{"id":32641,"date":"2019-10-31T21:48:11","date_gmt":"2019-10-31T18:48:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/vvedenie-v-setevye-politiki-kubernetes-dlya-spetsialistov-po-bezopasnosti\/"},"modified":"2019-10-31T21:48:11","modified_gmt":"2019-10-31T18:48:11","slug":"vvedenie-v-setevye-politiki-kubernetes-dlya-spetsialistov-po-bezopasnosti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/vvedenie-v-setevye-politiki-kubernetes-dlya-spetsialistov-po-bezopasnosti","title":{"rendered":"\u00davod do sie\u0165ov\u00fdch polit\u00edk Kubernetes pre bezpe\u010dnostn\u00fdch \u0161pecialistov","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"\u00davod do sie\u0165ov\u00fdch polit\u00edk Kubernetes pre bezpe\u010dnostn\u00fdch \u0161pecialistov\" src=\"\/wp-content\/uploads\/2019\/04\/6972a1e1385463b1fcc723c09036a565.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i><b>Pozn. prekl.<\/b>: Autor \u010dl\u00e1nku \u2013 Reuven Harrison \u2013 m\u00e1 viac ako 20 rokov sk\u00fasenost\u00ed s v\u00fdvojom softv\u00e9ru a v s\u00fa\u010dasnosti je technick\u00fdm riadite\u013eom a spoluzakladate\u013eom spolo\u010dnosti Tufin, ktor\u00e1 vytv\u00e1ra rie\u0161enia na spr\u00e1vu bezpe\u010dnostn\u00fdch polit\u00edk. Ke\u010f\u017ee sie\u0165ov\u00e9 politiky Kubernetes pova\u017euje za dos\u0165 siln\u00fd n\u00e1stroj na segment\u00e1ciu siete v klastre, z\u00e1rove\u0148 si mysl\u00ed, \u017ee ich aplik\u00e1cia v praxi nie je tak\u00e1 jednoduch\u00e1. Tento materi\u00e1l (relat\u00edvne rozsiahly) je ur\u010den\u00fd na zv\u00fd\u0161enie povedomia odborn\u00edkov v tejto oblasti a pomoc pri vytv\u00e1ran\u00ed potrebn\u00fdch konfigur\u00e1ci\u00ed.<\/i><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>V s\u00fa\u010dasnosti si st\u00e1le viac firiem vyber\u00e1 Kubernetes na sp\u00fa\u0161\u0165anie svojich aplik\u00e1ci\u00ed. Z\u00e1ujem o tento softv\u00e9r je tak\u00fd vysok\u00fd, \u017ee niektor\u00ed ho naz\u00fdvaj\u00fa \u201enov\u00fdm opera\u010dn\u00fdm syst\u00e9mom pre d\u00e1tov\u00e9 centr\u00e1\u201c. Postupne sa Kubernetes (alebo k8s) za\u010d\u00edna vn\u00edma\u0165 ako kriticky d\u00f4le\u017eit\u00e1 s\u00fa\u010das\u0165 podnikania, ktor\u00e1 si vy\u017eaduje organiz\u00e1ciu vyspel\u00fdch obchodn\u00fdch procesov, vr\u00e1tane zais\u0165ovania sie\u0165ovej bezpe\u010dnosti.<\/p>\n<p>Pre odborn\u00edkov na bezpe\u010dnos\u0165, ktor\u00fdch zmiatlo zaobch\u00e1dzanie s Kubernetes, m\u00f4\u017ee by\u0165 skuto\u010dn\u00fdm prekvapen\u00edm predvolen\u00e9 pravidlo tejto platformy: povoli\u0165 v\u0161etko.<\/p>\n<p>Tento sprievodca pom\u00f4\u017ee porozumie\u0165 vn\u00fatornej \u0161trukt\u00fare sie\u0165ov\u00fdch polit\u00edk; pochopi\u0165, v \u010dom sa l\u00ed\u0161ia od pravidiel pre be\u017en\u00e9 firewally. Tie\u017e sa dozviete o niektor\u00fdch \u00faskal\u00ed a dostanete odpor\u00fa\u010dania, ktor\u00e9 pom\u00f4\u017eu chr\u00e1ni\u0165 aplik\u00e1cie v Kubernetes.<\/p>\n<h2>Sie\u0165ov\u00e9 politiky Kubernetes<\/h2>\n<p>\nMechanizmus sie\u0165ov\u00fdch polit\u00edk Kubernetes umo\u017e\u0148uje riadi\u0165 interakciu nasaden\u00fdch aplik\u00e1ci\u00ed na platforme na sie\u0165ovej \u00farovni (tretej v modeli OSI). Sie\u0165ov\u00e9 politiky nemaj\u00fa niektor\u00e9 pokro\u010dil\u00e9 funkcie modern\u00fdch firewallov, ako je kontrola na 7. \u00farovni OSI a detekcia hrozieb, av\u0161ak poskytuj\u00fa z\u00e1kladn\u00fa \u00farove\u0148 sie\u0165ovej bezpe\u010dnosti, \u010do je dobr\u00fd v\u00fdchodiskov\u00fd bod.<\/p>\n<h2>Sie\u0165ov\u00e9 politiky riadia komunik\u00e1ciu medzi podmi<\/h2>\n<p>\nPracovn\u00e9 za\u0165a\u017eenia v Kubernetes s\u00fa rozlo\u017een\u00e9 po podoch, ktor\u00e9 sa skladaj\u00fa z jedn\u00e9ho alebo viacer\u00fdch kontajnerov, nasaden\u00fdch spolo\u010dne. Kubernetes prira\u010fuje ka\u017ed\u00e9mu podu IP adresu, pr\u00edstupn\u00fa z in\u00fdch podov. Sie\u0165ov\u00e9 politiky Kubernetes ur\u010duj\u00fa pr\u00edstupov\u00e9 pr\u00e1va pre skupiny podov podobne ako skupiny zabezpe\u010denia v cloude sa pou\u017e\u00edvaj\u00fa na riadenie pr\u00edstupu k virtu\u00e1lnym strojom.<\/p>\n<h2>Defin\u00edcia sie\u0165ov\u00fdch polit\u00edk<\/h2>\n<p>\nRovnako ako ostatn\u00e9 zdroje Kubernetes, sie\u0165ov\u00e9 politiky s\u00fa definovan\u00e9 v jazyku YAML. V ni\u017e\u0161ie uvedenom pr\u00edklade m\u00e1 aplik\u00e1cia <code>balance<\/code> pr\u00edstup k <code>postgres<\/code>:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.postgres\n  namespace: default\nspec:\n  podSelector:\n    matchLabels:\n      app: postgres\n  ingress:\n  - from:\n    - podSelector:\n        matchLabels:\n          app: balance\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do sie\u0165ov\u00fdch polit\u00edk Kubernetes pre bezpe\u010dnostn\u00fdch \u0161pecialistov\" src=\"\/wp-content\/uploads\/2019\/04\/ff5857af2641e62558b035bab9c413dc.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>(<b>Pozn. prekl.<\/b>: tento sn\u00edmok, ako aj v\u0161etky nasleduj\u00face podobn\u00e9, nebol vytvoren\u00fd nat\u00edvnymi n\u00e1strojmi Kubernetes, ale pomocou n\u00e1stroja Tufin Orca, za ktor\u00fdm stoj\u00ed spolo\u010dnos\u0165 autora p\u00f4vodn\u00e9ho \u010dl\u00e1nku a ktor\u00fd je spomenut\u00fd na konci materi\u00e1lu.)<\/i><\/p>\n<p>Na definovanie vlastnej sie\u0165ovej politiky bud\u00fa potrebn\u00e9 z\u00e1kladn\u00e9 znalosti jazyka YAML. Tento jazyk je zalo\u017een\u00fd na odsaden\u00ed (ur\u010denom medzerami, nie tabul\u00e1tormi). Prvok s odsaden\u00edm patr\u00ed najbli\u017e\u0161iemu prvku s odsaden\u00edm nad n\u00edm. Nov\u00fd prvok zoznamu sa za\u010d\u00edna poml\u010dkou, v\u0161etky ostatn\u00e9 prvky maj\u00fa podobu <i>k\u013e\u00fa\u010d-hodnota<\/i>.<\/p>\n<p>Po opise politiky v YAML pou\u017eite <noindex><a rel=\"nofollow\" href=\"https:\/\/kubernetes.io\/docs\/reference\/kubectl\/kubectl\/\">kubectl<\/a><\/noindex>, aby ste ju vytvorili v klastri:<\/p>\n<pre><code class=\"bash\">kubectl create -f policy.yaml<\/code><\/pre>\n<p><\/p>\n<h2>\u0160pecifik\u00e1cia sie\u0165ovej politiky<\/h2>\n<p>\n\u0160pecifik\u00e1cia sie\u0165ovej politiky Kubernetes obsahuje \u0161tyri prvky:<\/p>\n<ol>\n<li> <code>podSelector<\/code>: ur\u010duje pody, ktor\u00e9 s\u00fa touto politikou ovplyvnen\u00e9 (cie\u013e) \u2014 povinn\u00e9;<\/li>\n<li> <code>policyTypes<\/code>: uv\u00e1dza, ak\u00e9 typy polit\u00edk s\u00fa zahrnut\u00e9 v tejto: ingress a\/alebo egress \u2014 volite\u013en\u00fd, ale odpor\u00fa\u010dam ho jasne uv\u00e1dza\u0165 vo v\u0161etk\u00fdch pr\u00edpadoch;<\/li>\n<li> <code>ingress<\/code>: ur\u010duje povolen\u00fd <b>prich\u00e1dzaj\u00faci<\/b> prev\u00e1dzka do cie\u013eov\u00fdch podov \u2014 volite\u013en\u00e9;<\/li>\n<li> <code>egress<\/code>: ur\u010duje povolen\u00fd <b>odch\u00e1dzaj\u00faci<\/b> prev\u00e1dzka z cie\u013eov\u00fdch podov \u2014 volite\u013en\u00e9.