{"id":32641,"date":"2019-10-31T21:48:11","date_gmt":"2019-10-31T18:48:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/vvedenie-v-setevye-politiki-kubernetes-dlya-spetsialistov-po-bezopasnosti\/"},"modified":"2019-10-31T21:48:11","modified_gmt":"2019-10-31T18:48:11","slug":"vvedenie-v-setevye-politiki-kubernetes-dlya-spetsialistov-po-bezopasnosti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/vvedenie-v-setevye-politiki-kubernetes-dlya-spetsialistov-po-bezopasnosti","title":{"rendered":"Hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/6972a1e1385463b1fcc723c09036a565.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i><b>Sh\u00ebn. p\u00ebrkth.<\/b>: Autori i artikullit \u2014 Reuven Harrison \u2014 ka m\u00eb shum\u00eb se 20 vjet p\u00ebrvoj\u00eb n\u00eb zhvillimin e software-it dhe aktualisht \u00ebsht\u00eb drejtori teknik dhe bashk\u00ebthemelues i kompanis\u00eb Tufin, e cila krijon zgjidhje p\u00ebr menaxhimin e politikave t\u00eb siguris\u00eb. Edhe pse i konsideron politikat e rrjetit n\u00eb Kubernetes si nj\u00eb mjet t\u00eb fuqish\u00ebm p\u00ebr segmentimin e rrjetit n\u00eb klaster, ai mendon se ato nuk jan\u00eb aq t\u00eb lehta n\u00eb praktik\u00eb. Ky material (mjaft i gjer\u00eb) ka p\u00ebr q\u00ebllim t\u00eb rris\u00eb nd\u00ebrgjegj\u00ebsimin e profesionist\u00ebve n\u00eb k\u00ebt\u00eb fush\u00eb dhe t'i ndihmoj\u00eb ata n\u00eb krijimin e konfigurimeve t\u00eb nevojshme.<\/i><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>Sot shum\u00eb kompani po zgjedhin gjithnj\u00eb e m\u00eb shum\u00eb Kubernetes p\u00ebr t\u00eb lansuar aplikacionet e tyre. Interesi p\u00ebr k\u00ebt\u00eb software \u00ebsht\u00eb aq i lart\u00eb sa disa e quajn\u00eb Kubernetes \u00absistemin e ri operativ p\u00ebr qendrat e t\u00eb dh\u00ebnave\u00bb. Gradualisht, Kubernetes (ose k8s) fillon t\u00eb perceptohet si nj\u00eb pjes\u00eb kritike e biznesit q\u00eb k\u00ebrkon organizimin e proceseve t\u00eb mira biznesore, p\u00ebrfshir\u00eb sigurimin e siguris\u00eb n\u00eb rrjet.<\/p>\n<p>P\u00ebr profesionist\u00ebt e siguris\u00eb, t\u00eb cil\u00ebt jan\u00eb t\u00eb shqet\u00ebsuar nga puna me Kubernetes, nj\u00eb zbulim i v\u00ebrtet\u00eb mund t\u00eb jet\u00eb politika e k\u00ebsaj platforme p\u00ebr default: lejo gjith\u00e7ka.<\/p>\n<p>Ky udh\u00ebzues do t'ju ndihmoj\u00eb t\u00eb kuptoni struktur\u00ebn e brendshme t\u00eb politikave t\u00eb rrjetit; t\u00eb kuptoni si dallohet ato nga rregullat p\u00ebr firewall-et e zakonsh\u00ebm. Gjithashtu, do t\u00eb flitet p\u00ebr disa pengesa dhe do t\u00eb jepen rekomandime q\u00eb do t'ju ndihmojn\u00eb t\u00eb mbroni aplikacionet n\u00eb Kubernetes.<\/p>\n<h2>Politikat e rrjetit Kubernetes<\/h2>\n<p>\nMekanizmi i politikave t\u00eb rrjetit n\u00eb Kubernetes lejon menaxhimin e nd\u00ebrveprimeve t\u00eb aplikacioneve t\u00eb vendosura n\u00eb platform\u00eb n\u00eb nivelin e rrjetit (niveli i tret\u00eb n\u00eb modelin OSI). Politikat e rrjetit i mungojn\u00eb disa funksione t\u00eb avancuara t\u00eb firewall-eve moderne, si kontrolli n\u00eb nivelin 7 t\u00eb OSI dhe zbardhja e rrezikut, megjithat\u00eb ato ofrojn\u00eb nj\u00eb nivel bazik t\u00eb siguris\u00eb n\u00eb rrjet, q\u00eb sh\u00ebrben si nj\u00eb pik\u00eb e mir\u00eb fillestare.<\/p>\n<h2>Politikat rrjetore kontrollojn\u00eb komunikacionet midis pod\u2019ave<\/h2>\n<p>\nNgarkesat n\u00eb Kubernetes shp\u00ebrndahen midis pod\u2019ave, t\u00eb cilat p\u00ebrb\u00ebhen nga nj\u00eb ose disa kontejner\u00eb, t\u00eb implementuar s\u00eb bashku. Kubernetes i cakton \u00e7do pod-i nj\u00eb adres\u00eb IP, e cila \u00ebsht\u00eb e qasshme nga pod\u2019a t\u00eb tjer\u00eb. Politikat rrjetore t\u00eb Kubernetes p\u00ebrcaktojn\u00eb t\u00eb drejtat e qasjes p\u00ebr grupe pod\u2019ash n\u00eb t\u00eb nj\u00ebjt\u00ebn m\u00ebnyr\u00eb si grupet e siguris\u00eb n\u00eb cloud p\u00ebrdoren p\u00ebr t\u00eb menaxhuar qasjen n\u00eb instancat e makinave virtuale.<\/p>\n<h2>P\u00ebrcaktimi i politikave rrjetore<\/h2>\n<p>\nSi t\u00eb gjitha burimet e tjera t\u00eb Kubernetes, politikat rrjetore p\u00ebrcaktohen n\u00eb gjuh\u00ebn YAML. N\u00eb shembullin e m\u00ebposht\u00ebm, aplikacionit <code>balance<\/code> i hapet ky\u00e7ja p\u00ebr <code>postgres<\/code>:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.postgres\n  namespace: default\nspec:\n  podSelector:\n    matchLabels:\n      app: postgres\n  ingress:\n  - from:\n    - podSelector:\n        matchLabels:\n          app: balance\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/ff5857af2641e62558b035bab9c413dc.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>(<b>Sh\u00ebn. p\u00ebrkth.<\/b>: ky screenshot, ashtu si t\u00eb gjith\u00eb screenshot-et e ngjashme t\u00eb m\u00ebvonshme, \u00ebsht\u00eb krijuar jo me mjete t\u00eb natyrshme t\u00eb Kubernetes, por me ndihm\u00ebn e mjetit Tufin Orca, zhvillimi i t\u00eb cilit mb\u00ebshtetet nga kompania e autorit t\u00eb artikullit origjinal dhe p\u00ebrmendet n\u00eb fund t\u00eb materialit.<\/i><\/p>\n<p>P\u00ebr t\u00eb p\u00ebrcaktuar politik\u00ebn tuaj t\u00eb rrjetit, do t'ju nevojiten njohuri bazike n\u00eb YAML. Kjo gjuh\u00eb bazohet n\u00eb hap\u00ebsira (t\u00eb p\u00ebrcaktuara me hap\u00ebsira, jo me tabulator\u00eb). Nj\u00eb element me hap\u00ebsira i p\u00ebrket elementit m\u00eb t\u00eb af\u00ebrt me hap\u00ebsira mbi t\u00eb. Nj\u00eb element i ri liste fillon me nj\u00eb defis, t\u00eb gjitha elementet e tjera kan\u00eb pamjen <i>\u00e7el\u00ebs-vler\u00eb<\/i>.<\/p>\n<p>Pas p\u00ebrshkrimit t\u00eb politik\u00ebs n\u00eb YAML, p\u00ebrdorni <noindex><a rel=\"nofollow\" href=\"https:\/\/kubernetes.io\/docs\/reference\/kubectl\/kubectl\/\">kubectl<\/a><\/noindex>, p\u00ebr ta krijuar at\u00eb n\u00eb klaster:<\/p>\n<pre><code class=\"bash\">kubectl create -f policy.yaml<\/code><\/pre>\n<p><\/p>\n<h2>Specifikimi i politik\u00ebs rrjetore<\/h2>\n<p>\nSpecifikimi i politik\u00ebs rrjetore t\u00eb Kubernetes p\u00ebrfshin kat\u00ebr elemente:<\/p>\n<ol>\n<li> <code>podSelector<\/code>: p\u00ebrcakton pod\u2019\u00ebt, t\u00eb goditur nga kjo politik\u00eb (q\u00ebllime) \u2014 obligator;<\/li>\n<li> <code>policyTypes<\/code>: tregon se cilat lloje politikash jan\u00eb t\u00eb p\u00ebrfshira: ingress dhe\/ose egress - e opcional, megjithat\u00eb e rekomandoj ta shkruani qart\u00eb n\u00eb t\u00eb gjitha rastet;<\/li>\n<li> <code>ingress<\/code>: p\u00ebrcakton trafikun e lejuar <b>n\u00eb<\/b> trafiku n\u00eb pod\u2019\u00ebt e synuar \u2014 joobligator;<\/li>\n<li> <code>egress<\/code>: p\u00ebrcakton trafikun e lejuar <b>trafiku<\/b> trafiku nga pod\u2019\u00ebt e synuar \u2014 joobligator.