\u044b, \u043d\u0435 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0435 \u043a\u0430\u043a\u043e\u0439-\u043b\u0438\u0431\u043e \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u043e\u0439, \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c\u0438.<\/p>\n<p>Sarnast k\u00e4itumist saab muuta puhastamisreegliga.<\/p>\n<h2>Puhastamisreegel (\"Keelata\")<\/h2>\n<p>\nTulem\u00fc\u00fcride poliitikad keelavad tavaliselt iga asjaolu, mis ei ole selgelt lubatud.<\/p>\n<p><b>Kuberneteses ei ole \"keelata\" (deny) tegevust<\/b>, \u043e\u0434\u043d\u0430\u043a\u043e \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u043e\u0433\u043e \u044d\u0444\u0444\u0435\u043a\u0442\u0430 \u043c\u043e\u0436\u043d\u043e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0441 \u043e\u0431\u044b\u0447\u043d\u043e\u0439 (\u0440\u0430\u0437\u0440\u0435\u0448\u0430\u044e\u0449\u0435\u0439) \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u043e\u0439, \u0432\u044b\u0431\u0440\u0430\u0432 \u043f\u0443\u0441\u0442\u0443\u044e \u0433\u0440\u0443\u043f\u043f\u0443 pod&#8217;\u043e\u0432-\u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u0432 (ingress):<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: deny-all\n  namespace: default\nspec:\n  podSelector: {}\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Kubernetes&#039;e v\u00f5rgupoliitikas tutvumine turvaekspertidele\" src=\"\/wp-content\/uploads\/2019\/04\/8b3ced50ec5a1de70940d53f467966fe.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u042d\u0442\u0430 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430 \u0432\u044b\u0431\u0438\u0440\u0430\u0435\u0442 \u0432\u0441\u0435 pod&#8217;\u044b \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u0438\u043c\u0435\u043d \u0438 \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 ingress \u043d\u0435\u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u043c, \u0437\u0430\u043f\u0440\u0435\u0449\u0430\u044f \u0432\u0435\u0441\u044c \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439 \u0442\u0440\u0430\u0444\u0438\u043a.<\/p>\n<p>Sarnasel moel saab piirata kogu v\u00e4ljaminevat liiklust nimede ruumist:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: deny-all-egress\n  namespace: default\nspec:\n  podSelector: {}\n  policyTypes:\n  - Egress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Kubernetes&#039;e v\u00f5rgupoliitikas tutvumine turvaekspertidele\" src=\"\/wp-content\/uploads\/2019\/04\/be22e11efef0098f2665331c09d748f2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPange t\u00e4hele, et <b>\u043b\u044e\u0431\u044b\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438, \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u044e\u0449\u0438\u0435 \u0442\u0440\u0430\u0444\u0438\u043a \u043a pod&#8217;\u0430\u043c \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u0438\u043c\u0435\u043d, \u0431\u0443\u0434\u0443\u0442 \u0438\u043c\u0435\u0442\u044c \u043f\u0440\u0438\u043e\u0440\u0438\u0442\u0435\u0442 \u043d\u0430\u0434 \u044d\u0442\u0438\u043c \u043f\u0440\u0430\u0432\u0438\u043b\u043e\u043c<\/b> (sarnane lubava reegli lisamisega enne keelavat reeglit tulem\u00fc\u00fcris).<\/p>\n<h2>Luba k\u00f5ik (Any-Any-Any-Allow)<\/h2>\n<p>\nKuna luua poliitika \u00abLuba k\u00f5ik\u00bb, on soovitatav t\u00e4iendada \u00fclaltoodud keelu poliitikat t\u00fchja elemendiga <code>ingress<\/code>:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: allow-all\n  namespace: default\nspec:\n  podSelector: {}\n  ingress: # &lt;&lt;&lt;\n  - {}     # &lt;&lt;&lt;\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Kubernetes&#039;e v\u00f5rgupoliitikas tutvumine turvaekspertidele\" src=\"\/wp-content\/uploads\/2019\/04\/7322351493211388fe772b8dc270108d.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSee avab ligip\u00e4\u00e4su <b>\u0432\u0441\u0435\u0445 pod&#8217;\u043e\u0432 \u0432\u043e \u0432\u0441\u0435\u0445 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430\u0445 \u0438\u043c\u0435\u043d (\u0438 \u0432\u0441\u0435\u0445 IP) \u043a \u043b\u044e\u0431\u043e\u043c\u0443 pod\u2019\u0443 \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u0438\u043c\u0435\u043d <code>default<\/code><\/b>. Sarnane k\u00e4itumine on vaikimisi sisse l\u00fclitatud, seega tavaliselt ei ole seda vaja veelkord m\u00e4\u00e4ratleda. Siiski v\u00f5ib m\u00f5nikord olla vajalik ajutine teatud lubade keelamine probleemi t\u00f5rkeotsimiseks.<\/p>\n<p>Reegelit saab kitsendada ja lubada juurdep\u00e4\u00e4su ainult <b>\u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u043d\u0430\u0431\u043e\u0440\u0443 pod&#8217;\u043e\u0432<\/b> (<code>app:balance<\/code>) nimede ruumis <code>default<\/code>:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: allow-all-to-balance\n  namespace: default\nspec:\n  podSelector:\n    matchLabels:\n      app: balance\n  ingress: \n  - {}\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Kubernetes&#039;e v\u00f5rgupoliitikas tutvumine turvaekspertidele\" src=\"\/wp-content\/uploads\/2019\/04\/d8c9cb85003f489acec815d1c2b53497.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nJ\u00e4rgmine poliiitika lubab kogu sissetulevat (ingress) ja v\u00e4ljaminevat (egress) liiklust, sealhulgas juurdep\u00e4\u00e4su mis tahes IP-le klastrist v\u00e4ljaspool:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: allow-all\nspec:\n  podSelector: {}\n  ingress:\n  - {}\n  egress:\n  - {}\n  policyTypes:\n  - Ingress\n  - Egress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Kubernetes&#039;e v\u00f5rgupoliitikas tutvumine turvaekspertidele\" src=\"\/wp-content\/uploads\/2019\/04\/2477f18d3d228f80bc5169d9ec3be2fc.