<\/li>\n<\/ol>\n<p>\nPr\u00edklad prevzat\u00fd z webu Kubernetes (nahradil som <code>role<\/code> na <code>app<\/code>), ukazuje, ako sa pou\u017e\u00edvaj\u00fa v\u0161etky \u0161tyri prvky:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: test-network-policy\n  namespace: default\nspec:\n  podSelector:    # &lt;&lt;&lt;\n    matchLabels:\n      app: db\n  policyTypes:    # &lt;&lt;&lt;\n  - Ingress\n  - Egress\n  ingress:        # &lt;&lt;&lt;\n  - from:\n    - ipBlock:\n        cidr: 172.17.0.0\/16\n        except:\n        - 172.17.1.0\/24\n    - namespaceSelector:\n        matchLabels:\n          project: myproject\n    - podSelector:\n        matchLabels:\n          role: frontend\n    ports:\n    - protocol: TCP\n      port: 6379\n  egress:         # &lt;&lt;&lt;\n  - to:\n    - ipBlock:\n        cidr: 10.0.0.0\/24\n    ports:\n    - protocol: TCP\n      port: 5978<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do sie\u0165ov\u00fdch polit\u00edk Kubernetes pre bezpe\u010dnostn\u00fdch \u0161pecialistov\" src=\"\/wp-content\/uploads\/2019\/04\/f01e748410564756d6272095093e52e2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<img decoding=\"async\" alt=\"\u00davod do sie\u0165ov\u00fdch polit\u00edk Kubernetes pre bezpe\u010dnostn\u00fdch \u0161pecialistov\" src=\"\/wp-content\/uploads\/2019\/04\/997282073ee6b5c4d6b7af45cdc11295.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nVezmite na vedomie, \u017ee v\u0161etky \u0161tyri prvky nie s\u00fa povinn\u00e9. Povinn\u00fd je iba <code>podSelector<\/code>, ostatn\u00e9 parametre m\u00f4\u017eete pou\u017ei\u0165 pod\u013ea potreby.<\/p>\n<p>Ak vynech\u00e1te <code>policyTypes<\/code>, politika sa bude interpretova\u0165 nasledovne:<\/p>\n<ul>\n<li> Predpoklad\u00e1 sa, \u017ee ur\u010duje prich\u00e1dzaj\u00facu (ingress) stranu. Ak v politike nie s\u00fa explicitne uveden\u00e9 \u017eiadne pokyny, syst\u00e9m bude predpoklada\u0165, \u017ee v\u0161etok prenos je zak\u00e1zan\u00fd.<\/li>\n<li> Spr\u00e1vanie na odch\u00e1dzaj\u00facej (egress) strane bude z\u00e1visie\u0165 od pr\u00edtomnosti alebo absencie pr\u00edslu\u0161n\u00e9ho parametra egress.<\/li>\n<\/ul>\n<p>\nAby ste predi\u0161li chyb\u00e1m, odpor\u00fa\u010dam <b>v\u017edy explicitne uv\u00e1dza\u0165 <code>policyTypes<\/code><\/b>.<\/p>\n<p>V s\u00falade s vy\u0161\u0161ie uvedenou logikou, ak s\u00fa parametre <code>ingress<\/code> a\/alebo <code>egress<\/code> vynechan\u00e9, politika zak\u00e1\u017ee cel\u00fd prenos (pozri \u201e\u010cist\u00e9 pravidlo\u201c ni\u017e\u0161ie).<\/p>\n<h2>Predvolen\u00e9 pravidlo je povoli\u0165<\/h2>\n<p>\nAk nie s\u00fa politiky definovan\u00e9, Kubernetes predvolene povo\u013euje v\u0161etku prev\u00e1dzku. V\u0161etky pody si m\u00f4\u017eu slobodne vymie\u0148a\u0165 inform\u00e1cie. Z poh\u013eadu bezpe\u010dnosti to m\u00f4\u017ee zda\u0165 nelogick\u00e9, ale pam\u00e4tajte na to, \u017ee Kubernetes bol p\u00f4vodne vytvoren\u00fd v\u00fdvoj\u00e1rmi s cie\u013eom zabezpe\u010di\u0165 interakciu aplik\u00e1ci\u00ed. Sie\u0165ov\u00e9 politiky boli pridan\u00e9 nesk\u00f4r.<\/p>\n<h2>Namespaces<\/h2>\n<p>\nNamespaces (priestory mien) s\u00fa mechanizmom kolekt\u00edvnej pr\u00e1ce Kubernetes. Sl\u00fa\u017eia na izol\u00e1ciu logick\u00fdch prostred\u00ed navz\u00e1jom, pri\u010dom v\u00fdmena \u00fadajov medzi priestormi je predvolene povolen\u00e1.<\/p>\n<p>Rovnako ako v\u00e4\u010d\u0161ina komponentov Kubernetes, sie\u0165ov\u00e9 politiky sa nach\u00e1dzaj\u00fa v ur\u010ditom namespace. V bloku <code>metadata<\/code> m\u00f4\u017eete uvies\u0165, ktor\u00e9mu konkr\u00e9tnemu priestoru patr\u00ed politika:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: test-network-policy\n  namespace: my-namespace  # &lt;&lt;&lt;\nspec:\n...<\/code><\/pre>\n<p>\nAk namespace v metad\u00e1tach explicitne nie je uveden\u00fd, syst\u00e9m pou\u017eije namespace uveden\u00e9 v kubectl (predvolene <code>namespace=default<\/code>):<\/p>\n<pre><code class=\"bash\">kubectl apply -n my-namespace -f namespace.yaml<\/code><\/pre>\n<p>\nOdpor\u00fa\u010dam <b>explicitne uv\u00e1dza\u0165 namespace<\/b>, ak p\u00ed\u0161ete politiku, ktor\u00e1 je ur\u010den\u00e1 pre viacero oborov.<\/p>\n<p><b>Hlavn\u00fd<\/b> prvok <code>podSelector<\/code> politika bude vybera\u0165 pody z namespace, ku ktor\u00e9mu politika patr\u00ed (nem\u00e1 pr\u00edstup k podom z in\u00fdch namespaces).<\/p>\n<p>Podobn\u00fdm sp\u00f4sobom podSelector-y <b>v blokoch ingress a egress<\/b> m\u00f4\u017eu vybera\u0165 pod\u2019y len zo svojho oboru, pokia\u013e ich samozrejme nespoj\u00edte pomocou <code>namespaceSelector<\/code> (o tom bude re\u010d v \u010dasti \u201eFiltrova\u0165 pod\u013ea namespace a podov\u201c).<\/p>\n<h2>Pravidl\u00e1 pomenov\u00e1vania polit\u00edk<\/h2>\n<p>\nN\u00e1zvy polit\u00edk s\u00fa jedine\u010dn\u00e9 v r\u00e1mci jedn\u00e9ho oboru. Dve politiky s rovnak\u00fdm n\u00e1zvom v jednom obore nem\u00f4\u017eu existova\u0165, ale m\u00f4\u017eu existova\u0165 politiky s rovnak\u00fdmi n\u00e1zvami v r\u00f4znych oboroch. Toto je praktick\u00e9, ke\u010f chcete op\u00e4tovne aplikova\u0165 t\u00fa ist\u00fa politiku na viacer\u00e9 obory.<\/p>\n<p>Osobitne sa mi p\u00e1\u010di jeden zo sp\u00f4sobov pomenov\u00e1vania. Spo\u010d\u00edva v tom, \u017ee kombinuje n\u00e1zov oboru s cie\u013eov\u00fdmi pod\u2019y. Napr\u00edklad:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.postgres  # &lt;&lt;&lt;\n  namespace: default\nspec:\n  podSelector:\n    matchLabels:\n      app: postgres\n  ingress:\n  - from:\n    - podSelector:\n        matchLabels:\n          app: admin\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do sie\u0165ov\u00fdch polit\u00edk Kubernetes pre bezpe\u010dnostn\u00fdch \u0161pecialistov\" src=\"\/wp-content\/uploads\/2019\/04\/18318c320d6e37eeb01c51f251550639.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>\u0160t\u00edtky<\/h2>\n<p>\nK objektom Kubernetes, ako s\u00fa pod\u2019y a obory, je mo\u017en\u00e9 pripoji\u0165 vlastn\u00e9 \u0161t\u00edtky. \u0160t\u00edtky (<i>labels<\/i> \u2014 tagy) s\u00fa ekvivalentom tagov v cloude. Sie\u0165ov\u00e9 politiky Kubernetes pou\u017e\u00edvaj\u00fa \u0161t\u00edtky na v\u00fdber <b>podov<\/b>, na ktor\u00e9 sa aplikuj\u00fa:<\/p>\n<pre><code class=\"plaintext\">podSelector:\n  matchLabels:\n    role: db<\/code><\/pre>\n<p>\n\u2026 alebo <b>oborov<\/b>, na ktor\u00e9 sa uplat\u0148uj\u00fa. V tomto pr\u00edklade s\u00fa vybran\u00e9 v\u0161etky pody v namespaces s pr\u00edslu\u0161n\u00fdmi label-mi:<\/p>\n<pre><code class=\"plaintext\">namespaceSelector:\n  matchLabels:\n    project: myproject<\/code><\/pre>\n<p>\nJedno varovanie: pri pou\u017eit\u00ed <code>namespaceSelector<\/code> <b>sa uistite, \u017ee vyberan\u00e9 obory obsahuj\u00fa po\u017eadovan\u00fd \u0161t\u00edtok<\/b>. Majte na pam\u00e4ti, \u017ee vstavan\u00e9 obory, ako napr\u00edklad <code>default<\/code> a <code>kube-system<\/code>, predvolene neobsahuj\u00fa \u017eiadne \u0161t\u00edtky.