<\/li>\n<\/ol>\n<p>\nNj\u00eb shembull, e marr\u00eb nga faqja e Kubernetes (un\u00eb z\u00ebvend\u00ebsova <code>role<\/code> n\u00eb <code>app<\/code>), tregon se si p\u00ebrdoren t\u00eb kat\u00ebr elementet:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: test-network-policy\n  namespace: default\nspec:\n  podSelector:    # &lt;&lt;&lt;\n    matchLabels:\n      app: db\n  policyTypes:    # &lt;&lt;&lt;\n  - Ingress\n  - Egress\n  ingress:        # &lt;&lt;&lt;\n  - from:\n    - ipBlock:\n        cidr: 172.17.0.0\/16\n        except:\n        - 172.17.1.0\/24\n    - namespaceSelector:\n        matchLabels:\n          project: myproject\n    - podSelector:\n        matchLabels:\n          role: frontend\n    ports:\n    - protocol: TCP\n      port: 6379\n  egress:         # &lt;&lt;&lt;\n  - to:\n    - ipBlock:\n        cidr: 10.0.0.0\/24\n    ports:\n    - protocol: TCP\n      port: 5978<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/f01e748410564756d6272095093e52e2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<img decoding=\"async\" alt=\"Hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/997282073ee6b5c4d6b7af45cdc11295.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nVlenni se \u00e7do kat\u00ebr element\u00eb nuk jan\u00eb t\u00eb detyruesh\u00ebm. E vet\u00ebmjaftueshme \u00ebsht\u00eb <code>podSelector<\/code>, parametrat e tjer\u00eb mund t\u00eb p\u00ebrdoren sipas d\u00ebshir\u00ebs.<\/p>\n<p>N\u00ebse hiqet <code>policyTypes<\/code>, politika do t\u00eb interpretohet si n\u00eb vijim:<\/p>\n<ul>\n<li> Me default pranohet se ajo p\u00ebrcakton an\u00ebn ingress. N\u00ebse n\u00eb politik\u00eb nuk ka udh\u00ebzime t\u00eb qarta p\u00ebr k\u00ebt\u00eb, sistemi do t\u00eb mendoj\u00eb se gjith\u00eb trafiku \u00ebsht\u00eb i ndaluar.<\/li>\n<li> Sjellja n\u00eb an\u00ebn e egress do t\u00eb p\u00ebrkufizohet nga prania ose mungesa e parametrave t\u00eb p\u00ebrkatsh\u00ebm t\u00eb egress.<\/li>\n<\/ul>\n<p>\nP\u00ebr t\u00eb shmangur gabimet, rekomandoj <b>t\u00eb specifikoni gjithmon\u00eb qart\u00eb <code>policyTypes<\/code><\/b>.<\/p>\n<p>Sipas logjik\u00ebs s\u00eb m\u00ebsip\u00ebrme, n\u00eb rast se parametrat <code>ingress<\/code> dhe\/ose <code>egress<\/code> hiqen, politika do t\u00eb ndaloj\u00eb gjith\u00eb trafikun (shih \"Rregulli i pastrimit\" m\u00eb posht\u00eb).<\/p>\n<h2>Politika e paracaktuar \u00ebsht\u00eb lejohet<\/h2>\n<p>\nN\u00ebse politikat nuk jan\u00eb t\u00eb p\u00ebrcaktuara, Kubernetes automatikisht lejon t\u00eb gjith\u00eb trafikun. T\u00eb gjith\u00eb pod\u2019\u00ebt mund t\u00eb ndajn\u00eb informacion lirsh\u00ebm me nj\u00ebri-tjetrin. Nga k\u00ebndv\u00ebshtrimi i siguris\u00eb, kjo mund t\u00eb duket e paarsyeshme, por mbani mend se Kubernetes fillimisht u krijua nga zhvilluesit me q\u00ebllimin p\u00ebr t\u00eb siguruar bashk\u00ebpunimin e aplikacioneve. Politikat rrjetore u shtuan m\u00eb von\u00eb.<\/p>\n<h2>Hap\u00ebsirat emrash<\/h2>\n<p>\nHap\u00ebsirat emrash (Namespaces) jan\u00eb mekanizmi i bashk\u00ebpunimit n\u00eb Kubernetes. Ato jan\u00eb t\u00eb destinuara p\u00ebr t\u00eb izoluar ambientet logjike nga nj\u00ebra-tjetra, nd\u00ebrsa shk\u00ebmbimi i t\u00eb dh\u00ebnave mes hap\u00ebsirave \u00ebsht\u00eb lejuar automatikisht.<\/p>\n<p>Si shumica e komponent\u00ebve t\u00eb Kubernetes, politikat rrjetore q\u00ebndrojn\u00eb n\u00eb nj\u00eb hap\u00ebsir\u00eb emri t\u00eb caktuar. N\u00eb bllokun <code>metadata<\/code> mund t\u00eb specifikoni se kujt hap\u00ebsire i p\u00ebrket politika:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: test-network-policy\n  namespace: my-namespace  # &lt;&lt;&lt;\nspec:\n...<\/code><\/pre>\n<p>\nN\u00ebse hap\u00ebsira emri n\u00eb metadata nuk \u00ebsht\u00eb specifikuar qart\u00eb, sistemi do t\u00eb p\u00ebrdor\u00eb hap\u00ebsir\u00ebn e caktuar n\u00eb kubectl (me default <code>namespace=default<\/code>):<\/p>\n<pre><code class=\"bash\">kubectl apply -n my-namespace -f namespace.yaml<\/code><\/pre>\n<p>\nRekomandoj <b>t\u00eb specifikoni qart\u00eb hap\u00ebsir\u00ebn e emrit<\/b>, p\u00ebrve\u00e7 n\u00ebse po shkruani nj\u00eb politik\u00eb q\u00eb \u00ebsht\u00eb e destinuar p\u00ebr disa hap\u00ebsira emri.<\/p>\n<p><b>Kryesore<\/b> element <code>podSelector<\/code> n\u00eb politik\u00eb do t\u00eb p\u00ebrzgjedh\u00eb pod\u2019\u00ebt nga hap\u00ebsira em\u00ebrtimi, t\u00eb cil\u00ebs i p\u00ebrket politika (ai nuk ka qasje n\u00eb pod\u2019\u00ebt nga hap\u00ebsira t\u00eb tjera em\u00ebrtimi).<\/p>\n<p>N\u00eb t\u00eb nj\u00ebjt\u00ebn m\u00ebnyr\u00eb podSelector\u2019\u00ebt <b>n\u00eb blloqet ingress dhe egress<\/b> mund t\u00eb zgjedhin pod\u2019\u00ebt vet\u00ebm nga hap\u00ebsira e tyre emri, p\u00ebrve\u00e7 n\u00ebse i kombinoni ato me <code>namespaceSelector<\/code> (p\u00ebr k\u00ebt\u00eb do t\u00eb flitet n\u00eb seksionin \"Filtrimi sipas hap\u00ebsirave t\u00eb em\u00ebrtes\u00ebs dhe pod\u2019ave\").<\/p>\n<h2>Rregullat e em\u00ebrtimeve t\u00eb politikave<\/h2>\n<p>\nEmrat e politikave jan\u00eb unik\u00eb brenda nj\u00eb hap\u00ebsire emri. Nuk mund t\u00eb ket\u00eb dy politika me t\u00eb nj\u00ebjtin em\u00ebr n\u00eb nj\u00eb hap\u00ebsir\u00eb, por mund t\u00eb ket\u00eb politika me emra t\u00eb nj\u00ebjt\u00eb n\u00eb hap\u00ebsira t\u00eb ndryshme. Kjo \u00ebsht\u00eb e dobishme kur d\u00ebshironi t\u00eb rip\u00ebrdorni t\u00eb nj\u00ebjt\u00ebn politik\u00eb n\u00eb disa hap\u00ebsira.<\/p>\n<p>M\u00eb p\u00eblqen ve\u00e7an\u00ebrisht nj\u00eb nga metodat e em\u00ebrtes\u00ebs. Ajo p\u00ebrfshin kombinimin e emrit t\u00eb hap\u00ebsir\u00ebs emri me q\u00eblluar pod\u2019\u00ebt. P\u00ebr shembull:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.postgres  # &lt;&lt;&lt;\n  namespace: default\nspec:\n  podSelector:\n    matchLabels:\n      app: postgres\n  ingress:\n  - from:\n    - podSelector:\n        matchLabels:\n          app: admin\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/18318c320d6e37eeb01c51f251550639.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Etiketat<\/h2>\n<p>\nP\u00ebr objektet Kubernetes, si pod\u2019\u00ebt dhe hap\u00ebsirat e emrit, mund t\u00eb ngjiten etiketat e personalizuara. Etiketat (<i>labels<\/i> \u2014 etiketa) jan\u00eb ekuivalente t\u00eb etiketave n\u00eb cloud. Politikat e rrjetit Kubernetes p\u00ebrdorin etiketat p\u00ebr t\u00eb zgjedhur <b>pod\u2019\u00ebve<\/b>, p\u00ebr t\u00eb cilat ato aplikohen:<\/p>\n<pre><code class=\"plaintext\">podSelector:\n  matchLabels:\n    role: db<\/code><\/pre>\n<p>\n\u2026 ose <b>hap\u00ebsirave emri<\/b>, p\u00ebr t\u00eb cil\u00ebt ata aplikohen. N\u00eb k\u00ebt\u00eb shembull, p\u00ebrzgjidhen t\u00eb gjith\u00eb pod\u2019\u00ebt n\u00eb hap\u00ebsirat e em\u00ebrtes\u00ebs me etiketat p\u00ebrkat\u00ebse:<\/p>\n<pre><code class=\"plaintext\">namespaceSelector:\n  matchLabels:\n    project: myproject<\/code><\/pre>\n<p>\nNj\u00eb paralajm\u00ebrim: kur p\u00ebrdorni <code>namespaceSelector<\/code> <b>sigurohuni q\u00eb hap\u00ebsirat e zgjedhura t\u00eb p\u00ebrmbajn\u00eb etiket\u00ebn e nevojshme<\/b>. Mbani mend se hap\u00ebsirat e integruara, si <code>default<\/code> dhe <code>kube-system<\/code>, sipas parazgjedhjes nuk p\u00ebrmbajn\u00eb etiketa.