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<img decoding=\"async\" alt=\"Kubernetes&#039;e v\u00f5rgupoliitikas tutvumine turvaekspertidele\" src=\"\/wp-content\/uploads\/2019\/04\/3502b892713cdac8850e812b2eff3ea3.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Mitmete poliitikate \u00fchendamine<\/h2>\n<p>\n\u041f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u044f\u044e\u0442\u0441\u044f \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0418\u041b\u0418 \u043d\u0430 \u0442\u0440\u0435\u0445 \u0443\u0440\u043e\u0432\u043d\u044f\u0445; \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u044f \u043a\u0430\u0436\u0434\u043e\u0433\u043e pod&#8217;\u0430 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u0432 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0438 \u0441 \u0434\u0438\u0437\u044a\u044e\u043d\u043a\u0446\u0438\u0435\u0439 \u0432\u0441\u0435\u0445 \u043f\u043e\u043b\u0438\u0442\u0438\u043a, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0435\u0433\u043e \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442:<\/p>\n<p>1. Valdkondades <code>from<\/code> ja <code>to<\/code> saab m\u00e4\u00e4rata kolme t\u00fc\u00fcpi elemente (k\u00f5ik need kombineeritakse loogilise OR abil):<\/p>\n<ul>\n<li> <code>namespaceSelector'iga<\/code> \u2014 valib nimede ruumi t\u00e4ielikult;<\/li>\n<li> <code>podSelector<\/code> \u2014 valib pod'id;<\/li>\n<li> <code>ipBlock<\/code> \u2014 valib alamv\u00f5rgu.<\/li>\n<\/ul>\n<p>\nSellega on elementide arv (isegi samade) osade hulgas <code>from<\/code>\/<code>to<\/code> piiratud. K\u00f5ik need \u00fchendatakse loogilise OR abil.<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.postgres\n  namespace: default\nspec:\n  ingress:\n  - from:\n    - podSelector:\n        matchLabels:\n          app: indexer\n    - podSelector:\n        matchLabels:\n          app: admin\n  podSelector:\n    matchLabels:\n      app: postgres\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Kubernetes&#039;e v\u00f5rgupoliitikas tutvumine turvaekspertidele\" src=\"\/wp-content\/uploads\/2019\/04\/717e745720f39260a8508fb2b2bb6f65.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n2. Poliitika sees <code>ingress<\/code> v\u00f5ib sisaldada mitmeid elemente <code>from<\/code> (need \u00fchendatakse loogilise V\u00d5I-tega). Sarnaselt v\u00f5ib osa <code>egress<\/code> sisaldada mitmeid elemente <code>to<\/code> (need \u00fchendatakse samuti disjunktsiooniga):<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.postgres\n  namespace: default\nspec:\n  ingress:\n  - from:\n    - podSelector:\n        matchLabels:\n          app: indexer\n  - from:\n    - podSelector:\n        matchLabels:\n          app: admin\n  podSelector:\n    matchLabels:\n      app: postgres\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Kubernetes&#039;e v\u00f5rgupoliitikas tutvumine turvaekspertidele\" src=\"\/wp-content\/uploads\/2019\/04\/b579e1f4b97acd92fb38cd6703aa1983.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n3. Erinevad poliitikad \u00fchendatakse samuti loogilise V\u00d5I-tega<\/p>\n<p>Ent nende \u00fchendamise puhul on \u00fcks piirang, millele <noindex><a rel=\"nofollow\" href=\"https:\/\/medium.com\/sainsburys-engineering\/considerations-with-k8s-networkpolicy-cee7eacf5469\">et<\/a><\/noindex> <noindex><a rel=\"nofollow\" href=\"https:\/\/medium.com\/@chriscooney\">Chris Cooney<\/a><\/noindex>: Kubernetes suudab kombineerida poliitikaid ainult erinevate <code>policyTypes<\/code> (<code>Ingress<\/code> v\u00f5i <code>Egress<\/code>). Poliitikad, mis m\u00e4\u00e4ratlevad ingress (v\u00f5i egress), kirjutavad \u00fcksteist \u00fcle.<\/p>\n<h2>Nimekiri ruumide vahel<\/h2>\n<p>\nVaikimisi on teabevahetus nimekiri ruumide vahel lubatud. Seda saab muuta piirava poliitikaga, mis piirab v\u00e4ljaminevat ja\/ v\u00f5i sisenevat liiklust nimekirja ruumis (vt \"Puhastusreegel\" \u00fclal).<\/p>\n<p>Blokeerides juurdep\u00e4\u00e4su nimeserverisse (vt \u201eKorrigeerimise reegel\u201c \u00fcleval), saate teha erandeid keelu poliitikas, lubades \u00fchendusi kindlast nimeserverist. <code>namespaceSelector'iga<\/code>:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: database.postgres\n  namespace: database\nspec:\n  podSelector:\n    matchLabels:\n      app: postgres\n  ingress:\n  - from:\n    - namespaceSelector: # &lt;&lt;&lt;\n        matchLabels:\n          namespace: default\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Kubernetes&#039;e v\u00f5rgupoliitikas tutvumine turvaekspertidele\" src=\"\/wp-content\/uploads\/2019\/04\/5a3d2baed1ff9b813ef0651fe500ad8a.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTulemuseks on see, et k\u00f5ik pod'id nimeserveris <code>default<\/code> \u043f\u043e\u043b\u0443\u0447\u0430\u0442 \u0434\u043e\u0441\u0442\u0443\u043f \u043a pod&#8217;\u0430\u043c <code>postgres<\/code> nimeserveris <code>database<\/code>. Aga mis siis, kui soovite avada juurdep\u00e4\u00e4su <code>postgres<\/code> \u0442\u043e\u043b\u044c\u043a\u043e \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u044b\u043c pod&#8217;\u0430\u043c \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u0438\u043c\u0435\u043d <code>default<\/code>?