<\/p>\n<p>Prida\u0165 \u0161t\u00edtok k oboru mo\u017eno nasledovne:<\/p>\n<pre><code class=\"bash\">kubectl label namespace default namespace=default<\/code><\/pre>\n<p>\nPri tom namespace v sekcii <code>metadata<\/code> mus\u00ed odkazova\u0165 na skuto\u010dn\u00e9 meno oboru, a nie na \u0161t\u00edtok:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: test-network-policy\n  namespace: default   # &lt;&lt;&lt;\nspec:\n...<\/code><\/pre>\n<p><\/p>\n<h2>Zdroj a adres\u00e1t<\/h2>\n<p>\nPolitiky pre firewall pozost\u00e1vaj\u00fa z pravidiel so zdrojmi a adres\u00e1tmi. Sie\u0165ov\u00e9 politiky Kubernetes s\u00fa definovan\u00e9 pre cie\u013e \u2014 s\u00fabor podov, na ktor\u00e9 sa uplat\u0148uj\u00fa, a n\u00e1sledne stanovuj\u00fa pravidl\u00e1 pre prich\u00e1dzaj\u00facu (ingress) a\/alebo odch\u00e1dzaj\u00facu (egress) prev\u00e1dzku. V na\u0161om pr\u00edklade bude cie\u013eom politiky v\u0161etky pody v namespace <code>default<\/code> s labelom s k\u013e\u00fa\u010dom <code>app<\/code> a hodnotou <code>db.<\/code>:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: test-network-policy\n  namespace: default\nspec:\n  podSelector:\n    matchLabels:\n      app: db   # &lt;&lt;&lt;\n  policyTypes:\n  - Ingress\n  - Egress\n  ingress:\n  - from:\n    - ipBlock:\n        cidr: 172.17.0.0\/16\n        except:\n        - 172.17.1.0\/24\n    - namespaceSelector:\n        matchLabels:\n          project: myproject\n    - podSelector:\n        matchLabels:\n          role: frontend\n    ports:\n    - protocol: TCP\n      port: 6379\n  egress:\n  - to:\n    - ipBlock:\n        cidr: 10.0.0.0\/24\n    ports:\n    - protocol: TCP\n      port: 5978<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do sie\u0165ov\u00fdch polit\u00edk Kubernetes pre bezpe\u010dnostn\u00fdch \u0161pecialistov\" src=\"\/wp-content\/uploads\/2019\/04\/5fcb3f78e26ae1ed5635541ad69ef69f.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<img decoding=\"async\" alt=\"\u00davod do sie\u0165ov\u00fdch polit\u00edk Kubernetes pre bezpe\u010dnostn\u00fdch \u0161pecialistov\" src=\"\/wp-content\/uploads\/2019\/04\/c753f559ecc3ba54f8b55e29851428c4.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPodrobnos\u0165 <code>ingress<\/code> v tejto politike otv\u00e1ra prich\u00e1dzaj\u00faci traffic k cie\u013eov\u00fdm podom. In\u00fdmi slovami, ingress funguje ako zdroj, a cie\u013e je pr\u00edslu\u0161n\u00fdm adres\u00e1tom. Analogicky je egress adres\u00e1tom, a cie\u013e je jeho zdrojom.<\/p>\n<p><img decoding=\"async\" alt=\"\u00davod do sie\u0165ov\u00fdch polit\u00edk Kubernetes pre bezpe\u010dnostn\u00fdch \u0161pecialistov\" src=\"\/wp-content\/uploads\/2019\/04\/a0d865de57a7620849074424770832cd.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>To zodpoved\u00e1 dvom pravidl\u00e1m pre firewall: Ingress \u2192 Cie\u013e; Cie\u013e \u2192 Egress.<\/i><\/p>\n<h2>Egress a DNS (d\u00f4le\u017eit\u00e9!)<\/h2>\n<p>\nObmedzovan\u00edm odch\u00e1dzaj\u00faceho trafficu, <b>venujte osobitn\u00fa pozornos\u0165 DNS<\/b> \u2014 Kubernetes pou\u017e\u00edva t\u00fato slu\u017ebu na mapovanie slu\u017eieb na IP adresy. Napr\u00edklad, nasleduj\u00faca politika nebude fungova\u0165, preto\u017ee ste nepripustili aplik\u00e1ciu <code>balance<\/code> pristupova\u0165 k DNS:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.balance\n  namespace: default\nspec:\n  podSelector:\n    matchLabels:\n      app: balance\n  egress:\n  - to:\n    - podSelector:\n        matchLabels:\n          app: postgres\n  policyTypes:\n  - Egress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do sie\u0165ov\u00fdch polit\u00edk Kubernetes pre bezpe\u010dnostn\u00fdch \u0161pecialistov\" src=\"\/wp-content\/uploads\/2019\/04\/5857a44cc5e06de708f0d3b5b0f49628.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nM\u00f4\u017eete to opravi\u0165 umo\u017enen\u00edm pr\u00edstupu k DNS slu\u017ebe:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.balance\n  namespace: default\nspec:\n  podSelector:\n    matchLabels:\n      app: balance\n  egress:\n  - to:\n    - podSelector:\n        matchLabels:\n          app: postgres\n  - to:               # &lt;&lt;&lt;\n    ports:            # &lt;&lt;&lt;\n    - protocol: UDP   # &lt;&lt;&lt;\n      port: 53        # &lt;&lt;&lt;\n  policyTypes:\n  - Egress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do sie\u0165ov\u00fdch polit\u00edk Kubernetes pre bezpe\u010dnostn\u00fdch \u0161pecialistov\" src=\"\/wp-content\/uploads\/2019\/04\/a396bb2ae94fca94c3b62aef2cb07552.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPosledn\u00e1 polo\u017eka <code>to<\/code> \u2014 pr\u00e1zdna, a preto nepriamo vyber\u00e1 <b>v\u0161etky pody vo v\u0161etk\u00fdch namespaces<\/b>, \u010d\u00edm umo\u017e\u0148uje <code>balance<\/code> posiela\u0165 DNS dotazy na pr\u00edslu\u0161n\u00fa slu\u017ebu Kubernetes (vo v\u0161eobecnosti funguje v namespace <code>kube-system<\/code>).<\/p>\n<p>Tento pr\u00edstup funguje, av\u0161ak je <b>pr\u00edli\u0161 dovolenkov\u00fd a nebezpe\u010dn\u00fd<\/b>, preto\u017ee umo\u017e\u0148uje smerova\u0165 DNS dotazy mimo cluster.<\/p>\n<p>Je mo\u017en\u00e9 ho zlep\u0161i\u0165 tromi postupn\u00fdmi krokmi.<\/p>\n<p>1. Umo\u017eni\u0165 DNS dotazy iba <b>vn\u00fatri<\/b> clusteru, pridan\u00edm <code>namespaceSelector<\/code>:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.balance\n  namespace: default\nspec:\n  podSelector:\n    matchLabels:\n      app: balance\n  egress:\n  - to:\n    - podSelector:\n        matchLabels:\n          app: postgres\n  - to:\n    - namespaceSelector: {} \n    ports:\n    - protocol: UDP\n      port: 53\n  policyTypes:\n  - Egress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do sie\u0165ov\u00fdch polit\u00edk Kubernetes pre bezpe\u010dnostn\u00fdch \u0161pecialistov\" src=\"\/wp-content\/uploads\/2019\/04\/5920a043229676e0780d691d302c5ade.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n2. Povoli\u0165 DNS dotazy len v r\u00e1mci mena <code>kube-system<\/code>.<\/p>\n<p>Na to je potrebn\u00e9 prida\u0165 \u0161t\u00edtok do mena <code>kube-system<\/code>: <code>kubectl label namespace kube-system namespace=kube-system<\/code> \u2014 a uvies\u0165 ju v politike pomocou <code>namespaceSelector<\/code>:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.balance\n  namespace: default\nspec:\n  podSelector:\n    matchLabels:\n      app: balance\n  egress:\n  - to:\n    - podSelector:\n        matchLabels:\n          app: postgres\n  - to:\n    - namespaceSelector: \n        matchLabels: \n          namespace: kube-system \n    ports:\n    - protocol: UDP\n      port: 53\n  policyTypes:\n  - Egress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do sie\u0165ov\u00fdch polit\u00edk Kubernetes pre bezpe\u010dnostn\u00fdch \u0161pecialistov\" src=\"\/wp-content\/uploads\/2019\/04\/2a1dd0975c58e6d277baffc7c3ac6e48.