<\/p>\n<p>Nj\u00eb etiket\u00eb mund t\u00eb shtohet n\u00eb hap\u00ebsir\u00ebn e emrit si m\u00eb posht\u00eb:<\/p>\n<pre><code class=\"bash\">kubectl label namespace default namespace=default<\/code><\/pre>\n<p>\nN\u00eb k\u00ebt\u00eb rast, namespace n\u00eb seksionin <code>metadata<\/code> duhet t\u00eb referohet me emrin aktual t\u00eb hap\u00ebsir\u00ebs, jo me etiket\u00ebn:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: test-network-policy\n  namespace: default   # &lt;&lt;&lt;\nspec:\n...<\/code><\/pre>\n<p><\/p>\n<h2>Burimi dhe adresati<\/h2>\n<p>\nPolitikat p\u00ebr firewall p\u00ebrb\u00ebhen nga rregulla me burime dhe destinacione. Politikat rrjetore t\u00eb Kubernetes p\u00ebrcaktohen p\u00ebr q\u00ebllim \u2014 nj\u00eb grup pod\u2019ash, t\u00eb cil\u00ebve ata u aplikohen, dhe m\u00eb pas vendosin rregulla p\u00ebr trafikun e ardhsh\u00ebm (ingress) dhe\/ose trafikun e daljes (egress). N\u00eb shembullin ton\u00eb, q\u00ebllimi i politik\u00ebs do t\u00eb jet\u00eb t\u00eb gjith\u00eb pod\u2019\u00ebt n\u00eb hap\u00ebsir\u00ebn e em\u00ebrtimit <code>default<\/code> me etiket\u00ebn me \u00e7el\u00ebsin <code>app<\/code> dhe vler\u00ebn <code>db<\/code>:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: test-network-policy\n  namespace: default\nspec:\n  podSelector:\n    matchLabels:\n      app: db   # &lt;&lt;&lt;\n  policyTypes:\n  - Ingress\n  - Egress\n  ingress:\n  - from:\n    - ipBlock:\n        cidr: 172.17.0.0\/16\n        except:\n        - 172.17.1.0\/24\n    - namespaceSelector:\n        matchLabels:\n          project: myproject\n    - podSelector:\n        matchLabels:\n          role: frontend\n    ports:\n    - protocol: TCP\n      port: 6379\n  egress:\n  - to:\n    - ipBlock:\n        cidr: 10.0.0.0\/24\n    ports:\n    - protocol: TCP\n      port: 5978<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/5fcb3f78e26ae1ed5635541ad69ef69f.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<img decoding=\"async\" alt=\"Hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/c753f559ecc3ba54f8b55e29851428c4.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nN\u00ebnseksioni <code>ingress<\/code> n\u00eb k\u00ebt\u00eb politik\u00eb hap trafikun e hyr\u00ebs p\u00ebr pod\u2019at e synuar. N\u00eb fjal\u00eb t\u00eb tjera, ingress vepron si burim, dhe q\u00ebllimi si destinacion p\u00ebrkat\u00ebs. Po ashtu, egress \u00ebsht\u00eb destinacioni, nd\u00ebrsa q\u00ebllimi \u00ebsht\u00eb burimi i tij.<\/p>\n<p><img decoding=\"async\" alt=\"Hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/a0d865de57a7620849074424770832cd.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>Kjo \u00ebsht\u00eb ekuivalente me dy rregulla p\u00ebr firewall: Ingress \u2192 Q\u00ebllimi; Q\u00ebllimi \u2192 Egress.<\/i><\/p>\n<h2>Egress dhe DNS (e r\u00ebnd\u00ebsishme!)<\/h2>\n<p>\nDuke kufizuar trafikun e daljes, <b>kushtojini v\u00ebmendje t\u00eb ve\u00e7ant\u00eb DNS<\/b> \u2014 Kubernetes e p\u00ebrdor k\u00ebt\u00eb sh\u00ebrbim p\u00ebr t\u00eb lidhur sh\u00ebrbimet me adresat IP. P\u00ebr shembull, politika e m\u00ebposhtme nuk do t\u00eb funksionoj\u00eb, pasi nuk e lejuat aplikacionin <code>balance<\/code> t\u00eb lidhet me DNS:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.balance\n  namespace: default\nspec:\n  podSelector:\n    matchLabels:\n      app: balance\n  egress:\n  - to:\n    - podSelector:\n        matchLabels:\n          app: postgres\n  policyTypes:\n  - Egress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/5857a44cc5e06de708f0d3b5b0f49628.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nMund t\u00eb rregullohet duke hapur aksesin n\u00eb sh\u00ebrbimin DNS:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.balance\n  namespace: default\nspec:\n  podSelector:\n    matchLabels:\n      app: balance\n  egress:\n  - to:\n    - podSelector:\n        matchLabels:\n          app: postgres\n  - to:               # &lt;&lt;&lt;\n    ports:            # &lt;&lt;&lt;\n    - protocol: UDP   # &lt;&lt;&lt;\n      port: 53        # &lt;&lt;&lt;\n  policyTypes:\n  - Egress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/a396bb2ae94fca94c3b62aef2cb07552.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nElementi i fundit <code>to<\/code> \u2014 \u00ebsht\u00eb i zbraz\u00ebt, dhe p\u00ebr k\u00ebt\u00eb arsye ai indirekt zgjedh <b>t\u00eb gjith\u00eb pod\u2019\u00ebt n\u00eb t\u00eb gjitha hap\u00ebsirat e em\u00ebrtes\u00ebs<\/b>, duke lejuar <code>balance<\/code> d\u00ebrgimin e k\u00ebrkesave DNS n\u00eb sh\u00ebrbimin p\u00ebrkat\u00ebs t\u00eb Kubernetes (zakonisht funksionon n\u00eb hap\u00ebsir\u00ebn <code>kube-system<\/code>).<\/p>\n<p>Ky qasje funksionon, megjithat\u00eb \u00ebsht\u00eb <b>shum\u00eb lejuese dhe e pasigurt<\/b>, pasi lejon d\u00ebrgimin e k\u00ebrkesave DNS jasht\u00eb clustrit.<\/p>\n<p>Mund ta p\u00ebrmir\u00ebsoni at\u00eb me tri hapa t\u00eb radh\u00ebs.<\/p>\n<p>1. Lejoni k\u00ebrkesat DNS vet\u00ebm <b>brenda<\/b> n\u00eb cluster, duke shtuar <code>namespaceSelector<\/code>:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.balance\n  namespace: default\nspec:\n  podSelector:\n    matchLabels:\n      app: balance\n  egress:\n  - to:\n    - podSelector:\n        matchLabels:\n          app: postgres\n  - to:\n    - namespaceSelector: {} # &lt;&lt;&lt;&lt;\n    ports:\n    - protocol: UDP\n      port: 53\n  policyTypes:\n  - Egress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/5920a043229676e0780d691d302c5ade.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n2. Lejoni k\u00ebrkesat DNS vet\u00ebm n\u00eb hap\u00ebsir\u00ebn e emrave <code>kube-system<\/code>.<\/p>\n<p>P\u00ebr k\u00ebt\u00eb, duhet t\u00eb shtoni nj\u00eb etiket\u00eb n\u00eb hap\u00ebsir\u00ebn e emrave <code>kube-system<\/code>: <code>kubectl label namespace kube-system namespace=kube-system<\/code> \u2014 dhe ta p\u00ebrfshini at\u00eb n\u00eb politik\u00eb p\u00ebrmes <code>namespaceSelector<\/code>:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.balance\n  namespace: default\nspec:\n  podSelector:\n    matchLabels:\n      app: balance\n  egress:\n  - to:\n    - podSelector:\n        matchLabels:\n          app: postgres\n  - to:\n    - namespaceSelector:         # &lt;&lt;&lt;&lt;\n        matchLabels:             # &lt;&lt;&lt;&lt;\n          namespace: kube-system # &lt;&lt;&lt;&lt;\n    ports:\n    - protocol: UDP\n      port: 53\n  policyTypes:\n  - Egress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/2a1dd0975c58e6d277baffc7c3ac6e48.