<\/p>\n<h2>\u0424\u0438\u043b\u044c\u0442\u0440 \u043f\u043e \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430\u043c \u0438\u043c\u0435\u043d \u0418 pod&#8217;\u0430\u043c<\/h2>\n<p>\nKubernetes versioonis 1.11 ja k\u00f5rgem v\u00f5imaldab kombineerida operaatorid <code>namespaceSelector'iga<\/code> ja <code>podSelector<\/code> kasutades loogilist JA. See n\u00e4eb v\u00e4lja nii:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: database.postgres\n  namespace: database\nspec:\n  podSelector:\n    matchLabels:\n      app: postgres\n  ingress:\n  - from:\n    - namespaceSelector:\n        matchLabels:\n          namespace: default\n      podSelector: # &lt;&lt;&lt;\n        matchLabels:\n          app: admin\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Kubernetes&#039;e v\u00f5rgupoliitikas tutvumine turvaekspertidele\" src=\"\/wp-content\/uploads\/2019\/04\/e933e449d9f9c10505e45930d1477b2c.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nMiks see t\u00f5lgendatakse kui JA, mitte tavap\u00e4raseks V\u00d5I?<\/p>\n<p>Pange t\u00e4hele, et <code>podSelector<\/code> ei alga kriipsust. YAML-is t\u00e4hendab see, et <code>podSelector<\/code> ja selle ees <code>namespaceSelector'iga<\/code> kuuluvad samasse listi elementi. Seet\u00f5ttu liidetakse need loogilise JA-ga.<\/p>\n<p>Kriipsu lisamine enne <code>podSelector<\/code> toob endaga kaasa uue loendi elementi, mis kombineeritakse eelnevaga <code>namespaceSelector'iga<\/code> loogilise V\u00d5I abil.<\/p>\n<p>\u0427\u0442\u043e\u0431\u044b \u0432\u044b\u0431\u0440\u0430\u0442\u044c pod&#8217;\u044b \u0441 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u043c \u043b\u0435\u0439\u0431\u043b\u043e\u043c <b>k\u00f5igis nimede ruumides<\/b>, j\u00e4tke t\u00fchjaks <code>namespaceSelector'iga<\/code>:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: database.postgres\n  namespace: database\nspec:\n  podSelector:\n    matchLabels:\n      app: postgres\n  ingress:\n  - from:\n    - namespaceSelector: {}\n      podSelector:\n        matchLabels:\n          app: admin\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Kubernetes&#039;e v\u00f5rgupoliitikas tutvumine turvaekspertidele\" src=\"\/wp-content\/uploads\/2019\/04\/e79e4a8067fa254f85fa8be105c3ad34.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Mitmed sillad \u00fchendatakse V\u00d5I-ga<\/h2>\n<p>\nTulekahjus\u00fcsteemi reeglid mitme objekti (hostide, v\u00f5rkude, r\u00fchmade) jaoks kombineeritakse loogilise V\u00d5I abil. J\u00e4rgmine reegel rakendub, kui paketi allikas vastab <code>Host_1<\/code> V\u00d5I <code>Host_2<\/code>:<\/p>\n<pre><code class=\"plaintext\">| Allikas | Sihtkoht | Teenus | Tegevus |\n| ----------------------------------------|\n| Host_1 | Alams\u00fcsteem_A | HTTPS | Luba |\n| Host_2 |             |         |        |\n| ----------------------------------------|<\/code><\/pre>\n<p>\nTeiseks, Kubernetesis erinevad sillad <code>podSelector<\/code> v\u00f5i <code>namespaceSelector'iga<\/code> kombineeritakse loogilise JA abil. N\u00e4iteks j\u00e4rgmine reegel valib pod'e, millel on m\u00f5lemad sillad, <code>role=db<\/code> JA <code>version=v2<\/code>:<\/p>\n<pre><code class=\"plaintext\">podSelector:\n  matchLabels:\n    role: db\n    version: v2<\/code><\/pre>\n<p>\n\u0422\u0430 \u0436\u0435 \u043b\u043e\u0433\u0438\u043a\u0430 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u043a\u043e \u0432\u0441\u0435\u043c \u0442\u0438\u043f\u0430\u043c \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u043e\u0432: \u0441\u0435\u043b\u0435\u043a\u0442\u043e\u0440\u0430\u043c \u0446\u0435\u043b\u0435\u0439 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438, \u0441\u0435\u043b\u0435\u043a\u0442\u043e\u0440\u0430\u043c pod&#8217;\u043e\u0432 \u0438 \u0441\u0435\u043b\u0435\u043a\u0442\u043e\u0440\u0430\u043c \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432 \u0438\u043c\u0435\u043d.<\/p>\n<h2>Alams\u00fcsteemid ja IP-aadressid (IPBlocks)<\/h2>\n<p>\nVLAN-e, IP-aadresse ja alamv\u00f5rgud on brankd\u00fc\u00fcsi kasutamiseks v\u00f5rgu segmentimiseks.<\/p>\n<p>\u0412 Kubernetes IP-\u0430\u0434\u0440\u0435\u0441\u0430 \u043f\u0440\u0438\u0441\u0432\u0430\u0438\u0432\u0430\u044e\u0442\u0441\u044f pod&#8217;\u0430\u043c \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0438 \u043c\u043e\u0433\u0443\u0442 \u0447\u0430\u0441\u0442\u043e \u043c\u0435\u043d\u044f\u0442\u044c\u0441\u044f, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0434\u043b\u044f \u0432\u044b\u0431\u043e\u0440\u0430 pod&#8217;\u043e\u0432 \u0438 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432 \u0438\u043c\u0435\u043d \u0432 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430\u0445 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u043b\u0435\u0439\u0431\u043b\u044b.<\/p>\n<p>Alamv\u00f5rgud (<code>ipBlocks<\/code>) \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u043f\u0440\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0438 \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u043c\u0438 (ingress) \u0438\u043b\u0438 \u0438\u0441\u0445\u043e\u0434\u044f\u0449\u0438\u043c\u0438 (egress) \u0432\u043d\u0435\u0448\u043d\u0438\u043c\u0438 (North-South) \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f\u043c\u0438. \u041a \u043f\u0440\u0438\u043c\u0435\u0440\u0443, \u044d\u0442\u0430 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430 \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u0432\u0441\u0435\u043c pod&#8217;\u0430\u043c \u0438\u0437 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u0438\u043c\u0435\u043d <code>default<\/code> juurdep\u00e4\u00e4su Google'i DNS-teenusele:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: egress-dns\n  namespace: default\nspec:\n  podSelector: {}\n  policyTypes:\n  - Egress\n  egress:\n  - to:\n    - ipBlock:\n        cidr: 8.8.8.8\/32\n    ports:\n    - protocol: UDP\n      port: 53<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Kubernetes&#039;e v\u00f5rgupoliitikas tutvumine turvaekspertidele\" src=\"\/wp-content\/uploads\/2019\/04\/42e1194e28331e667a094f19c88e0934.