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n3. Paranoidn\u00ed m\u00f4\u017eu \u00eds\u0165 e\u0161te \u010falej a obmedzi\u0165 DNS dotazy na konkr\u00e9tnu DNS slu\u017ebu v <code>kube-system<\/code>. V \u010dasti \u201eFiltrova\u0165 pod\u013ea namespaces a podov\u201c sa dozviete, ako to dosiahnu\u0165.<\/p>\n<p>Inou mo\u017enos\u0165ou je povoli\u0165 DNS na \u00farovni priestoru mien. V takom pr\u00edpade ho nebude potrebn\u00e9 otv\u00e1ra\u0165 pre ka\u017ed\u00fa slu\u017ebu:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.dns\n  namespace: default\nspec:\n  podSelector: {} \n  egress:\n  - to:\n    - namespaceSelector: {}\n    ports:\n    - protocol: UDP\n      port: 53\n  policyTypes:\n  - Egress<\/code><\/pre>\n<p>\nPr\u00e1zdny <code>podSelector<\/code> vyber\u00e1 v\u0161etky pady v priestore mien.<\/p>\n<p><img decoding=\"async\" alt=\"\u00davod do sie\u0165ov\u00fdch polit\u00edk Kubernetes pre bezpe\u010dnostn\u00fdch \u0161pecialistov\" src=\"\/wp-content\/uploads\/2019\/04\/5d6b627b69da980477b3910fbf4de6c1.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Prv\u00e9 zodpovedanie a poradie pravidiel<\/h2>\n<p>\nV be\u017en\u00fdch firewally je akcia (\"Povoli\u0165\" alebo \"Zaka\u017ei\u0165\") vo vz\u0165ahu k paketu ur\u010den\u00e1 prv\u00fdm pravidlom, ktor\u00e9mu vyhovuje. <b>V Kubernetes poradie polit\u00edk nem\u00e1 \u017eiadny v\u00fdznam.<\/b><\/p>\n<p>Predvolene, ke\u010f politiky nie s\u00fa nastaven\u00e9, komunik\u00e1cie medzi podmi s\u00fa povolen\u00e9 a m\u00f4\u017eu si slobodne vymie\u0148a\u0165 inform\u00e1cie. Akon\u00e1hle za\u010dnete formu\u013eova\u0165 politiky, ka\u017ed\u00fd pod, dotknut\u00fd aspo\u0148 jednou z nich, sa st\u00e1va izolovan\u00fdm v s\u00falade s disjunkciou (logick\u00fdm ALE) v\u0161etk\u00fdch polit\u00edk, ktor\u00e9 ho vybrali. Pody, ktor\u00e9 nie s\u00fa ovplyvnen\u00e9 \u017eiadnou politikou, zost\u00e1vaj\u00fa otvoren\u00e9.<\/p>\n<p>Toto spr\u00e1vanie m\u00f4\u017eete zmeni\u0165 pomocou pravidla \u010distenia.<\/p>\n<h2>Pravidlo \u010distenia (\"Zaka\u017ei\u0165\")<\/h2>\n<p>\nPolitiky firewallov zvy\u010dajne zakazuj\u00fa ak\u00fdko\u013evek explicitne neumo\u017enen\u00fd prenos.<\/p>\n<p><b>V Kubernetes neexistuje akcia \"zak\u00e1za\u0165\" (deny),<\/b>, av\u0161ak rovnak\u00e9ho efektu sa d\u00e1 dosiahnu\u0165 s obvyklou (povolenou) politikou, vybrat\u00edm pr\u00e1zdnej skupiny podov-zdrojov (ingress):<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: deny-all\n  namespace: default\nspec:\n  podSelector: {}\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do sie\u0165ov\u00fdch polit\u00edk Kubernetes pre bezpe\u010dnostn\u00fdch \u0161pecialistov\" src=\"\/wp-content\/uploads\/2019\/04\/8b3ced50ec5a1de70940d53f467966fe.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nT\u00e1to politika vyber\u00e1 v\u0161etky pod v namespace a nech\u00e1va ingress neur\u010den\u00fd, \u010d\u00edm zakazuje cel\u00fd prich\u00e1dzaj\u00faci traffic.<\/p>\n<p>Podobn\u00fdm sp\u00f4sobom je mo\u017en\u00e9 obmedzi\u0165 cel\u00fd odch\u00e1dzaj\u00faci prenos z priestoru mien:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: deny-all-egress\n  namespace: default\nspec:\n  podSelector: {}\n  policyTypes:\n  - Egress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do sie\u0165ov\u00fdch polit\u00edk Kubernetes pre bezpe\u010dnostn\u00fdch \u0161pecialistov\" src=\"\/wp-content\/uploads\/2019\/04\/be22e11efef0098f2665331c09d748f2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nMajte na pam\u00e4ti, \u017ee <b>ak\u00e9ko\u013evek \u010fal\u0161ie politiky, ktor\u00e9 povo\u013euj\u00fa traffic k podom v namespace, bud\u00fa ma\u0165 prednos\u0165 pred touto pravidlom<\/b> (podobne ako pridanie povo\u013euj\u00faceho pravidla pred zakazuj\u00facim v konfigur\u00e1cii firewallu).<\/p>\n<h2>Povoli\u0165 v\u0161etko (Any-Any-Any-Allow)<\/h2>\n<p>\nAk chcete vytvori\u0165 politiku 'Povoli\u0165 v\u0161etko', mus\u00edte doplni\u0165 vy\u0161\u0161ie uveden\u00fa zakazuj\u00facu politiku pr\u00e1zdnym prvkom <code>ingress<\/code>:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: allow-all\n  namespace: default\nspec:\n  podSelector: {}\n  ingress: # &lt;&lt;&lt;\n  - {}     # &lt;&lt;&lt;\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do sie\u0165ov\u00fdch polit\u00edk Kubernetes pre bezpe\u010dnostn\u00fdch \u0161pecialistov\" src=\"\/wp-content\/uploads\/2019\/04\/7322351493211388fe772b8dc270108d.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nOtv\u00e1ra pr\u00edstup zo <b>v\u0161etk\u00fdch podov vo v\u0161etk\u00fdch namespace (a v\u0161etk\u00fdch IP) k ak\u00e9muko\u013evek podu v namespace <code>default<\/code><\/b>. Tak\u00e9to spr\u00e1vanie je predvolene zapnut\u00e9, a preto ho zvy\u010dajne netreba dodato\u010dne definova\u0165. Ob\u010das v\u0161ak m\u00f4\u017ee by\u0165 potrebn\u00e9 do\u010dasne zak\u00e1za\u0165 niektor\u00e9 konkr\u00e9tne povolenia na diagnostiku probl\u00e9mu.<\/p>\n<p>Pravidlo mo\u017eno z\u00fa\u017ei\u0165 a povoli\u0165 pr\u00edstup iba k <b>ur\u010dit\u00e9mu s\u00faboru podov<\/b> (<code>app:balance<\/code>) v priestore mien <code>default<\/code>:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: allow-all-to-balance\n  namespace: default\nspec:\n  podSelector:\n    matchLabels:\n      app: balance\n  ingress: \n  - {}\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do sie\u0165ov\u00fdch polit\u00edk Kubernetes pre bezpe\u010dnostn\u00fdch \u0161pecialistov\" src=\"\/wp-content\/uploads\/2019\/04\/d8c9cb85003f489acec815d1c2b53497.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNasleduj\u00faca politika povo\u013euje cel\u00fd prich\u00e1dzaj\u00faci (ingress) a odch\u00e1dzaj\u00faci (egress) prenos, vr\u00e1tane pr\u00edstupu k ak\u00e9muko\u013evek IP mimo klastra:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: allow-all\nspec:\n  podSelector: {}\n  ingress:\n  - {}\n  egress:\n  - {}\n  policyTypes:\n  - Ingress\n  - Egress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do sie\u0165ov\u00fdch polit\u00edk Kubernetes pre bezpe\u010dnostn\u00fdch \u0161pecialistov\" src=\"\/wp-content\/uploads\/2019\/04\/2477f18d3d228f80bc5169d9ec3be2fc.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<img decoding=\"async\" alt=\"\u00davod do sie\u0165ov\u00fdch polit\u00edk Kubernetes pre bezpe\u010dnostn\u00fdch \u0161pecialistov\" src=\"\/wp-content\/uploads\/2019\/04\/3502b892713cdac8850e812b2eff3ea3.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Kombinovanie nieko\u013ek\u00fdch polit\u00edk<\/h2>\n<p>\nPolitiky sa kombinuj\u00fa pomocou logick\u00e9ho OR na troch \u00farovniach; povolenia ka\u017ed\u00e9ho podu s\u00fa stanoven\u00e9 pod\u013ea disjunkcie v\u0161etk\u00fdch polit\u00edk, ktor\u00e9 sa ho t\u00fdkaj\u00fa:<\/p>\n<p>1. V poliach <code>z<\/code> a <code>to<\/code> m\u00f4\u017eete definova\u0165 tri typy prvkov (v\u0161etky sa kombinuj\u00fa pomocou OR):<\/p>\n<ul>\n<li> <code>namespaceSelector<\/code> \u2014 vyber\u00e1 cel\u00fd priestor mien;<\/li>\n<li> <code>podSelector<\/code> \u2014 vyber\u00e1 podov;<\/li>\n<li> <code>ipBlock<\/code> \u2014 vyber\u00e1 podsie\u0165.