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n3. Paranoik\u00ebt mund t\u00eb shkojn\u00eb akoma m\u00eb tej dhe t\u00eb kufizojn\u00eb k\u00ebrkesat DNS p\u00ebr nj\u00eb sh\u00ebrbim t\u00eb caktuar DNS n\u00eb <code>kube-system<\/code>. N\u00eb seksionin \"Filtrimi sipas hap\u00ebsirave t\u00eb em\u00ebrtes\u00ebs dhe pod\u2019ave\" do t\u00eb diskutohet se si t\u00eb arrijm\u00eb k\u00ebt\u00eb.<\/p>\n<p>Nj\u00eb opsion tjet\u00ebr \u00ebsht\u00eb t\u00eb lejoni DNS n\u00eb nivelin e hap\u00ebsir\u00ebs s\u00eb emrave. N\u00eb k\u00ebt\u00eb rast nuk do t\u00eb nevojitet t\u00eb hapet p\u00ebr \u00e7do sh\u00ebrbim:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.dns\n  namespace: default\nspec:\n  podSelector: {} # &lt;&lt;&lt;&lt;\n  egress:\n  - to:\n    - namespaceSelector: {}\n    ports:\n    - protocol: UDP\n      port: 53\n  policyTypes:\n  - Egress<\/code><\/pre>\n<p>\nE zbraz\u00ebt <code>podSelector<\/code> zgjedh t\u00eb gjitha pod\u2019at n\u00eb hap\u00ebsir\u00ebn e emrave.<\/p>\n<p><img decoding=\"async\" alt=\"Hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/5d6b627b69da980477b3910fbf4de6c1.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>P\u00ebrputhshm\u00ebria e par\u00eb dhe rendi i rregullave<\/h2>\n<p>\nN\u00eb firewall-in e zakonsh\u00ebm, veprimi (\"Lejo\" ose \"Ndal\") n\u00eb lidhje me nj\u00eb paket\u00eb p\u00ebrcaktohet nga rregulli i par\u00eb q\u00eb plot\u00ebson. <b>N\u00eb Kubernetes, rendi i politikave s'ka asnj\u00eb r\u00ebnd\u00ebsi.<\/b><\/p>\n<p>N\u00eb m\u00ebnyr\u00eb default, kur politikat nuk jan\u00eb p\u00ebrcaktuar, komunikacionet midis pod\u2019ave jan\u00eb t\u00eb lejuara dhe ato mund t\u00eb ndajn\u00eb informacion lirsh\u00ebm. Sa her\u00eb q\u00eb filloni t\u00eb formuloni politika, \u00e7do pod, i goditur nga t\u00eb pakt\u00ebn nj\u00ebra prej tyre, b\u00ebhet i izoluar n\u00eb p\u00ebrputhje me disjunkcionin (logjik OR) t\u00eb t\u00eb gjitha politikave q\u00eb e p\u00ebrzgjedhin at\u00eb. Pod\u2019\u00ebt, q\u00eb nuk jan\u00eb goditur nga ndonj\u00eb politik\u00eb, mbeten t\u00eb hapur.<\/p>\n<p>Mund t\u00eb ndryshoni nj\u00eb sjellje t\u00eb till\u00eb p\u00ebrmes nj\u00eb rregulli pastrimi.<\/p>\n<h2>Rregulli i pastrimit (\"Ndal\")<\/h2>\n<p>\nPolitikat e firewall-eve zakonisht ndalojn\u00eb \u00e7do trafik q\u00eb nuk lejohet qart\u00eb.<\/p>\n<p><b>N\u00eb Kubernetes nuk ka veprimi \"ndal\" (deny),<\/b>, megjithat\u00eb, efektin e ngjash\u00ebm mund ta arrini me nj\u00eb politik\u00eb t\u00eb zakonshme (lejuese), duke zgjedhur nj\u00eb grup t\u00eb zbraz\u00ebt pod\u2019esh burimi (ingress):<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: deny-all\n  namespace: default\nspec:\n  podSelector: {}\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/8b3ced50ec5a1de70940d53f467966fe.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKjo politik\u00eb zgjedh t\u00eb \u062c\u0645\u064a\u0639 pod\u2019esh n\u00eb hap\u00ebsir\u00ebn e emrave dhe e l\u00eb ingress t\u00eb pasigurt, duke ndaluar gjith\u00eb trafikun e ardhsh\u00ebm.<\/p>\n<p>N\u00eb m\u00ebnyr\u00eb t\u00eb ngjashme, mund t\u00eb kufizoni t\u00eb gjith\u00eb trafikun q\u00eb del nga hap\u00ebsira e emrit:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: deny-all-egress\n  namespace: default\nspec:\n  podSelector: {}\n  policyTypes:\n  - Egress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/be22e11efef0098f2665331c09d748f2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKujdes, <b>\u00e7do politik\u00eb shtes\u00eb, q\u00eb lejon trafikun te pod\u2019esh n\u00eb hap\u00ebsir\u00ebn e emrave, do t\u00eb ket\u00eb p\u00ebrpar\u00ebsi mbi k\u00ebt\u00eb rregull.<\/b> (analog si shtimi i nj\u00eb rregulli leht\u00ebsues para nj\u00eb ndalues n\u00eb konfigurimin e firewall-it).<\/p>\n<h2>Lejo t\u00eb gjitha (Any-Any-Any-Allow)<\/h2>\n<p>\nP\u00ebr t\u00eb krijuar politik\u00ebn \"Lejo t\u00eb gjitha\", \u00ebsht\u00eb e nevojshme t\u00eb plot\u00ebsoni politik\u00ebn ndaluese t\u00eb m\u00ebsip\u00ebrme me nj\u00eb element t\u00eb zbraz\u00ebt <code>ingress<\/code>:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: allow-all\n  namespace: default\nspec:\n  podSelector: {}\n  ingress: # &lt;&lt;&lt;&lt;\n  - {}     # &lt;&lt;&lt;&lt;\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/7322351493211388fe772b8dc270108d.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAjo hap akses nga <b>t\u00eb gjith\u00eb pod\u2019esh n\u00eb t\u00eb gjitha hap\u00ebsirat e emrave (dhe t\u00eb gjith\u00eb IP-t\u00eb) n\u00eb \u00e7do pod\u2019 n\u00eb hap\u00ebsir\u00ebn e emrave <code>default<\/code><\/b>. Nj\u00eb sjellje e till\u00eb \u00ebsht\u00eb e aktivizuar si parazgjedhje, prandaj zakonisht nuk \u00ebsht\u00eb e nevojshme ta p\u00ebrcaktoni s\u00ebrish. Megjithat\u00eb, ndonj\u00ebher\u00eb mund t\u00eb jet\u00eb e nevojshme t\u00eb p\u00ebrkoh\u00ebsoni disa leje specifike p\u00ebr diagnostikimin e nj\u00eb problemi.<\/p>\n<p>Rregulli mund t\u00eb ngushtohet dhe t\u00eb lejoj\u00eb akses vet\u00ebm n\u00eb <b>nj\u00eb grup t\u00eb caktuar pod\u2019esh<\/b> (<code>app:balance<\/code>) n\u00eb hap\u00ebsir\u00ebn e emrit <code>default<\/code>:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: allow-all-to-balance\n  namespace: default\nspec:\n  podSelector:\n    matchLabels:\n      app: balance\n  ingress: \n  - {}\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/d8c9cb85003f489acec815d1c2b53497.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPolitika e m\u00ebposhtme lejon t\u00eb gjith\u00eb trafikun q\u00eb hyn (ingress) dhe del (egress), duke p\u00ebrfshir\u00eb aksesin n\u00eb \u00e7do IP jasht\u00eb klasit:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: allow-all\nspec:\n  podSelector: {}\n  ingress:\n  - {}\n  egress:\n  - {}\n  policyTypes:\n  - Ingress\n  - Egress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/2477f18d3d228f80bc5169d9ec3be2fc.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<img decoding=\"async\" alt=\"Hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/3502b892713cdac8850e812b2eff3ea3.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Kombinimi i politikave t\u00eb shumta<\/h2>\n<p>\nPolitikat bashkohen duke p\u00ebrdorur logjik\u00ebn O n\u00eb tre nivele; lejet e \u00e7do pod\u2019i vendosen n\u00eb baz\u00eb t\u00eb disjunksionit t\u00eb t\u00eb gjitha politikave q\u00eb e prekin at\u00eb:<\/p>\n<p>1. N\u00eb fushat <code>from<\/code> dhe <code>to<\/code> mund t\u00eb p\u00ebrcaktoni tri lloje element\u00ebsh (t\u00eb gjith\u00eb k\u00ebta kombinohen duke p\u00ebrdorur ORE):<\/p>\n<ul>\n<li> <code>namespaceSelector<\/code> \u2014 zgjedh hap\u00ebsir\u00ebn e emrit n\u00eb t\u00ebr\u00ebsi;<\/li>\n<li> <code>podSelector<\/code> \u2014 zgjedh pod'\u00ebt;<\/li>\n<li> <code>ipBlock<\/code> \u2014 zgjedh n\u00ebnrrjet\u00ebn.