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u041f\u0443\u0441\u0442\u043e\u0439 \u0441\u0435\u043b\u0435\u043a\u0442\u043e\u0440 pod&#8217;\u043e\u0432 \u0432 \u044d\u0442\u043e\u043c \u043f\u0440\u0438\u043c\u0435\u0440\u0435 \u043e\u0437\u043d\u0430\u0447\u0430\u0435\u0442 \u00ab\u0432\u044b\u0431\u0440\u0430\u0442\u044c \u0432\u0441\u0435 pod\u2019\u044b \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u0438\u043c\u0435\u043d\u00bb.<\/p>\n<p>See poliitika avab p\u00e4\u00e4su ainult 8.8.8.8; juurdep\u00e4\u00e4s mistahes muule IP-le on keelatud. Seega olete sisuliselt blokeerinud juurdep\u00e4\u00e4su Kubernetes'e sisemisele DNS-teenusele. Kui soovite selle avada, tehke seda selgelt.<\/p>\n<p>Tavaliselt <code>ipBlocks<\/code> ja <code>podSelectors<\/code> \u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0432\u0437\u0430\u0438\u043c\u043e\u0438\u0441\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0438\u043c\u0438, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0435 IP-\u0430\u0434\u0440\u0435\u0441\u0430 pod&#8217;\u043e\u0432 \u043d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0432 <code>ipBlocks<\/code>. M\u00e4\u00e4rates <b>\u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0435 IP pod&#8217;\u043e\u0432<\/b>, \u0432\u044b \u0444\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0440\u0430\u0437\u0440\u0435\u0448\u0438\u0442\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a\/\u043e\u0442 pod&#8217;\u043e\u0432 \u0441 \u044d\u0442\u0438\u043c\u0438 \u0430\u0434\u0440\u0435\u0441\u0430\u043c\u0438. \u041d\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0435 \u0432\u044b \u043d\u0435 \u0431\u0443\u0434\u0435\u0442\u0435 \u0437\u043d\u0430\u0442\u044c, \u043a\u0430\u043a\u043e\u0439 IP-\u0430\u0434\u0440\u0435\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c, \u0438\u043c\u0435\u043d\u043d\u043e \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0438\u0445 \u043d\u0435 \u0441\u0442\u043e\u0438\u0442 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c \u0434\u043b\u044f \u0432\u044b\u0431\u043e\u0440\u0430 pod&#8217;\u043e\u0432.<\/p>\n<p>\u0412 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043a\u043e\u043d\u0442\u0440-\u043f\u0440\u0438\u043c\u0435\u0440\u0430 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430 \u0432\u043a\u043b\u044e\u0447\u0430\u0435\u0442 \u0432\u0441\u0435 IP \u0438, \u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e, \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f \u043a\u043e \u0432\u0441\u0435\u043c \u0434\u0440\u0443\u0433\u0438\u043c pod&#8217;\u0430\u043c:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: egress-any\n  namespace: default\nspec:\n  podSelector: {}\n  policyTypes:\n  - Egress\n  egress:\n  - to:\n    - ipBlock:\n        cidr: 0.0.0.0\/0<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Kubernetes&#039;e v\u00f5rgupoliitikas tutvumine turvaekspertidele\" src=\"\/wp-content\/uploads\/2019\/04\/d99dfdead1c96b071b1643cb5c572878.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u041c\u043e\u0436\u043d\u043e \u043e\u0442\u043a\u0440\u044b\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0442\u043e\u043b\u044c\u043a\u043e \u043a \u0432\u043d\u0435\u0448\u043d\u0438\u043c IP, \u0438\u0441\u043a\u043b\u044e\u0447\u0438\u0432 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0435 IP-\u0430\u0434\u0440\u0435\u0441\u0430 pod&#8217;\u043e\u0432. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0435\u0441\u043b\u0438 \u043f\u043e\u0434\u0441\u0435\u0442\u044c \u0432\u0430\u0448\u0435\u0433\u043e pod&#8217;\u0430 10.16.0.0\/14:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: egress-any\n  namespace: default\nspec:\n  podSelector: {}\n  policyTypes:\n  - Egress\n  egress:\n  - to:\n    - ipBlock:\n        cidr: 0.0.0.0\/0\n        except:\n        - 10.16.0.0\/14<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Kubernetes&#039;e v\u00f5rgupoliitikas tutvumine turvaekspertidele\" src=\"\/wp-content\/uploads\/2019\/04\/b157cfe0f1cd4677cf0defd9fdfa8a13.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Pordid ja protokollid<\/h2>\n<p>\n\u041e\u0431\u044b\u0447\u043d\u043e pod&#8217;\u044b \u0441\u043b\u0443\u0448\u0430\u044e\u0442 \u043e\u0434\u0438\u043d \u043f\u043e\u0440\u0442. \u042d\u0442\u043e \u043e\u0437\u043d\u0430\u0447\u0430\u0435\u0442, \u0447\u0442\u043e \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u043e\u0441\u0442\u043e \u043d\u0435 \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0442\u044c \u043d\u043e\u043c\u0435\u0440\u0430 \u043f\u043e\u0440\u0442\u043e\u0432 \u0432 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430\u0445 \u0438 \u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0432\u0441\u0435 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u0412\u043f\u0440\u043e\u0447\u0435\u043c, \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u0434\u0435\u043b\u0430\u0442\u044c \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u043b\u0443\u0447\u0430\u044f\u0445 \u0432\u0441\u0435 \u0436\u0435 \u043c\u043e\u0436\u043d\u043e \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0442\u044c \u043f\u043e\u0440\u0442\u044b:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.postgres\n  namespace: default\nspec:\n  ingress:\n  - from:\n    - podSelector:\n        matchLabels:\n          app: indexer\n    - podSelector:\n        matchLabels:\n          app: admin\n    ports:             \n      - port: 443      \n        protocol: TCP  \n      - port: 80       \n        protocol: TCP  \n  podSelector:\n    matchLabels:\n      app: postgres\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Kubernetes&#039;e v\u00f5rgupoliitikas tutvumine turvaekspertidele\" src=\"\/wp-content\/uploads\/2019\/04\/4c778cd46c54e2ae0f4527ffa9e1e740.