<\/li>\n<\/ul>\n<p>\nPri tom po\u010det prvkov (aj rovnak\u00fdch) v podsekci\u00e1ch <code>z<\/code>\/<code>to<\/code> nie je obmedzen\u00fd. V\u0161etky bud\u00fa kombinovan\u00e9 logick\u00fdm OR.<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.postgres\n  namespace: default\nspec:\n  ingress:\n  - from:\n    - podSelector:\n        matchLabels:\n          app: indexer\n    - podSelector:\n        matchLabels:\n          app: admin\n  podSelector:\n    matchLabels:\n      app: postgres\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do sie\u0165ov\u00fdch polit\u00edk Kubernetes pre bezpe\u010dnostn\u00fdch \u0161pecialistov\" src=\"\/wp-content\/uploads\/2019\/04\/717e745720f39260a8508fb2b2bb6f65.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n2. Vn\u00fatri politiky m\u00f4\u017ee by\u0165 sekcia <code>ingress<\/code> mno\u017estvo prvkov <code>z<\/code> (sp\u00e1jaj\u00fa sa logick\u00fdm OR). Podobne sekcia <code>egress<\/code> m\u00f4\u017ee obsahova\u0165 mno\u017estvo prvkov <code>to<\/code> (tie\u017e spojen\u00e9 disjunkciou):<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.postgres\n  namespace: default\nspec:\n  ingress:\n  - from:\n    - podSelector:\n        matchLabels:\n          app: indexer\n  - from:\n    - podSelector:\n        matchLabels:\n          app: admin\n  podSelector:\n    matchLabels:\n      app: postgres\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do sie\u0165ov\u00fdch polit\u00edk Kubernetes pre bezpe\u010dnostn\u00fdch \u0161pecialistov\" src=\"\/wp-content\/uploads\/2019\/04\/b579e1f4b97acd92fb38cd6703aa1983.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n3. R\u00f4zne politiky sa tie\u017e sp\u00e1jaj\u00fa logick\u00fdm OR<\/p>\n<p>Ale pri ich kombin\u00e1cii existuje jedno obmedzenie, na ktor\u00e9 <noindex><a rel=\"nofollow\" href=\"https:\/\/medium.com\/sainsburys-engineering\/considerations-with-k8s-networkpolicy-cee7eacf5469\">uviedol<\/a><\/noindex> <noindex><a rel=\"nofollow\" href=\"https:\/\/medium.com\/@chriscooney\">Chris Cooney<\/a><\/noindex>: Kubernetes m\u00f4\u017ee kombinova\u0165 politiky iba s r\u00f4znymi <code>policyTypes<\/code> (<code>Ingress<\/code> alebo <code>Egress<\/code>). Politiky, ktor\u00e9 ur\u010duj\u00fa ingress (alebo egress), si navz\u00e1jom prepisuj\u00fa pravidl\u00e1.<\/p>\n<h2>Vz\u0165ah medzi priestormi n\u00e1zvov<\/h2>\n<p>\nPredvolene je v\u00fdmena inform\u00e1ci\u00ed medzi priestormi n\u00e1zvov povolen\u00e1. To je mo\u017en\u00e9 zmeni\u0165 pomocou obmedzuj\u00facej politiky, ktor\u00e1 obmedz\u00ed odch\u00e1dzaj\u00facu a\/alebo prich\u00e1dzaj\u00facu prev\u00e1dzku v priestore n\u00e1zvov (pozri \"Z\u00e1sadu \u010distenia\" vy\u0161\u0161ie).<\/p>\n<p>Zablokovan\u00edm pr\u00edstupu do priestoru n\u00e1zvov (pozri \"Z\u00e1sadu \u010distenia\" vy\u0161\u0161ie) m\u00f4\u017eete urobi\u0165 v\u00fdnimky z obmedzuj\u00facej politiky, ktor\u00e1 umo\u017en\u00ed pripojenia z ur\u010dit\u00e9ho priestoru n\u00e1zvov pomocou <code>namespaceSelector<\/code>:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: database.postgres\n  namespace: database\nspec:\n  podSelector:\n    matchLabels:\n      app: postgres\n  ingress:\n  - from:\n    - namespaceSelector: # &lt;&lt;&lt;\n        matchLabels:\n          namespace: default\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do sie\u0165ov\u00fdch polit\u00edk Kubernetes pre bezpe\u010dnostn\u00fdch \u0161pecialistov\" src=\"\/wp-content\/uploads\/2019\/04\/5a3d2baed1ff9b813ef0651fe500ad8a.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nV\u00fdsledkom je, \u017ee v\u0161etky pod-y v priestore n\u00e1zvov <code>default<\/code> z\u00edskaj\u00fa pr\u00edstup k podom <code>postgres<\/code> v priestore n\u00e1zvov <code>database<\/code>. Ale \u010do ak chcete otvori\u0165 pr\u00edstup k <code>postgres<\/code> iba konkr\u00e9tnym podom v namespace <code>default<\/code>?<\/p>\n<h2>Filter pod\u013ea namespace a podov<\/h2>\n<p>\nKubernetes verzie 1.11 a vy\u0161\u0161ie umo\u017e\u0148uje kombinova\u0165 oper\u00e1tory <code>namespaceSelector<\/code> a <code>podSelector<\/code> pomocou logick\u00e9ho AND. Vyzer\u00e1 to nasledovne:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: database.postgres\n  namespace: database\nspec:\n  podSelector:\n    matchLabels:\n      app: postgres\n  ingress:\n  - from:\n    - namespaceSelector:\n        matchLabels:\n          namespace: default\n      podSelector: # &lt;&lt;&lt;\n        matchLabels:\n          app: admin\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do sie\u0165ov\u00fdch polit\u00edk Kubernetes pre bezpe\u010dnostn\u00fdch \u0161pecialistov\" src=\"\/wp-content\/uploads\/2019\/04\/e933e449d9f9c10505e45930d1477b2c.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPre\u010do je to interpretovan\u00e9 ako AND namiesto be\u017en\u00e9ho OR?<\/p>\n<p>V\u0161imnite si, \u017ee <code>podSelector<\/code> nezap\u00edna sa poml\u010dkou. V YAML to znamen\u00e1, \u017ee <code>podSelector<\/code> a stojaci pred n\u00edm <code>namespaceSelector<\/code> patria do tej istej polo\u017eky zoznamu. Preto sa sp\u00e1jaj\u00fa logick\u00fdm AND.<\/p>\n<p>Pridanie poml\u010dky pred <code>podSelector<\/code> vytvor\u00ed nov\u00fd prvok zoznamu, ktor\u00fd sa skombinuje s predch\u00e1dzaj\u00facim <code>namespaceSelector<\/code> s pomocou logick\u00e9ho ALE.<\/p>\n<p>Aby ste vybrali pod s konkr\u00e9tnym labelom <b>vo v\u0161etk\u00fdch menn\u00fdch priestoroch<\/b>, zadajte pr\u00e1zdny <code>namespaceSelector<\/code>:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: database.postgres\n  namespace: database\nspec:\n  podSelector:\n    matchLabels:\n      app: postgres\n  ingress:\n  - from:\n    - namespaceSelector: {}\n      podSelector:\n        matchLabels:\n          app: admin\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do sie\u0165ov\u00fdch polit\u00edk Kubernetes pre bezpe\u010dnostn\u00fdch \u0161pecialistov\" src=\"\/wp-content\/uploads\/2019\/04\/e79e4a8067fa254f85fa8be105c3ad34.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Viacer\u00e9 labely sa kombinuj\u00fa s A<\/h2>\n<p>\nPravidl\u00e1 pre firewall s viacer\u00fdmi objektmi (hostite\u013emi, sie\u0165ami, skupinami) sa kombinuj\u00fa pomocou logick\u00e9ho ALE. Nasleduj\u00face pravidlo sa spust\u00ed, ak zdroj bal\u00edka s\u00fahlas\u00ed s <code>Host_1<\/code> ALEBO <code>Host_2<\/code>:<\/p>\n<pre><code class=\"plaintext\">| Zdroj | Cie\u013e | Slu\u017eba | Akcia |\n| ----------------------------------------|\n| Host_1 | Subnet_A    | HTTPS   | Povoli\u0165  |\n| Host_2 |             |         |        |\n| ----------------------------------------|<\/code><\/pre>\n<p>\nNaopak, v Kubernetes sa r\u00f4zne labely <code>podSelector<\/code> alebo <code>namespaceSelector<\/code> kombinuj\u00fa logick\u00fdm A. Napr\u00edklad, nasleduj\u00face pravidlo vyberie pod\u2019y, ktor\u00e9 maj\u00fa obidva labely, <code>role=db<\/code> A <code>version=v2<\/code>:<\/p>\n<pre><code class=\"plaintext\">podSelector:\n  matchLabels:\n    role: db\n    version: v2<\/code><\/pre>\n<p>\nT\u00e1 ist\u00e1 logika sa uplat\u0148uje na v\u0161etky typy oper\u00e1torov: selektory cie\u013eovej politiky, selektory podov a selektory namespace.