<\/li>\n<\/ul>\n<p>\nN\u00eb k\u00ebt\u00eb m\u00ebnyr\u00eb, numri i elementeve (edhe t\u00eb nj\u00ebjta) n\u00eb n\u00ebnshkrime <code>from<\/code>\/<code>to<\/code> nuk \u00ebsht\u00eb i kufizuar. T\u00eb gjitha do t\u00eb kombinohen me logjik\u00ebn ORE.<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.postgres\n  namespace: default\nspec:\n  ingress:\n  - from:\n    - podSelector:\n        matchLabels:\n          app: indexer\n    - podSelector:\n        matchLabels:\n          app: admin\n  podSelector:\n    matchLabels:\n      app: postgres\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/717e745720f39260a8508fb2b2bb6f65.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n2. Brend politik\u00eb ndar\u00ebse <code>ingress<\/code> mund t\u00eb ket\u00eb shum\u00eb elemente <code>from<\/code> (duke u kombinuar logjikisht me ORE). Po ashtu, seksioni <code>egress<\/code> mund t\u00eb p\u00ebrmbaj\u00eb shum\u00eb elemente <code>to<\/code> (po ashtu kombinohen me disjunksion):<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.postgres\n  namespace: default\nspec:\n  ingress:\n  - from:\n    - podSelector:\n        matchLabels:\n          app: indexer\n  - from:\n    - podSelector:\n        matchLabels:\n          app: admin\n  podSelector:\n    matchLabels:\n      app: postgres\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/b579e1f4b97acd92fb38cd6703aa1983.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n3. Politikat e ndryshme gjithashtu kombinohen logjikisht me ORE<\/p>\n<p>Por, kur ato kombinohen, ekziston nj\u00eb kufizim, p\u00ebr t\u00eb cilin <noindex><a rel=\"nofollow\" href=\"https:\/\/medium.com\/sainsburys-engineering\/considerations-with-k8s-networkpolicy-cee7eacf5469\">specifikoja<\/a><\/noindex> <noindex><a rel=\"nofollow\" href=\"https:\/\/medium.com\/@chriscooney\">Chris Cooney<\/a><\/noindex>: Kubernetes mund t\u00eb kombinoj\u00eb politika vet\u00ebm me t\u00eb ndryshme <code>policyTypes<\/code> (<code>Ingress<\/code> ose <code>Egress<\/code>). Politikat q\u00eb p\u00ebrcaktojn\u00eb ingress (ose egress) do t\u00eb mbizot\u00ebrojn\u00eb mbi nj\u00ebra-tjetr\u00ebn.<\/p>\n<h2>Lidhja midis hap\u00ebsirave t\u00eb emrave<\/h2>\n<p>\nN\u00eb m\u00ebnyr\u00eb default, shk\u00ebmbimi i informacionit midis hap\u00ebsirave t\u00eb emrave \u00ebsht\u00eb i lejuar. Kjo mund t\u00eb ndryshohet p\u00ebrmes nj\u00eb politike ndaluese, e cila do t\u00eb kufizoj\u00eb trafikun e dalsh\u00ebm dhe\/ose hyr\u00ebs n\u00eb hap\u00ebsir\u00ebn e emrit (shih \u2018Rregulli i pastrimit\u2019 m\u00eb sip\u00ebr).<\/p>\n<p>Duke bllokuar qasjen n\u00eb hap\u00ebsir\u00ebn e emrave (shih \u2018Rregulli i pastrimit\u2019 m\u00eb sip\u00ebr), mund t\u00eb b\u00ebni p\u00ebrjashtime nga politika ndaluese duke lejuar lidhjet nga nj\u00eb hap\u00ebsir\u00eb emri t\u00eb caktuar p\u00ebrmes <code>namespaceSelector<\/code>:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: database.postgres\n  namespace: database\nspec:\n  podSelector:\n    matchLabels:\n      app: postgres\n  ingress:\n  - from:\n    - namespaceSelector: # &lt;&lt;&lt;\n        matchLabels:\n          namespace: default\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/5a3d2baed1ff9b813ef0651fe500ad8a.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSi rezultat, t\u00eb gjith\u00eb pod\u2019\u00ebt n\u00eb hap\u00ebsir\u00ebn e emrave <code>default<\/code> do t\u00eb ken\u00eb qasje n\u00eb pod\u2019esh <code>postgres<\/code> n\u00eb hap\u00ebsir\u00ebn e em\u00ebrtimit <code>database<\/code>. Por, \u00e7far\u00eb ndodh n\u00ebse d\u00ebshiron t\u00eb hap\u00ebsh qasjen n\u00eb <code>postgres<\/code> vet\u00ebm pod\u2019 t\u00eb caktuar n\u00eb hap\u00ebsir\u00ebn e emrave <code>default<\/code>?<\/p>\n<h2>Filtri sipas hap\u00ebsirave t\u00eb emrave dhe pod\u2019esh<\/h2>\n<p>\nKubernetes version 1.11 dhe m\u00eb lart lejon kombinimin e operator\u00ebve <code>namespaceSelector<\/code> dhe <code>podSelector<\/code> p\u00ebrmes logjik\u00ebs AND. Duket k\u00ebshtu:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: database.postgres\n  namespace: database\nspec:\n  podSelector:\n    matchLabels:\n      app: postgres\n  ingress:\n  - from:\n    - namespaceSelector:\n        matchLabels:\n          namespace: default\n      podSelector: # &lt;&lt;&lt;\n        matchLabels:\n          app: admin\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/e933e449d9f9c10505e45930d1477b2c.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPse interpretohet si AND n\u00eb vend t\u00eb zakonshmes ORE?<\/p>\n<p>Vini re se <code>podSelector<\/code> nuk fillon me nj\u00eb shkronj\u00eb t\u00eb madhe. N\u00eb YAML, kjo do t\u00eb thot\u00eb se <code>podSelector<\/code> dhe ajo q\u00eb e ndjek <code>namespaceSelector<\/code> i p\u00ebrkasin t\u00eb nj\u00ebjtit element liste. Prandaj, ato kombinohen logjikisht me AND.<\/p>\n<p>Shtimi i nj\u00eb pese para <code>podSelector<\/code> do t\u00eb \u00e7oj\u00eb n\u00eb krijimin e nj\u00eb elementi t\u00eb ri t\u00eb list\u00ebs, i cili do t\u00eb kombinohet me at\u00eb paraprak <code>namespaceSelector<\/code> n\u00ebp\u00ebrmjet logjik\u00ebs OORT.<\/p>\n<p>P\u00ebr t\u00eb zgjedhur pod\u2019esh me nj\u00eb etiket\u00eb t\u00eb caktuar <b>n\u00eb t\u00eb gjitha hap\u00ebsirat e emrave<\/b>, shkruani bosh <code>namespaceSelector<\/code>:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: database.postgres\n  namespace: database\nspec:\n  podSelector:\n    matchLabels:\n      app: postgres\n  ingress:\n  - from:\n    - namespaceSelector: {}\n      podSelector:\n        matchLabels:\n          app: admin\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/e79e4a8067fa254f85fa8be105c3ad34.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Etiketat shum\u00ebfishe kombinohen me O.<\/h2>\n<p>\nRregullat p\u00ebr firewall me objekte t\u00eb shumta (hostname, rrjete, grupe) kombinohen n\u00ebp\u00ebrmjet logjik\u00ebs O. Rregulli n\u00eb vijim do t\u00eb zbatohet n\u00ebse burimi i paket\u00ebs p\u00ebrputhet me <code>Host_1<\/code> OSE <code>Host_2<\/code>:<\/p>\n<pre><code class=\"plaintext\">| Burimi | Destinacioni | Sh\u00ebrbimi | Veprimi |\n| ----------------------------------------|\n| Host_1 | Subnet_A    | HTTPS   | Lejo  |\n| Host_2 |             |         |        |\n| ----------------------------------------|<\/code><\/pre>\n<p>\nP\u00ebrkundrazi, n\u00eb Kubernetes etiketat e ndryshme n\u00eb <code>podSelector<\/code> ose <code>namespaceSelector<\/code> kombinohen me logjik\u00ebn E. P\u00ebr shembull, rregulli n\u00eb vijim do t\u00eb zgjedh\u00eb pod\u2019\u00ebt q\u00eb kan\u00eb t\u00eb dy etiketat <code>role=db<\/code> DHE <code>version=v2<\/code>:<\/p>\n<pre><code class=\"plaintext\">podSelector:\n  matchLabels:\n    role: db\n    version: v2<\/code><\/pre>\n<p>\nE nj\u00ebjta logjik\u00eb aplikohet p\u00ebr t\u00eb gjith\u00eb llojet e operator\u00ebve: selektor\u00ebt e q\u00ebllimit t\u00eb politik\u00ebs, selektor\u00ebt e pod\u2019esh dhe selektor\u00ebt e hap\u00ebsirave t\u00eb emrave.