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nM\u00e4rge, et valija <code>ports<\/code> k\u00f5ikidele elementidele plokis <code>to<\/code> v\u00f5i <code>from<\/code>, kus see asub. Erinevate elementide koguste jaoks erinevate portide m\u00e4\u00e4ramiseks jagage <code>ingress<\/code> v\u00f5i <code>egress<\/code> mitmeks alajaoks koos <code>to<\/code> v\u00f5i <code>from<\/code> ja igas m\u00e4\u00e4rake oma pordid:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.postgres\n  namespace: default\nspec:\n  ingress:\n  - from:\n    - podSelector:\n        matchLabels:\n          app: indexer\n    ports:             \n     - port: 443       \n       protocol: TCP   \n  - from:\n    - podSelector:\n        matchLabels:\n          app: admin\n    ports:             \n     - port: 80        \n       protocol: TCP   \n  podSelector:\n    matchLabels:\n      app: postgres\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Kubernetes&#039;e v\u00f5rgupoliitikas tutvumine turvaekspertidele\" src=\"\/wp-content\/uploads\/2019\/04\/b9ac1d8af491e992cac0be184005a278.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPortide vaikimisi t\u00f6\u00f6:<\/p>\n<ul>\n<li> Kui j\u00e4tate pordi m\u00e4\u00e4ratlemise t\u00e4ielikult v\u00e4lja (<code>ports<\/code>), t\u00e4hendab see k\u00f5iki protokolle ja k\u00f5iki porte;<\/li>\n<li> Kui j\u00e4tate protokolli m\u00e4\u00e4ratlemise v\u00e4lja (<code>protocol<\/code>), t\u00e4hendab see TCP;<\/li>\n<li> Kui j\u00e4tate pordi (<code>port<\/code>) m\u00e4\u00e4ratlemise v\u00e4lja, t\u00e4hendab see k\u00f5iki porte.<\/li>\n<\/ul>\n<p>\nParim praktika: \u00e4rge toetuge vaikev\u00e4\u00e4rtustele, m\u00e4\u00e4rake vajalikud v\u00e4\u00e4rtused selgelt.<\/p>\n<p>\u041e\u0431\u0440\u0430\u0442\u0438\u0442\u0435 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435, \u0447\u0442\u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0440\u0442\u044b pod&#8217;\u043e\u0432, \u0430 \u043d\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 (\u043f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435 \u043e\u0431 \u044d\u0442\u043e\u043c \u0432 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u043c \u043f\u0430\u0440\u0430\u0433\u0440\u0430\u0444\u0435).<\/p>\n<h2>\u041f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u044b \u0434\u043b\u044f pod&#8217;\u043e\u0432 \u0438\u043b\u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432?<\/h2>\n<p>\n\u041e\u0431\u044b\u0447\u043d\u043e pod\u2019\u044b \u0432 Kubernetes \u043e\u0431\u0440\u0430\u0449\u0430\u044e\u0442\u0441\u044f \u0434\u0440\u0443\u0433 \u043a \u0434\u0440\u0443\u0433\u0443 \u0447\u0435\u0440\u0435\u0437 \u0441\u0435\u0440\u0432\u0438\u0441 \u2014 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0439 \u0431\u0430\u043b\u0430\u043d\u0441\u0438\u0440\u043e\u0432\u0449\u0438\u043a \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438, \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0442\u0440\u0430\u0444\u0438\u043a \u043a pod&#8217;\u0430\u043c, \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u044e\u0449\u0438\u043c \u0441\u0435\u0440\u0432\u0438\u0441. \u041c\u043e\u0436\u043d\u043e \u043f\u043e\u0434\u0443\u043c\u0430\u0442\u044c, \u0447\u0442\u043e \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u044e\u0442 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0435\u0440\u0432\u0438\u0441\u0430\u043c, \u043d\u043e \u044d\u0442\u043e \u043d\u0435 \u0442\u0430\u043a. <b>\u0421\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 Kubernetes \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0442 \u0441 \u043f\u043e\u0440\u0442\u0430\u043c\u0438 pod&#8217;\u043e\u0432, \u0430 \u043d\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432.<\/b><\/p>\n<p>\u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0435\u0441\u043b\u0438 \u0441\u0435\u0440\u0432\u0438\u0441 \u0441\u043b\u0443\u0448\u0430\u0435\u0442 80-\u0439 \u043f\u043e\u0440\u0442, \u043d\u043e \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442 \u0442\u0440\u0430\u0444\u0438\u043a \u043d\u0430 \u043f\u043e\u0440\u0442 8080 \u0441\u0432\u043e\u0438\u0445 pod&#8217;\u043e\u0432, \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0435 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0443\u043a\u0430\u0437\u0430\u0442\u044c \u0438\u043c\u0435\u043d\u043d\u043e 8080.<\/p>\n<p>\u041f\u043e\u0434\u043e\u0431\u043d\u044b\u0439 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u043f\u0440\u0438\u0437\u043d\u0430\u0442\u044c \u043d\u0435\u043e\u043f\u0442\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u043c: \u043f\u0440\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0438 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0433\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0441\u0435\u0440\u0432\u0438\u0441\u0430 (\u043f\u043e\u0440\u0442\u044b \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0441\u043b\u0443\u0448\u0430\u044e\u0442 pod&#8217;\u044b) \u043f\u0440\u0438\u0434\u0435\u0442\u0441\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438.<\/p>\n<p>Uus arhitektuuriline l\u00e4henemine Service Mesh'i kasutamisega <i>(n\u00e4iteks vaadake Istio kohta allpool \u2014 t\u00f5lkija m\u00e4rkus)<\/i> lahendab selle probleemi.<\/p>\n<h2>Kas on vajalik m\u00e4\u00e4rata nii Ingress kui ka Egress?