<\/p>\n<h2>Podnety a IP adresy (IPBlocks)<\/h2>\n<p>\nNa segment\u00e1ciu siete firewally pou\u017e\u00edvaj\u00fa VLAN, IP adresy a podnety.<\/p>\n<p>V Kubernetes s\u00fa IP adresy prira\u010fovan\u00e9 podom automaticky a m\u00f4\u017eu sa \u010dasto meni\u0165, preto sa na vyberanie podov a namespace v sie\u0165ov\u00fdch politik\u00e1ch pou\u017e\u00edvaj\u00fa labely.<\/p>\n<p>Podnety (<code>ipBlocks<\/code>) sa pou\u017e\u00edvaj\u00fa na riadenie prich\u00e1dzaj\u00facich (ingress) alebo odch\u00e1dzaj\u00facich (egress) vonkaj\u0161\u00edch (North-South) pripojen\u00ed. Napr\u00edklad, t\u00e1to politika otv\u00e1ra pr\u00edstup v\u0161etk\u00fdm podom z namespace <code>default<\/code> pr\u00edstup k DNS slu\u017ebe Google:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: egress-dns\n  namespace: default\nspec:\n  podSelector: {}\n  policyTypes:\n  - Egress\n  egress:\n  - to:\n    - ipBlock:\n        cidr: 8.8.8.8\/32\n    ports:\n    - protocol: UDP\n      port: 53<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do sie\u0165ov\u00fdch polit\u00edk Kubernetes pre bezpe\u010dnostn\u00fdch \u0161pecialistov\" src=\"\/wp-content\/uploads\/2019\/04\/42e1194e28331e667a094f19c88e0934.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPr\u00e1zdny selektor podov v tomto pr\u00edklade znamen\u00e1 \u201evybra\u0165 v\u0161etky pod v namespace\u201c.<\/p>\n<p>T\u00e1to politika otvor\u00ed pr\u00edstup iba k 8.8.8.8; pr\u00edstup k ak\u00e9muko\u013evek in\u00e9mu IP je zak\u00e1zan\u00fd. T\u00fdmto sp\u00f4sobom v podstate blokujete pr\u00edstup k vn\u00fatorn\u00fdm slu\u017eb\u00e1m DNS Kubernetes. Ak to v\u0161ak chcete povoli\u0165, uve\u010fte to v\u00fdslovne.<\/p>\n<p>Obvykle <code>ipBlocks<\/code> a <code>podSelectors<\/code> s\u00fa vz\u00e1jomne vylu\u010duj\u00face, ke\u010f\u017ee vn\u00fatorn\u00e9 IP adresy podov sa v <code>ipBlocks<\/code>. Uveden\u00edm <b>vn\u00fatorn\u00e9 IP podov<\/b>, v skuto\u010dnosti povol\u00edte pripojenia k\/od podov s t\u00fdmito adresami. V praxi nebudete vedie\u0165, ktor\u00fa IP adresu pou\u017ei\u0165, a preto by sa nemali pou\u017e\u00edva\u0165 na v\u00fdber podov.<\/p>\n<p>Ako kontra-pr\u00edklad nasleduj\u00faca politika zah\u0155\u0148a v\u0161etky IP a t\u00fdm p\u00e1dom povo\u013euje pr\u00edstup ku v\u0161etk\u00fdm ostatn\u00fdm podom:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: egress-any\n  namespace: default\nspec:\n  podSelector: {}\n  policyTypes:\n  - Egress\n  egress:\n  - to:\n    - ipBlock:\n        cidr: 0.0.0.0\/0<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do sie\u0165ov\u00fdch polit\u00edk Kubernetes pre bezpe\u010dnostn\u00fdch \u0161pecialistov\" src=\"\/wp-content\/uploads\/2019\/04\/d99dfdead1c96b071b1643cb5c572878.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nM\u00f4\u017eete otvori\u0165 pr\u00edstup iba k vonkaj\u0161\u00edm IP, pri\u010dom vn\u00fatorn\u00e9 IP adresy podov s\u00fa vyl\u00fa\u010den\u00e9. Napr\u00edklad, ak je podsiete v\u00e1\u0161ho podu 10.16.0.0\/14:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: egress-any\n  namespace: default\nspec:\n  podSelector: {}\n  policyTypes:\n  - Egress\n  egress:\n  - to:\n    - ipBlock:\n        cidr: 0.0.0.0\/0\n        except:\n        - 10.16.0.0\/14<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do sie\u0165ov\u00fdch polit\u00edk Kubernetes pre bezpe\u010dnostn\u00fdch \u0161pecialistov\" src=\"\/wp-content\/uploads\/2019\/04\/b157cfe0f1cd4677cf0defd9fdfa8a13.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Porty a protokoly<\/h2>\n<p>\nObvykle pod po\u010d\u00fava jeden port. To znamen\u00e1, \u017ee m\u00f4\u017eete jednoducho neuv\u00e1dza\u0165 \u010d\u00edsla portov v politik\u00e1ch a necha\u0165 v\u0161etko na predvolen\u00e9 hodnoty. Av\u0161ak politiky sa odpor\u00fa\u010da robi\u0165 maxim\u00e1lne obmedzuj\u00face, a preto v niektor\u00fdch pr\u00edpadoch je predsa len mo\u017en\u00e9 uv\u00e1dza\u0165 porty:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.postgres\n  namespace: default\nspec:\n  ingress:\n  - from:\n    - podSelector:\n        matchLabels:\n          app: indexer\n    - podSelector:\n        matchLabels:\n          app: admin\n    ports:             # &lt;&lt;&lt;&lt;\n      - port: 443      # &lt;&lt;&lt;&lt;\n        protocol: TCP  # &lt;&lt;&lt;&lt;\n      - port: 80       # &lt;&lt;&lt;&lt;\n        protocol: TCP  # &lt;&lt;&lt;&lt;\n  podSelector:\n    matchLabels:\n      app: postgres\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do sie\u0165ov\u00fdch polit\u00edk Kubernetes pre bezpe\u010dnostn\u00fdch \u0161pecialistov\" src=\"\/wp-content\/uploads\/2019\/04\/4c778cd46c54e2ae0f4527ffa9e1e740.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nV\u0161imnite si, \u017ee selektor <code>ports<\/code> sa aplikuje na v\u0161etky prvky v bloku <code>to<\/code> alebo <code>z<\/code>, v ktorom je obsiahnut\u00fd. Aby ste uviedli r\u00f4zne porty pre r\u00f4zne skupiny prvkov, rozde\u013ete <code>ingress<\/code> alebo <code>egress<\/code> na nieko\u013eko podsekci\u00ed s <code>to<\/code> alebo <code>z<\/code> a v ka\u017edej uve\u010fte svoje porty:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.postgres\n  namespace: default\nspec:\n  ingress:\n  - from:\n    - podSelector:\n        matchLabels:\n          app: indexer\n    ports:             # &lt;&lt;&lt;&lt;\n     - port: 443       # &lt;&lt;&lt;&lt;\n       protocol: TCP   # &lt;&lt;&lt;&lt;\n  - from:\n    - podSelector:\n        matchLabels:\n          app: admin\n    ports:             # &lt;&lt;&lt;&lt;\n     - port: 80        # &lt;&lt;&lt;&lt;\n       protocol: TCP   # &lt;&lt;&lt;&lt;\n  podSelector:\n    matchLabels:\n      app: postgres\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"\u00davod do sie\u0165ov\u00fdch polit\u00edk Kubernetes pre bezpe\u010dnostn\u00fdch \u0161pecialistov\" src=\"\/wp-content\/uploads\/2019\/04\/b9ac1d8af491e992cac0be184005a278.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nFunkcia portov predvolene:<\/p>\n<ul>\n<li> Ak \u00faplne vynech\u00e1te defin\u00edciu portov (<code>ports<\/code>), znamen\u00e1 to v\u0161etky protokoly a v\u0161etky porty;<\/li>\n<li> Ak vynech\u00e1te defin\u00edciu protokolu (<code>protocol<\/code>), znamen\u00e1 to TCP;<\/li>\n<li> Ak vynech\u00e1te defin\u00edciu portu (<code>port<\/code>), znamen\u00e1 to v\u0161etky porty.<\/li>\n<\/ul>\n<p>\nNajlep\u0161ia prax: nespoliehajte sa na predvolen\u00e9 hodnoty, uv\u00e1dzajte to, \u010do potrebujete, jednozna\u010dne.