<\/p>\n<h2>Subnet\u00ebt dhe IP adresat (IPBlocks)<\/h2>\n<p>\nP\u00ebr segmentimin e rrjetit, firewall p\u00ebrdorin VLAN, IP adresat dhe subnetet.<\/p>\n<p>N\u00eb Kubernetes, IP-t\u00eb i asignohen pod\u2019esh automatsh\u00ebm dhe mund t\u00eb ndryshojn\u00eb shpesh, k\u00ebshtu q\u00eb p\u00ebr t\u00eb zgjedhur pod\u2019esh dhe hap\u00ebsira emrash n\u00eb politikat rrjet\u00ebrore p\u00ebrdoren etiketat.<\/p>\n<p>Subnet\u00ebt (<code>ipBlocks<\/code>) p\u00ebrdoren p\u00ebr menaxhimin e lidhjeve t\u00eb ardhshme (ingress) ose t\u00eb dalura (egress) t\u00eb jashtme (North-South). P\u00ebr shembull, kjo politik\u00eb hap gjithsej pod\u2019esh nga hap\u00ebsira e emrave <code>default<\/code> n\u00eb sh\u00ebrbimin DNS t\u00eb Google:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: egress-dns\n  namespace: default\nspec:\n  podSelector: {}\n  policyTypes:\n  - Egress\n  egress:\n  - to:\n    - ipBlock:\n        cidr: 8.8.8.8\/32\n    ports:\n    - protocol: UDP\n      port: 53<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/42e1194e28331e667a094f19c88e0934.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNj\u00eb selektor i zbraz\u00ebt pod\u2019esh n\u00eb k\u00ebt\u00eb shembull do t\u00eb thot\u00eb \u201czgjedh t\u00eb gjitha pod\u2019esh n\u00eb hap\u00ebsir\u00ebn e emrave\u201d.<\/p>\n<p>Kjo politik\u00eb hap qasje vet\u00ebm n\u00eb 8.8.8.8; qasje n\u00eb \u00e7do IP tjet\u00ebr \u00ebsht\u00eb e ndaluar. Pra, n\u00eb thelb, keni bllokuar qasjen n\u00eb sh\u00ebrbimin e brendsh\u00ebm DNS t\u00eb Kubernetes. N\u00ebse d\u00ebshironi ta hapni aty, shprehni qart\u00eb k\u00ebt\u00eb.<\/p>\n<p>Zakonisht <code>ipBlocks<\/code> dhe <code>podSelectors<\/code> jan\u00eb ekskluzive, pasi IP-t\u00eb brendshme t\u00eb pod\u2019esh nuk p\u00ebrdoren n\u00eb <code>ipBlocks<\/code>. Duke specifikuar <b>IP-t\u00eb brendshme t\u00eb pod\u2019esh<\/b>, n\u00eb fakt do t\u00eb lejoni lidhje te\/nga pod\u2019esh me k\u00ebto adresa. N\u00eb praktik\u00eb, nuk do t\u00eb dini se cilin IP do t\u00eb p\u00ebrdorni, ndaj nuk duhet t'i p\u00ebrdorni p\u00ebr t\u00eb zgjedhur pod\u2019esh.<\/p>\n<p>Si nj\u00eb kund\u00ebr-shembull, politika e m\u00ebposhtme p\u00ebrfshin t\u00eb gjitha IP-t\u00eb dhe, si rezultat, lejon akses n\u00eb t\u00eb gjith\u00eb pod\u2019esh e tjer\u00eb:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: egress-any\n  namespace: default\nspec:\n  podSelector: {}\n  policyTypes:\n  - Egress\n  egress:\n  - to:\n    - ipBlock:\n        cidr: 0.0.0.0\/0<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/d99dfdead1c96b071b1643cb5c572878.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nMund t\u00eb hapni akses vet\u00ebm p\u00ebr IP-t\u00eb e jashtme, duke p\u00ebrjashtuar IP-t\u00eb brendshme t\u00eb pod\u2019esh. P\u00ebr shembull, n\u00ebse subneti i pod\u2019it tuaj \u00ebsht\u00eb 10.16.0.0\/14:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: egress-any\n  namespace: default\nspec:\n  podSelector: {}\n  policyTypes:\n  - Egress\n  egress:\n  - to:\n    - ipBlock:\n        cidr: 0.0.0.0\/0\n        except:\n        - 10.16.0.0\/14<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/b157cfe0f1cd4677cf0defd9fdfa8a13.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Portat dhe protokollet<\/h2>\n<p>\nZakoni \u00ebsht\u00eb q\u00eb pod\u2019esh t\u00eb d\u00ebgjojn\u00eb nj\u00eb port. Kjo do t\u00eb thot\u00eb se mund t\u00eb mos specifikoni numrat e porteve n\u00eb politika dhe t\u00eb lini gjith\u00e7ka sipas default-it. Megjithat\u00eb, politikat rekomandohet t\u00eb jen\u00eb sa m\u00eb kufizuese, prandaj n\u00eb disa raste gjithashtu mund t\u00eb specifikoni porte:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.postgres\n  namespace: default\nspec:\n  ingress:\n  - from:\n    - podSelector:\n        matchLabels:\n          app: indexer\n    - podSelector:\n        matchLabels:\n          app: admin\n    ports:             # &lt;&lt;&lt;\n      - port: 443      # &lt;&lt;&lt;\n        protocol: TCP  # &lt;&lt;&lt;\n      - port: 80       # &lt;&lt;&lt;\n        protocol: TCP  # &lt;&lt;&lt;\n  podSelector:\n    matchLabels:\n      app: postgres\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/4c778cd46c54e2ae0f4527ffa9e1e740.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nV\u00ebreni, se selektori <code>ports<\/code> aplikohet p\u00ebr t\u00eb gjith\u00eb elementet n\u00eb bllokun <code>to<\/code> ose <code>from<\/code>, n\u00eb t\u00eb cilin ndodhet. P\u00ebr t\u00eb specifikuar portat e ndryshme p\u00ebr grupe t\u00eb ndryshme elementesh, nda nj\u00eb <code>ingress<\/code> ose <code>egress<\/code> n\u00eb disa n\u00ebnndahje me <code>to<\/code> ose <code>from<\/code> dhe n\u00eb \u00e7do t\u00eb shkruani portat tuaja:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.postgres\n  namespace: default\nspec:\n  ingress:\n  - from:\n    - podSelector:\n        matchLabels:\n          app: indexer\n    ports:             # &lt;&lt;&lt;\n     - port: 443       # &lt;&lt;&lt;\n       protocol: TCP   # &lt;&lt;&lt;\n  - from:\n    - podSelector:\n        matchLabels:\n          app: admin\n    ports:             # &lt;&lt;&lt;\n     - port: 80        # &lt;&lt;&lt;\n       protocol: TCP   # &lt;&lt;&lt;\n  podSelector:\n    matchLabels:\n      app: postgres\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/b9ac1d8af491e992cac0be184005a278.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nFunksioni i portave nga parazgjedhja:<\/p>\n<ul>\n<li> N\u00ebse e hidhni plot\u00ebsisht p\u00ebr \u062a\u0639\u0631\u064a\u0641in e portave (<code>ports<\/code>), kjo do t\u00eb thot\u00eb t\u00eb gjitha protokollet dhe t\u00eb gjitha portat;<\/li>\n<li> N\u00ebse e hidhni p\u00ebr \u062a\u0639\u0631\u064a\u0641in e protokollit (<code>protocol<\/code>), kjo do t\u00eb thot\u00eb TCP;<\/li>\n<li> N\u00ebse e hidhni p\u00ebr \u062a\u0639\u0631\u064a\u0641in e portit (<code>port<\/code>), kjo do t\u00eb thot\u00eb t\u00eb gjitha portat.<\/li>\n<\/ul>\n<p>\nPraktika m\u00eb e mir\u00eb: mos u mb\u00ebshtetni n\u00eb vlerat e parazgjedhura, specifikoni ato q\u00eb ju nevojiten qart\u00eb.<\/p>\n<p>Ju lutemi vini re, se duhet t\u00eb p\u00ebrdoren portet e pod'ave, jo ato t\u00eb sh\u00ebrbimeve (m\u00eb shum\u00eb rreth k\u00ebsaj n\u00eb paragrafin e ardhsh\u00ebm).<\/p>\n<h2>Politikat jan\u00eb t\u00eb p\u00ebrcaktuara p\u00ebr pod'ave apo sh\u00ebrbimeve?<\/h2>\n<p>\nZakonisht, pod'\u00ebt n\u00eb Kubernetes i drejtohen nj\u00ebri-tjetrit n\u00ebp\u00ebrmjet sh\u00ebrbimit \u2014 nj\u00eb balancues virtual i ngarkes\u00ebs, i cili redirekton trafikun tek pod'\u00ebt q\u00eb zbatojn\u00eb sh\u00ebrbimin. Mund t\u00eb mendoni se politikat rrjetore kontrollojn\u00eb aksesin n\u00eb sh\u00ebrbime, por nuk \u00ebsht\u00eb k\u00ebshtu. <b>Politikat rrjetore t\u00eb Kubernetes punojn\u00eb me portet e pod'ave, jo me sh\u00ebrbimet.