<\/h2>\n<p>\nL\u00fchike vastus on ja, et pod A saaks suhelda pod B-ga, peab tal olema lubatud luua v\u00e4ljuv \u00fchendus (selleks tuleb seadistada egress-poliitika) ning pod B-l peab olema v\u00f5imalik vastu v\u00f5tta sissetulev \u00fchendus (seega on vajalik ingress-poliitika).<\/p>\n<p>Kuid praktikas v\u00f5ib toetuda vaikimisi poliitikale, mis lubab \u00fchendusi \u00fches v\u00f5i m\u00f5lemas suunas.<\/p>\n<p>Kui m\u00f5ni pod-<b>allikas<\/b> valitakse \u00fche v\u00f5i mitme <b>egress<\/b>-poliitika kaudu, siis sellele kehtestatud piirangud m\u00e4\u00e4ravad nende disjunktsioon. Sellisel juhul tuleb selges\u00f5naliselt lubada \u00fchendus pod-<b>adressaat<\/b>. Kui pod ei ole valitud \u00fchegi poliitika t\u00f5ttu, on tema v\u00e4ljuv (egress) liiklus vaikimisi lubatud.<\/p>\n<p>\u0410\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u0441\u0443\u0434\u044c\u0431\u0430 pod&#8217;\u0430-<b>adressaat<\/b>, mille on valinud \u00fche v\u00f5i mitme <b>ingress<\/b>-\u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430\u043c\u0438, \u0431\u0443\u0434\u0435\u0442 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u0442\u044c\u0441\u044f \u0438\u0445 \u0434\u0438\u0437\u044a\u044e\u043d\u043a\u0446\u0438\u0435\u0439. \u0412 \u044d\u0442\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u044f\u0432\u043d\u043e \u0440\u0430\u0437\u0440\u0435\u0448\u0438\u0442\u044c \u0435\u043c\u0443 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0442\u0440\u0430\u0444\u0438\u043a \u043e\u0442 pod&#8217;\u0430-\u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430. \u0415\u0441\u043b\u0438 pod \u043d\u0435 \u0432\u044b\u0431\u0440\u0430\u043d \u043a\u0430\u043a\u043e\u0439-\u043b\u0438\u0431\u043e \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u043e\u0439, \u0432\u0435\u0441\u044c \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439 (ingress) \u0442\u0440\u0430\u0444\u0438\u043a \u0434\u043b\u044f \u043d\u0435\u0433\u043e \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e.<\/p>\n<p>Vaata allpool punkti \"Stateful v\u00f5i Stateless\".<\/p>\n<h2>Logid<\/h2>\n<p>\nKubenetide poliitikad ei suuda liiklust logida. See raskendab poliitika t\u00f5hususe m\u00e4\u00e4ratlemist ja takistab oluliselt turvauuringute tegemist.<\/p>\n<h2>Liikluse kontroll v\u00e4listesse teenustesse<\/h2>\n<p>\nKubenetide poliitikad ei v\u00f5imalda m\u00e4\u00e4rata t\u00e4isvormingus domeeninime (DNS) v\u00e4ljumiste (egress) osades. See p\u00f5hjustab m\u00e4rkimisv\u00e4\u00e4rset ebamugavust, kui p\u00fc\u00fctakse piirata liiklust v\u00e4listele adressaatidele, kellel puudub staatiline IP-aadress (n\u00e4iteks aws.com).<\/p>\n<h2>Poliitika kontrollimine<\/h2>\n<p>\nTulem\u00fc\u00fcri seadmed teavitavad teid v\u00f5i isegi keelduvad vale poliitika vastuv\u00f5tmisest. Kubernetes viib samuti l\u00e4bi teatavaid kontrollimisi. Kui seadistada v\u00f5rgupoliitika l\u00e4bi kubectl, v\u00f5ib Kubernetes v\u00e4ita, et see on vale ja keelduda selle vastuv\u00f5tmisest. Teistes olukordades v\u00f5tab Kubernetes poliitika vastu ja t\u00e4idab puuduvaid andmeid. Neid saab vaadata j\u00e4rgmise k\u00e4su abil:<\/p>\n<pre><code class=\"plaintext\">kubernetes get networkpolicy  -o yaml<\/code><\/pre>\n<p>\nPange t\u00e4hele, et Kubernetes kontrollimisprotsess ei ole eksimustest vaba ja v\u00f5ib j\u00e4tta t\u00e4helepanuta m\u00f5ned t\u00fc\u00fcbid vigu.<\/p>\n<h2>Teostus<\/h2>\n<p>\nKubernetes ei rakenda v\u00f5rgu poliitikaid iseseisvalt, vaid toimib vaid API-l\u00fc\u00fcsina, j\u00e4ttes koormava kontrollit\u00f6\u00f6 allolevale s\u00fcsteemile, mida tuntakse kui Container Networking Interface (CNI). Poliitikate seadmine Kubernetes klastris ilma vastava CNI m\u00e4\u00e4ramiseta on sarnane poliitikate loomisega tulem\u00fc\u00fcride juhtimisse, ilma et need hiljem tulem\u00fc\u00fcridesse installitaks. Te peate ise veenduma, et teil on sobiv CNI v\u00f5i, juhul kui Kubernetes platvormi pakutakse pilves, <i>(v\u00f5ite tutvuda teenusepakkujate nimekirjaga <noindex>siit<\/noindex> \u2014 t\u00f5lkija m\u00e4rkus.)<\/i>, rakendama v\u00f5rgu poliitikaid, mis seadistavad CNI teie eest.<\/p>\n<p>Pange t\u00e4hele, et Kubernetes ei hoiatada teid, kui m\u00e4\u00e4rate v\u00f5rgu poliitika, ilma et vastav toimetav CNI oleks olemas.<\/p>\n<h3>Stateful v\u00f5i Stateless?<\/h3>\n<p>\nK\u00f5ik CNI-d, millega olen kokku puutunud, salvestavad olekuid (n\u00e4iteks Calico kasutab Linuxi conntrack). See v\u00f5imaldab pod'il saada vastuseid tema alustatud TCP-\u00fchendusele, ilma et oleks vaja seda uuesti kehtestada. Samas ei ole mulle teada Kubernetes'e standardit, mis garanteeriks olekute s\u00e4ilitamise (statefulness).<\/p>\n<h2>Edasiarenenud turvapoliitika haldamine<\/h2>\n<p>\nSiin on m\u00f5ned viisid, kuidas t\u00f5sta turvapoliitika t\u00e4itmise efektiivsust Kuberneteses:<\/p>\n<ol>\n<li> Teenuse Meshi arhitektuurimuster kasutab sidecar-konteinereid, et tagada p\u00f5hjalik telemeetrija ning liikluse kontroll teenuste tasemel. N\u00e4iteks v\u00f5ib tuua <noindex><a rel=\"nofollow\" href=\"https:\/\/istio.io\/\">Istio<\/a><\/noindex>.<\/li>\n<li> M\u00f5ned CNI pakkujad on t\u00e4iendanud oma t\u00f6\u00f6riistu nii, et need \u00fcletavad Kubernetes'e v\u00f5rgu poliitikaid.<\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.tufin.com\/products\/tufin-orca\">Tufin Orca<\/a><\/noindex> tagab Kubernetes'e v\u00f5rgu poliitikate l\u00e4bipaistvuse ja automatiseerimise.<\/li>\n<\/ol>\n<p>\nTufin Orca pakett haldab Kubernetes'e v\u00f5rgu poliitikaid (ja toimib eespool toodud ekraanipiltide allikana).