<\/p>\n<p>V\u0161imnite si, \u017ee je potrebn\u00e9 pou\u017e\u00edva\u0165 porty podov, a nie slu\u017eieb (viac o tom v nasleduj\u00facom odseku).<\/p>\n<h2>S\u00fa politiky definovan\u00e9 pre pod alebo slu\u017eby?<\/h2>\n<p>\nZvy\u010dajne sa pod-y v Kubernetes vz\u00e1jomne oslovuj\u00fa cez slu\u017eby \u2014 virtu\u00e1lne vyrovn\u00e1va\u010de z\u00e1\u0165a\u017ee, ktor\u00e9 smeruj\u00fa dopravu na pod-y, ktor\u00e9 realizuj\u00fa slu\u017ebu. M\u00f4\u017ee sa zda\u0165, \u017ee sie\u0165ov\u00e9 politiky kontroluj\u00fa pr\u00edstup k slu\u017eb\u00e1m, ale to nie je pravda. <b>Sie\u0165ov\u00e9 politiky Kubernetes pracuj\u00fa s portami podov, a nie slu\u017eieb.<\/b><\/p>\n<p>Napr\u00edklad, ak slu\u017eba po\u010d\u00fava na 80. porte, ale smeruje dopravu na port 8080 svojich podov, v sie\u0165ovej politike je potrebn\u00e9 uvies\u0165 pr\u00e1ve 8080.<\/p>\n<p>Tak\u00fdto mechanizmus je potrebn\u00e9 pova\u017eova\u0165 za suboptim\u00e1lny: pri zmene vn\u00fatornej \u0161trukt\u00fary slu\u017eby (porty, na ktor\u00fdch po\u010d\u00favaj\u00fa pod-y) bude potrebn\u00e9 aktualizova\u0165 sie\u0165ov\u00e9 politiky.<\/p>\n<p>Nov\u00fd architektonick\u00fd pr\u00edstup pomocou Service Mesh <i>(napr\u00edklad pozri ni\u017e\u0161ie o Istio \u2014 pozn. prekl.)<\/i> umo\u017e\u0148uje rie\u0161i\u0165 tento probl\u00e9m.<\/p>\n<h2>Je potrebn\u00e9 nastavi\u0165 ako Ingress, tak aj Egress?<\/h2>\n<p>\nKr\u00e1tka odpove\u010f je \u00e1no, aby pod A mohol komunikova\u0165 s podom B, je potrebn\u00e9 mu povoli\u0165 vytvorenie odch\u00e1dzaj\u00faceho spojenia (na to je potrebn\u00e9 nastavi\u0165 egress politiku), a pod B mus\u00ed ma\u0165 mo\u017enos\u0165 prij\u00edma\u0165 prich\u00e1dzaj\u00face spojenie (na to, samozrejme, potrebujeme ingress politiku).<\/p>\n<p>V praxi sa v\u0161ak m\u00f4\u017eete spo\u013eahn\u00fa\u0165 na politiku predvolene, ktor\u00e1 povo\u013euje spojenia v jednom alebo oboch smeroch.<\/p>\n<p>Ak pod-<b>zdroj<\/b> je vybran\u00fd jednou alebo viacer\u00fdmi <b>egress<\/b>-politikami, obmedzenia, ktor\u00e9 sa na neho vz\u0165ahuj\u00fa, bud\u00fa ur\u010den\u00e9 ich disjunkciou. V takom pr\u00edpade bude potrebn\u00e9 v\u00fdslovne povoli\u0165 pripojenie k podu-<b>cie\u013eu<\/b>. Ak pod nie je vybran\u00fd \u017eiadnou politikou, jeho odch\u00e1dzaj\u00faca (egress) doprava je povolen\u00e1 predvolene.<\/p>\n<p>Podobn\u00fdm sp\u00f4sobom bude osud pod-u-<b>cie\u013ea<\/b>, ktor\u00fd je vybran\u00fd jednou alebo viacer\u00fdmi <b>ingress<\/b>-polit\u00edk ur\u010dovan\u00fd ich disjunkciou. V tomto pr\u00edpade je potrebn\u00e9 explicitne povoli\u0165 mu prij\u00edma\u0165 dopravu od pod-u-zdroja. Ak pod nie je vybran\u00fd \u017eiadnou politikou, cel\u00e1 pr\u00edchoz\u00ed (ingress) doprava pre\u0148 je povolen\u00e1 predvolene.<\/p>\n<p>Pozri bod \u201eStateful alebo Stateless\u201c ni\u017e\u0161ie.<\/p>\n<h2>Logy<\/h2>\n<p>\nSie\u0165ov\u00e9 politiky Kubernetes nevedia zaznamen\u00e1va\u0165 dopravu. To s\u0165a\u017euje ur\u010denie, \u010di politika funguje spr\u00e1vne, a zna\u010dne komplikuje anal\u00fdzu v oblasti bezpe\u010dnosti.<\/p>\n<h2>Kontrola nad dopravou k extern\u00fdm slu\u017eb\u00e1m<\/h2>\n<p>\nSie\u0165ov\u00e9 politiky Kubernetes neumo\u017e\u0148uj\u00fa uv\u00e1dza\u0165 \u00fapln\u00e9 dom\u00e9nov\u00e9 meno (DNS) v sekci\u00e1ch egress. Tento fakt sp\u00f4sobuje v\u00fdrazn\u00e9 nev\u00fdhody pri pokuse o obmedzenie prenosu k vonkaj\u0161\u00edm adres\u00e1tom, ktor\u00ed nemaj\u00fa pevn\u00fd IP adresa (ako napr\u00edklad aws.com).<\/p>\n<h2>Kontrola politiky<\/h2>\n<p>\nFirewally v\u00e1s upozornia alebo dokonca odmietnu prija\u0165 neplatn\u00fa politiku. Kubernetes tie\u017e vykon\u00e1va niektor\u00e9 verifik\u00e1cie. Pri zad\u00e1van\u00ed sie\u0165ovej politiky cez kubectl m\u00f4\u017ee Kubernetes ozn\u00e1mi\u0165, \u017ee je neplatn\u00e1, a odmietnu\u0165 ju prija\u0165. V in\u00fdch pr\u00edpadoch Kubernetes politiku prijme a dopln\u00ed ch\u00fdbaj\u00face detaily. Tieto m\u00f4\u017eete z\u00edska\u0165 pomocou pr\u00edkazu:<\/p>\n<pre><code class=\"plaintext\">kubernetes get networkpolicy  -o yaml<\/code><\/pre>\n<p>\nMajte na pam\u00e4ti, \u017ee overovac\u00ed syst\u00e9m Kubernetes nie je neomyln\u00fd a m\u00f4\u017ee prehliadn\u00fa\u0165 niektor\u00e9 typy ch\u00fdb.<\/p>\n<h2>Vykonanie<\/h2>\n<p>\nKubernetes s\u00e1m o sebe nerealizuje sie\u0165ov\u00e9 politiky, ale sl\u00fa\u017ei len ako API br\u00e1na, pri\u010dom \u0165a\u017ek\u00fa pr\u00e1cu kontroly na\u010d\u00edta na podriaden\u00fd syst\u00e9m naz\u00fdvan\u00fd Container Networking Interface (CNI). Nastavenie polit\u00edk v klustre Kubernetes bez priradenia zodpovedaj\u00faceho CNI je podobn\u00e9 vytvoreniu polit\u00edk na spr\u00e1vcovskom serveri firewall bez ich n\u00e1sledn\u00e9ho nastavenia v firewally. Mus\u00edte sa sami uisti\u0165, \u017ee m\u00e1te d\u00f4stojn\u00fd CNI alebo, v pr\u00edpade platforiem Kubernetes umiestnen\u00fdch v cloude, <i>(zo zoznamom poskytovate\u013eov sa m\u00f4\u017eete obozn\u00e1mi\u0165 <noindex>tu<\/noindex> \u2014 pozn. prekl.)<\/i>, implementova\u0165 sie\u0165ov\u00e9 politiky, ktor\u00e9 CNI nastav\u00ed za v\u00e1s.<\/p>\n<p>V\u0161imnite si, \u017ee Kubernetes v\u00e1s neupozorn\u00ed, ak nastav\u00edte sie\u0165ov\u00fa politiku bez zodpovedaj\u00faceho pomocn\u00e9ho CNI.<\/p>\n<h3>Stateful alebo Stateless?<\/h3>\n<p>\nV\u0161etky CNI Kubernetes, s ktor\u00fdmi som sa stretol, uchov\u00e1vaj\u00fa stavy (napr\u00edklad Calico pou\u017e\u00edva Linux conntrack). To umo\u017e\u0148uje podu prij\u00edma\u0165 odpovede na jeho iniciovan\u00e9 TCP pripojenia bez nutnosti jeho op\u00e4tovn\u00e9ho nadv\u00e4zovania. V tejto s\u00favislosti nepozn\u00e1m \u0161tandard Kubernetes, ktor\u00fd by zaru\u010dil uchov\u00e1vanie stavu (statefulness).<\/p>\n<h2>Pokro\u010dil\u00e9 riadenie bezpe\u010dnostnej politiky<\/h2>\n<p>\nTu je nieko\u013eko sp\u00f4sobov, ako zv\u00fd\u0161i\u0165 \u00fa\u010dinnos\u0165 vykon\u00e1vania bezpe\u010dnostnej politiky v Kubernetes:<\/p>\n<ol>\n<li> Architektonick\u00fd vzor Service Mesh vyu\u017e\u00edva sidecar kontajnery na poskytovanie podrobnej telemetrie a kontroly prenosu na \u00farovni slu\u017eieb. Ako pr\u00edklad mo\u017eno uvies\u0165 <noindex><a rel=\"nofollow\" href=\"https:\/\/istio.io\/\">Istio<\/a><\/noindex>.<\/li>\n<li> Niektor\u00ed poskytovatelia CNI vylep\u0161ili svoje n\u00e1stroje, aby presiahli r\u00e1mec sie\u0165ov\u00fdch polit\u00edk Kubernetes.<\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.tufin.com\/products\/tufin-orca\">Tufin Orca<\/a><\/noindex> poskytuje transparentnos\u0165 a automatiz\u00e1ciu sie\u0165ov\u00fdch polit\u00edk Kubernetes.<\/li>\n<\/ol>\n<p>\nBal\u00edk Tufin Orca spravuje sie\u0165ov\u00e9 politiky Kubernetes (a sl\u00fa\u017ei ako zdroj sn\u00edmok obrazovky uveden\u00fdch vy\u0161\u0161ie).