<\/b><\/p>\n<p>P\u00ebr shembull, n\u00ebse sh\u00ebrbimi d\u00ebgjon n\u00eb portin 80, por redirekton trafikun n\u00eb portin 8080 t\u00eb pod'ave t\u00eb tij, n\u00eb politik\u00ebn rrjetore duhet t\u00eb specifikohet pik\u00ebrisht 8080.<\/p>\n<p>Nj\u00eb mekaniz\u00ebm i till\u00eb duhet t\u00eb pranohet si jo optimal: kur ndryshon struktura e brendshme e sh\u00ebrbimit (portet e t\u00eb cil\u00ebve d\u00ebgjohen nga pod'\u00ebt) do t\u00eb duhet azhurnuar politikat rrjetore.<\/p>\n<p>Nj\u00eb qasje t\u00eb re arkitekturore duke p\u00ebrdorur Service Mesh <i>(p\u00ebr shembull, shihni p\u00ebr Istio m\u00eb posht\u00eb \u2014 v\u00ebrejtje e p\u00ebrkthyesit)<\/i> i lejon t\u00eb zgjidh\u00eb k\u00ebt\u00eb problem.<\/p>\n<h2>A \u00ebsht\u00eb e nevojshme t\u00eb specifikohen si Ingress ashtu edhe Egress?<\/h2>\n<p>\nP\u00ebrgjigja e shkurt\u00ebr \u00ebsht\u00eb \u2014 po, q\u00eb pod A t\u00eb mund t\u00eb lidhet me pod B, \u00ebsht\u00eb e nevojshme t\u00eb lejohet krijimi i nj\u00eb lidhjeje dal\u00ebse (p\u00ebr k\u00ebt\u00eb duhet t\u00eb konfigurohet politika e egress), dhe pod B duhet t\u00eb ket\u00eb mund\u00ebsi p\u00ebr t\u00eb pranuar nj\u00eb lidhje hyr\u00ebse (p\u00ebr k\u00ebt\u00eb, sigurisht, nevojitet politika e ingress).<\/p>\n<p>Megjithat\u00eb, n\u00eb praktik\u00eb, mund t\u00eb mb\u00ebshteteni n\u00eb politik\u00ebn e paracaktuar, e cila lejon lidhjet n\u00eb nj\u00eb ose t\u00eb dyja drejtimet.<\/p>\n<p>N\u00ebse nj\u00eb pod-<b>burimi<\/b> do t\u00eb zgjidhet nga nj\u00eb ose disa <b>egress<\/b>-politika, kufizimet q\u00eb i vendosen atij do t\u00eb p\u00ebrcaktohen nga disjunksioni i tyre. N\u00eb k\u00ebt\u00eb rast, do t\u00eb nevojitet t\u00eb lejohet qartazi lidhja me pod-in-<b>destinat<\/b>. N\u00ebse pod-i nuk zgjidhet nga ndonj\u00eb politik\u00eb, trafiku i tij dal\u00ebs (egress) lejohet automatikisht.<\/p>\n<p>Po ashtu, fati i pod'it-<b>destinat<\/b>, i zgjedhur nga nj\u00eb ose disa <b>ingress<\/b>-politikat do t\u00eb p\u00ebrcaktohet nga disjunkcioni i tyre. N\u00eb k\u00ebt\u00eb rast, \u00ebsht\u00eb e nevojshme t\u00eb lejohet qart\u00eb q\u00eb t\u00eb marr\u00eb trafik nga pod'i burim. N\u00ebse pod'i nuk zgjidhet nga ndonj\u00eb politik\u00eb, e gjith\u00eb trafiku hyr\u00ebs (ingress) p\u00ebr t\u00eb lejohet n\u00eb m\u00ebnyr\u00eb standarde.<\/p>\n<p>Shihni seksionin \"Stateful ose Stateless\" m\u00eb posht\u00eb.<\/p>\n<h2>D\u00ebgjimet<\/h2>\n<p>\nPolitikat rrjetore t\u00eb Kubernetes nuk kan\u00eb kapacitet p\u00ebr t\u00eb regjistruar trafikun. Kjo e komplikon p\u00ebrcaktimin n\u00ebse politika funksionon si duhet dhe e v\u00ebshtir\u00ebson analiz\u00ebn n\u00eb fush\u00ebn e siguris\u00eb.<\/p>\n<h2>Kontrolli i trafikut ndaj sh\u00ebrbimeve t\u00eb jashtme<\/h2>\n<p>\nPolitikat e rrjetit t\u00eb Kubernetes nuk lejojn\u00eb specifikimin e nj\u00eb emri t\u00eb plot\u00eb domeni (DNS) n\u00eb seksionet e egress. Ky shqet\u00ebsim \u00e7on n\u00eb shqet\u00ebsime t\u00eb konsiderueshme kur p\u00ebrpiqeni t\u00eb kufizoni trafikun drejt adresave t\u00eb jashtme q\u00eb nuk kan\u00eb nj\u00eb IP t\u00eb fiksuar (si aws.com).<\/p>\n<h2>Kontrolli i politik\u00ebs<\/h2>\n<p>\nFirewall-et do t'ju paralajm\u00ebrojn\u00eb ose madje do t\u00eb refuzojn\u00eb t\u00eb pranoni nj\u00eb politik\u00eb t\u00eb gabuar. Kubernetes gjithashtu b\u00ebn disa verifikime. Kur definoni politik\u00ebn e rrjetit p\u00ebrmes kubectl, Kubernetes mund t\u00eb deklaroj\u00eb se ajo \u00ebsht\u00eb e pavlefshme dhe t\u00eb refuzoj\u00eb ta pranoj\u00eb. N\u00eb raste t\u00eb tjera, Kubernetes do ta pranoj\u00eb politik\u00ebn dhe do ta plot\u00ebsoj\u00eb me detajet q\u00eb mungojn\u00eb. Ato mund t\u00eb shihen p\u00ebrmes komand\u00ebs:<\/p>\n<pre><code class=\"plaintext\">kubernetes get networkpolicy  -o yaml<\/code><\/pre>\n<p>\nMbani parasysh se sistemi i kontrollit t\u00eb Kubernetes nuk \u00ebsht\u00eb i infallibil dhe mund t\u00eb kaloj\u00eb disa lloje gabimesh.<\/p>\n<h2>Ekzekutimi<\/h2>\n<p>\nKubernetes nuk merret me zbatimin e politikave t\u00eb rrjetit vet\u00eb, por \u00ebsht\u00eb vet\u00ebm nj\u00eb port\u00eb API, e cila i ngarkon pun\u00ebn e nd\u00ebrlikuar t\u00eb kontrollit sistemit n\u00ebntok\u00ebsor t\u00eb quajtur Container Networking Interface (CNI). Definimi i politikave n\u00eb klasterin Kubernetes pa p\u00ebrcaktimin e CNI p\u00ebrkat\u00ebs \u00ebsht\u00eb si t\u00eb krijosh politika n\u00eb nj\u00eb server menaxhimi firewall pa i instaluar m\u00eb pas ato n\u00eb firewall-e. Ju duhet t\u00eb siguroheni p\u00ebr nj\u00eb CNI t\u00eb denj\u00eb ose, n\u00eb rastin e platformave Kubernetes q\u00eb jan\u00eb t\u00eb vendosura n\u00eb cloud, <i>(me nj\u00eb list\u00eb ofruesish mund t\u00eb konsultoheni <noindex>k\u00ebtu<\/noindex> \u2014 sh\u00ebnim i redaktorit)<\/i>, p\u00ebr t\u00eb angazhuar politikat e rrjetit q\u00eb do t\u00eb vendosin CNI p\u00ebr ju.<\/p>\n<p>Kujdes, Kubernetes nuk do t'ju paralajm\u00ebroj\u00eb n\u00ebse definoni nj\u00eb politik\u00eb rrjeti pa CNI-n\u00eb mb\u00ebshtet\u00ebs p\u00ebrkat\u00ebs.<\/p>\n<h3>Stateful apo Stateless?<\/h3>\n<p>\nT\u00eb gjitha CNI-t\u00eb e Kubernetes me t\u00eb cilat kam pasur takime ruajn\u00eb gjendjen (p.sh., Calico p\u00ebrdor conntrack t\u00eb Linux). Kjo lejon q\u00eb pod-i t\u00eb marr\u00eb p\u00ebrgjigje nga lidhja TCP q\u00eb ka iniciuar pa nevoj\u00ebn p\u00ebr ta rivendosur at\u00eb. Megjithat\u00eb, nuk di p\u00ebr asnj\u00eb standart t\u00eb Kubernetes q\u00eb garanton ruajtjen e gjendjes (statefulness).<\/p>\n<h2>Menaxhimi i avancuar i politik\u00ebs s\u00eb siguris\u00eb<\/h2>\n<p>\nJa disa m\u00ebnyra p\u00ebr t\u00eb rritur efektivitetin e zbatimit t\u00eb politik\u00ebs s\u00eb siguris\u00eb n\u00eb Kubernetes:<\/p>\n<ol>\n<li> Shembulli i arkitektur\u00ebs s\u00eb pattern-it Service Mesh p\u00ebrdor kontejner\u00eb sidecar p\u00ebr t\u00eb siguruar telemetri t\u00eb detajuar dhe kontroll mbi trafikun n\u00eb nivelin e sh\u00ebrbimeve. Nj\u00eb shembull mund t\u00eb jet\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/istio.io\/\">Istio<\/a><\/noindex>.<\/li>\n<li> Disa nga ofruesit e CNI kan\u00eb plot\u00ebsuar mjetet e tyre p\u00ebr t'u shtrir\u00eb p\u00ebrtej politikave rrjetore t\u00eb Kubernetes.<\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.tufin.com\/products\/tufin-orca\">Tufin Orca<\/a><\/noindex> siguron transparenc\u00eb dhe automatizim t\u00eb politikave rrjetore t\u00eb Kubernetes.<\/li>\n<\/ol>\n<p>\nPaketa Tufin Orca menaxhon politikat rrjetore t\u00eb Kubernetes (dhe sh\u00ebrben si burim p\u00ebr screenshotet e p\u00ebrmendura m\u00eb sip\u00ebr).