<\/p>\n<h2>Lisainformatsioon<\/h2>\n<p><\/p>\n<ul>\n<li> <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/ahmetb\/kubernetes-network-policy-recipes\">\u041f\u0440\u0438\u043c\u0435\u0440\u044b \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u043e\u043b\u0438\u0442\u0438\u043a, \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0435 Ahmet Alp Balkan&#8217;\u043e\u043c \u0438\u0437 GKE<\/a><\/noindex>;<\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"https:\/\/kubernetes.io\/docs\/concepts\/services-networking\/network-policies\/\">Dokumentatsioon Kubernetes'e ametlikul veebisaidil<\/a><\/noindex>;<\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"https:\/\/sookocheff.com\/post\/kubernetes\/understanding-kubernetes-networking-model\/\">Kubernetes'e v\u00f5rgu mudeli juhend<\/a><\/noindex>;<\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/Tufin\/test-network-policies\">V\u00f5rgu poliitikate kontrollimise skript<\/a><\/noindex>.<\/li>\n<\/ul>\n<p><\/p>\n<h2>Kokkuv\u00f5te<\/h2>\n<p>\nKubernetesi v\u00f5rgupoliitikad pakuvad head t\u00f6\u00f6riistade kogumit klastrite segmenteerimiseks, kuid need on intuitsioonilt keerulised ja neil on palju n\u00fcansse. Arvan, et selle keerukuse t\u00f5ttu sisaldavad paljude olemasolevate klastrite poliitikad vigu. Selle probleemi v\u00f5imalikud lahendused on poliitikate m\u00e4\u00e4ratlemise automatiseerimine v\u00f5i teiste segmenteerimisvahendite rakendamine.<\/p>\n<p>Loodan, et see juhend aitab selgitada m\u00f5ned k\u00fcsimused ja lahendada probleemid, millega v\u00f5ite kokku puutuda.<\/p>\n<h2>P.S. t\u00f5lkija m\u00e4rkused<\/h2>\n<p>\nLugege ka meie blogist:<\/p>\n<ul>\n<li> \u201eTagasi mikroteenuste juurde koos Istio\u2019ga\u201c: <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/438426\/\">osa 1 (tutvumine p\u00f5hifunktsioonidega)<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/440378\/\">osa 2 (suunamine, liikluse haldamine)<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/443668\/\">osa 3 (turvalisus)<\/a><\/noindex>;<\/li>\n<li> \u201eIllustreeritud juhend Kuberneteses olevate v\u00f5rkude seadistamiseks\u201c: <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/346304\/\">osad 1 ja 2 (v\u00f5rgumudel, overlay-v\u00f5rgud)<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/433382\/\">osa 3 (teenused ja liikluse t\u00f6\u00f6tlemine)<\/a><\/noindex>;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/440504\/\">Docker ja Kubernetes turvafookusega keskkondades<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/436300\/\">9 parimat praktikat Kubernetes'e turvamiseks<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/417905\/\">11 viisi, kuidas (mitte) sattuda Kubernetes'e h\u00e4kkimise ohvriks<\/a><\/noindex>\u00bb.<\/li>\n<\/ul>\n<p>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/443190\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u0438\u043c. \u043f\u0435\u0440\u0435\u0432.: \u0410\u0432\u0442\u043e\u0440 \u0441\u0442\u0430\u0442\u044c\u0438 \u2014 Reuven Harrison \u2014 \u0438\u043c\u0435\u0435\u0442 \u0431\u043e\u043b\u0435\u0435 20 \u043b\u0435\u0442 \u043e\u043f\u044b\u0442\u0430 \u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f, \u0430 \u043d\u0430 \u0441\u0435\u0433\u043e\u0434\u043d\u044f\u0448\u043d\u0438\u0439 \u0434\u0435\u043d\u044c \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u043c \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u043e\u043c \u0438 \u0441\u043e\u0443\u0447\u0440\u0435\u0434\u0438\u0442\u0435\u043b\u0435\u043c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Tufin, \u0441\u043e\u0437\u0434\u0430\u044e\u0449\u0435\u0439 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430\u043c\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0420\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u044f \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 Kubernetes \u043a\u0430\u043a \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043c\u043e\u0449\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e \u0434\u043b\u044f \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0438 \u0432 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0435, \u043e\u043d \u0432 \u0442\u043e \u0436\u0435 \u0432\u0440\u0435\u043c\u044f \u0441\u0447\u0438\u0442\u0430\u0435\u0442, \u0447\u0442\u043e \u043e\u043d\u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":24432,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-32641","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.10 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0440\u0438\u043c. \u043f\u0435\u0440\u0435\u0432.: \u0410\u0432\u0442\u043e\u0440 \u0441\u0442\u0430\u0442\u044c\u0438 \u2014 Reuven Harrison \u2014 \u0438\u043c\u0435\u0435\u0442 \u0431\u043e\u043b\u0435\u0435 20 \u043b\u0435\u0442 \u043e\u043f\u044b\u0442\u0430 \u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f, \u0430 \u043d\u0430 \u0441\u0435\u0433\u043e\u0434\u043d\u044f\u0448\u043d\u0438\u0439 \u0434\u0435\u043d\u044c \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u043c \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u043e\u043c \u0438 \u0441\u043e\u0443\u0447\u0440\u0435\u0434\u0438\u0442\u0435\u043b\u0435\u043c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Tufin, \u0441\u043e\u0437\u0434\u0430\u044e\u0449\u0435\u0439 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430\u043c\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0420\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u044f \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 Kubernetes \u043a\u0430\u043a \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043c\u043e\u0449\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e \u0434\u043b\u044f \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0438 \u0432 