<\/p>\n<h2>\u010eal\u0161ie inform\u00e1cie<\/h2>\n<p><\/p>\n<ul>\n<li> <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/ahmetb\/kubernetes-network-policy-recipes\">Pr\u00edklady sie\u0165ov\u00fdch polit\u00edk pripraven\u00e9 Ahmetom Alp Balkanom z GKE<\/a><\/noindex>;<\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"https:\/\/kubernetes.io\/docs\/concepts\/services-networking\/network-policies\/\">Dokument\u00e1cia z ofici\u00e1lnej str\u00e1nky Kubernetes<\/a><\/noindex>;<\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"https:\/\/sookocheff.com\/post\/kubernetes\/understanding-kubernetes-networking-model\/\">Pr\u00edru\u010dka k sie\u0165ov\u00e9mu modelu Kubernetes<\/a><\/noindex>;<\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/Tufin\/test-network-policies\">Skript na overenie sie\u0165ov\u00fdch polit\u00edk<\/a><\/noindex>.<\/li>\n<\/ul>\n<p><\/p>\n<h2>Z\u00e1ver<\/h2>\n<p>\nSie\u0165ov\u00e9 politiky Kubernetes pon\u00fakaj\u00fa slu\u0161n\u00fd s\u00fabor n\u00e1strojov na segment\u00e1ciu klastrov, av\u0161ak s\u00fa intuit\u00edvne nezrozumite\u013en\u00e9 a maj\u00fa mno\u017estvo jemnost\u00ed. Mysl\u00edm, \u017ee kv\u00f4li tejto zlo\u017eitosti politiky mnoh\u00fdch existuj\u00facich klastrov obsahuj\u00fa chyby. Mo\u017en\u00e9 rie\u0161enia tohto probl\u00e9mu zah\u0155\u0148aj\u00fa automatiz\u00e1ciu defin\u00edci\u00ed polit\u00edk alebo pou\u017eitie in\u00fdch n\u00e1strojov na segment\u00e1ciu.<\/p>\n<p>D\u00fafam, \u017ee t\u00e1to pr\u00edru\u010dka pom\u00f4\u017ee objasni\u0165 niektor\u00e9 ot\u00e1zky a vyrie\u0161i probl\u00e9my, s ktor\u00fdmi sa m\u00f4\u017eete stretn\u00fa\u0165.<\/p>\n<h2>P.S. od prekladate\u013ea<\/h2>\n<p>\nPre\u010d\u00edtajte si tie\u017e na na\u0161om blogu:<\/p>\n<ul>\n<li> \u201eSp\u00e4\u0165 k mikroslu\u017eb\u00e1m s Istio\u201c: <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/438426\/\">\u010das\u0165 1 (zozn\u00e1menie sa s hlavn\u00fdmi funkciami)<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/440378\/\">\u010das\u0165 2 (smerovanie, spr\u00e1va prev\u00e1dzky)<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/443668\/\">\u010das\u0165 3 (bezpe\u010dnos\u0165)<\/a><\/noindex>;<\/li>\n<li> \u201eIlustrovan\u00fd sprievodca architekt\u00farou siete v Kubernetes\u201c: <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/346304\/\">\u010das\u0165 1 a 2 (sie\u0165ov\u00fd model, overlay sie\u0165e)<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/433382\/\">\u010das\u0165 3 (slu\u017eby a spracovanie prev\u00e1dzky)<\/a><\/noindex>;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/440504\/\">Docker a Kubernetes v prostrediach s vysok\u00fdmi n\u00e1rokmi na bezpe\u010dnos\u0165<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/436300\/\">9 najlep\u0161\u00edch prakt\u00edk zabezpe\u010denia v Kubernetes<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/417905\/\">11 sp\u00f4sobov, ako (ne)sta\u0165 sa obe\u0165ou \u00fatoku v Kubernetes<\/a><\/noindex>\u00bb.<\/li>\n<\/ul>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/443190\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u0438\u043c. \u043f\u0435\u0440\u0435\u0432.: \u0410\u0432\u0442\u043e\u0440 \u0441\u0442\u0430\u0442\u044c\u0438 \u2014 Reuven Harrison \u2014 \u0438\u043c\u0435\u0435\u0442 \u0431\u043e\u043b\u0435\u0435 20 \u043b\u0435\u0442 \u043e\u043f\u044b\u0442\u0430 \u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f, \u0430 \u043d\u0430 \u0441\u0435\u0433\u043e\u0434\u043d\u044f\u0448\u043d\u0438\u0439 \u0434\u0435\u043d\u044c \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u043c \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u043e\u043c \u0438 \u0441\u043e\u0443\u0447\u0440\u0435\u0434\u0438\u0442\u0435\u043b\u0435\u043c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Tufin, \u0441\u043e\u0437\u0434\u0430\u044e\u0449\u0435\u0439 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430\u043c\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0420\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u044f \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 Kubernetes \u043a\u0430\u043a \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043c\u043e\u0449\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e \u0434\u043b\u044f \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0438 \u0432 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0435, \u043e\u043d \u0432 \u0442\u043e \u0436\u0435 \u0432\u0440\u0435\u043c\u044f \u0441\u0447\u0438\u0442\u0430\u0435\u0442, \u0447\u0442\u043e \u043e\u043d\u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":24432,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-32641","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0440\u0438\u043c.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/vvedenie-v-setevye-politiki-kubernetes-dlya-spetsialistov-po-bezopasnosti\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0432 \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 Kubernetes \u0434\u043b\u044f \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u043e\u0432 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0440\u0438\u043c.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/vvedenie-v-setevye-politiki-kubernetes-dlya-spetsialistov-po-bezopasnosti\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:48:11+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:48:11+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u00davod do sie\u0165ov\u00fdch polit\u00edk Kubernetes pre odborn\u00edkov na bezpe\u010dnos\u0165 | ProHoster","description":"Pr\u00edklad","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/vvedenie-v-setevye-politiki-kubernetes-dlya-spetsialistov-po-bezopasnosti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0432 \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 Kubernetes \u0434\u043b\u044f \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u043e\u0432 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 | ProHoster","og:description":"\u041f\u0440\u0438\u043c.","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/vvedenie-v-setevye-politiki-kubernetes-dlya-spetsialistov-po-bezopasnosti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:48:11+00:00","article:modified_time":"2019-10-31T18:48:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"32641","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 11:53:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:55:23","updated":"2026-01-21 11:53:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/32641","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=32641"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/32641\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/24432"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=32641"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=32641"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=32641"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}