<\/p>\n<h2>Informacione shtes\u00eb<\/h2>\n<p><\/p>\n<ul>\n<li> <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/ahmetb\/kubernetes-network-policy-recipes\">Shembujt e politikave rrjetore, t\u00eb p\u00ebrgatitur nga Ahmet Alp Balkan nga GKE.<\/a><\/noindex>;<\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"https:\/\/kubernetes.io\/docs\/concepts\/services-networking\/network-policies\/\">Dokumentacioni nga faqja zyrtare e Kubernetes<\/a><\/noindex>;<\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"https:\/\/sookocheff.com\/post\/kubernetes\/understanding-kubernetes-networking-model\/\">Udh\u00ebzuesi p\u00ebr modelin rrjetor t\u00eb Kubernetes<\/a><\/noindex>;<\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/Tufin\/test-network-policies\">Skripti p\u00ebr kontrollin e politikave rrjetore<\/a><\/noindex>.<\/li>\n<\/ul>\n<p><\/p>\n<h2>P\u00ebrfundim<\/h2>\n<p>\nPolitikat rrjetore t\u00eb Kubernetes ofrojn\u00eb nj\u00eb set t\u00eb mir\u00eb mjetesh p\u00ebr segmentimin e klaster\u00ebve, megjithat\u00eb ato jan\u00eb intuitivisht t\u00eb paqart\u00eb dhe kan\u00eb shum\u00eb nuanca. Un\u00eb besoj se p\u00ebr shkak t\u00eb k\u00ebsaj kompleksiteti, politikat e shum\u00eb klaster\u00ebve ekzistues p\u00ebrmbajn\u00eb gabime. Zgjidhjet e mundshme p\u00ebr k\u00ebt\u00eb problem jan\u00eb automatizimi i p\u00ebrkufizimeve t\u00eb politikave ose p\u00ebrdorimi i mjeteve t\u00eb tjera t\u00eb segmentimit.<\/p>\n<p>Shpresoj se ky udh\u00ebzues do t\u00eb ndihmoj\u00eb n\u00eb sqarimin e disa \u00e7\u00ebshtjeve dhe n\u00eb zgjidhjen e problemeve me t\u00eb cilat mund t\u00eb p\u00ebrballeni.<\/p>\n<h2>P.S. nga p\u00ebrkthyesi<\/h2>\n<p>\nLexoni gjithashtu n\u00eb blogun ton\u00eb:<\/p>\n<ul>\n<li> \"Kthehu n\u00eb mikrosh\u00ebrbime me Istio\": <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/438426\/\">pjesa 1 (takimi me mund\u00ebsit\u00eb kryesore)<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/440378\/\">pjesa 2 (ruk\u00ebtim, menaxhimi i trafikut)<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/443668\/\">pjese 3 (siguria)<\/a><\/noindex>;<\/li>\n<li> \u201cUdh\u00ebzuesi i Ilustruar p\u00ebr Struktur\u00ebn e Rrjeteve n\u00eb Kubernetes\u201d: <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/346304\/\">pjes\u00ebt 1 dhe 2 (modeli rrjetor, rrjetet overlay)<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/433382\/\">pjesa 3 (sh\u00ebrbimet dhe menaxhimi i trafik)<\/a><\/noindex>;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/440504\/\">9 praktikat m\u00eb t\u00eb mira p\u00ebr sigurimin e Kubernetes<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/436300\/\">OPA dhe SPIFFE \u2014 dy projekte t\u00eb reja n\u00eb CNCF p\u00ebr sigurin\u00eb e aplikacioneve n\u00eb cloud<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/417905\/\">11 m\u00ebnyra p\u00ebr t\u00eb (nuk) r\u00ebn\u00eb pre e hakerimit n\u00eb Kubernetes<\/a><\/noindex>\u00bb.<\/li>\n<\/ul>\n<p>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/443190\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u0438\u043c. \u043f\u0435\u0440\u0435\u0432.: \u0410\u0432\u0442\u043e\u0440 \u0441\u0442\u0430\u0442\u044c\u0438 \u2014 Reuven Harrison \u2014 \u0438\u043c\u0435\u0435\u0442 \u0431\u043e\u043b\u0435\u0435 20 \u043b\u0435\u0442 \u043e\u043f\u044b\u0442\u0430 \u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f, \u0430 \u043d\u0430 \u0441\u0435\u0433\u043e\u0434\u043d\u044f\u0448\u043d\u0438\u0439 \u0434\u0435\u043d\u044c \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u043c \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u043e\u043c \u0438 \u0441\u043e\u0443\u0447\u0440\u0435\u0434\u0438\u0442\u0435\u043b\u0435\u043c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Tufin, \u0441\u043e\u0437\u0434\u0430\u044e\u0449\u0435\u0439 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430\u043c\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0420\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u044f \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 Kubernetes \u043a\u0430\u043a \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043c\u043e\u0449\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e \u0434\u043b\u044f \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0438 \u0432 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0435, \u043e\u043d \u0432 \u0442\u043e \u0436\u0435 \u0432\u0440\u0435\u043c\u044f \u0441\u0447\u0438\u0442\u0430\u0435\u0442, \u0447\u0442\u043e \u043e\u043d\u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":24432,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-32641","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0440\u0438\u043c.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/vvedenie-v-setevye-politiki-kubernetes-dlya-spetsialistov-po-bezopasnosti\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0432 \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 Kubernetes \u0434\u043b\u044f \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u043e\u0432 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0440\u0438\u043c.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/vvedenie-v-setevye-politiki-kubernetes-dlya-spetsialistov-po-bezopasnosti\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:48:11+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:48:11+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Hyrje n\u00eb politikat rrjetore t\u00eb Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb | ProHoster","description":"Sh\u00ebn.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/vvedenie-v-setevye-politiki-kubernetes-dlya-spetsialistov-po-bezopasnosti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0432 \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 Kubernetes \u0434\u043b\u044f \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u043e\u0432 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 | ProHoster","og:description":"\u041f\u0440\u0438\u043c.","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/vvedenie-v-setevye-politiki-kubernetes-dlya-spetsialistov-po-bezopasnosti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:48:11+00:00","article:modified_time":"2019-10-31T18:48:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"32641","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 11:53:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:55:23","updated":"2026-01-21 11:53:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/32641","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=32641"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/32641\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/24432"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=32641"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=32641"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=32641"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}