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0435, \u043e\u043d \u0432 \u0442\u043e \u0436\u0435 \u0432\u0440\u0435\u043c\u044f \u0441\u0447\u0438\u0442\u0430\u0435\u0442, \u0447\u0442\u043e \u043e\u043d\u0438\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/vvedenie-v-setevye-politiki-kubernetes-dlya-spetsialistov-po-bezopasnosti\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.10\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0432 \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 Kubernetes \u0434\u043b\u044f \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u043e\u0432 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0440\u0438\u043c. \u043f\u0435\u0440\u0435\u0432.: \u0410\u0432\u0442\u043e\u0440 \u0441\u0442\u0430\u0442\u044c\u0438 \u2014 Reuven Harrison \u2014 \u0438\u043c\u0435\u0435\u0442 \u0431\u043e\u043b\u0435\u0435 20 \u043b\u0435\u0442 \u043e\u043f\u044b\u0442\u0430 \u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f, \u0430 \u043d\u0430 \u0441\u0435\u0433\u043e\u0434\u043d\u044f\u0448\u043d\u0438\u0439 \u0434\u0435\u043d\u044c \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u043c \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u043e\u043c \u0438 \u0441\u043e\u0443\u0447\u0440\u0435\u0434\u0438\u0442\u0435\u043b\u0435\u043c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Tufin, \u0441\u043e\u0437\u0434\u0430\u044e\u0449\u0435\u0439 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430\u043c\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0420\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u044f \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 Kubernetes \u043a\u0430\u043a \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043c\u043e\u0449\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e \u0434\u043b\u044f \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0438 \u0432 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0435, \u043e\u043d \u0432 \u0442\u043e \u0436\u0435 \u0432\u0440\u0435\u043c\u044f \u0441\u0447\u0438\u0442\u0430\u0435\u0442, \u0447\u0442\u043e \u043e\u043d\u0438\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/vvedenie-v-setevye-politiki-kubernetes-dlya-spetsialistov-po-bezopasnosti\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:48:11+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:48:11+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kubernetes'i v\u00f5rgupoliitikate sissejuhatus turvalisuse spetsialistidele | ProHoster","description":"M\u00e4rkus: Artikli autor Reuven Harrisonil on rohkem kui 20 aastat tarkvaraarenduse kogemust ning ta on praegu Tufini tehniline direktor ja kaasasutaja, kes loob turvapoliitikate haldamise lahendusi. \u00dchtlasi peab ta Kubernetes'i v\u00f5rgupoliitikaid piisavalt tugeva vahendina v\u00f5rgu segmentimiseks klastris, kuid ...","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/vvedenie-v-setevye-politiki-kubernetes-dlya-spetsialistov-po-bezopasnosti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0432 \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 Kubernetes \u0434\u043b\u044f \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u043e\u0432 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 | ProHoster","og:description":"\u041f\u0440\u0438\u043c. \u043f\u0435\u0440\u0435\u0432.: \u0410\u0432\u0442\u043e\u0440 \u0441\u0442\u0430\u0442\u044c\u0438 \u2014 Reuven Harrison \u2014 \u0438\u043c\u0435\u0435\u0442 \u0431\u043e\u043b\u0435\u0435 20 \u043b\u0435\u0442 \u043e\u043f\u044b\u0442\u0430 \u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f, \u0430 \u043d\u0430 \u0441\u0435\u0433\u043e\u0434\u043d\u044f\u0448\u043d\u0438\u0439 \u0434\u0435\u043d\u044c \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u043c \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u043e\u043c \u0438 \u0441\u043e\u0443\u0447\u0440\u0435\u0434\u0438\u0442\u0435\u043b\u0435\u043c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Tufin, \u0441\u043e\u0437\u0434\u0430\u044e\u0449\u0435\u0439 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430\u043c\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0420\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u044f \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 Kubernetes \u043a\u0430\u043a \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043c\u043e\u0449\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e \u0434\u043b\u044f \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0438 \u0432 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0435, \u043e\u043d \u0432 \u0442\u043e \u0436\u0435 \u0432\u0440\u0435\u043c\u044f \u0441\u0447\u0438\u0442\u0430\u0435\u0442, \u0447\u0442\u043e \u043e\u043d\u0438","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/vvedenie-v-setevye-politiki-kubernetes-dlya-spetsialistov-po-bezopasnosti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:48:11+00:00","article:modified_time":"2019-10-31T18:48:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"32641","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 11:53:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:55:23","updated":"2026-01-21 11:53:20"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/32641","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=32641"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/32641\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/24432"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=32641"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=32641"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=32641"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}