{"id":32641,"date":"2019-10-31T21:48:11","date_gmt":"2019-10-31T18:48:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/vvedenie-v-setevye-politiki-kubernetes-dlya-spetsialistov-po-bezopasnosti\/"},"modified":"2019-10-31T21:48:11","modified_gmt":"2019-10-31T18:48:11","slug":"vvedenie-v-setevye-politiki-kubernetes-dlya-spetsialistov-po-bezopasnosti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/vvedenie-v-setevye-politiki-kubernetes-dlya-spetsialistov-po-bezopasnosti","title":{"rendered":"Nj\u00eb hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Nj\u00eb hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/6972a1e1385463b1fcc723c09036a565.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i><b>Sh\u00ebn. p\u00ebrk.<\/b>: Autori i artikullit \u2014 Reuven Harrison \u2014 ka m\u00eb shum\u00eb se 20 vjet p\u00ebrvoj\u00eb n\u00eb zhvillimin e softuerit dhe aktualisht \u00ebsht\u00eb drejtori teknik dhe bashk\u00ebthemelues i kompanis\u00eb Tufin, e cila krijon zgjidhje p\u00ebr menaxhimin e politikave t\u00eb siguris\u00eb. Duke e par\u00eb politik\u00ebn rrjetore t\u00eb Kubernetes si nj\u00eb mjet mjaft t\u00eb fuqish\u00ebm p\u00ebr segmentimin e rrjetit brenda nj\u00eb klasteri, ai gjithashtu beson se ato nuk jan\u00eb aq t\u00eb lehta p\u00ebr t'u zbatuar n\u00eb praktik\u00eb. Ky material (mjaft i gjer\u00eb) ka p\u00ebr q\u00ebllim t\u00eb rris\u00eb nd\u00ebrgjegj\u00ebsimin e profesionist\u00ebve mbi k\u00ebt\u00eb \u00e7\u00ebshtje dhe t\u00eb ndihmoj\u00eb ata n\u00eb krijimin e konfigurimeve t\u00eb nevojshme.<\/i><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>Sot, shum\u00eb kompani po e zgjedhin gjithnj\u00eb e m\u00eb shpesh Kubernetes p\u00ebr t\u00eb ekzekutuar aplikacionet e tyre. Interesi p\u00ebr k\u00ebt\u00eb software \u00ebsht\u00eb aq i lart\u00eb, sa disa e quajn\u00eb Kubernetes \"sistemi i ri operativ p\u00ebr qendrat e t\u00eb dh\u00ebnave\". Me kalimin e koh\u00ebs, Kubernetes (ose k8s) fillon t\u00eb perceptohet si nj\u00eb pjes\u00eb thelb\u00ebsore e biznesit q\u00eb k\u00ebrkon organizimin e proceseve t\u00eb zhvilluara t\u00eb biznesit, duke p\u00ebrfshir\u00eb sigurimin e siguris\u00eb rrjetore.<\/p>\n<p>P\u00ebr profesionist\u00ebt e siguris\u00eb q\u00eb jan\u00eb t\u00eb shqet\u00ebsuar nga puna me Kubernetes, politika e k\u00ebtij platforme p\u00ebr parazgjedhje mund t\u00eb jet\u00eb nj\u00eb zgjidhje e v\u00ebrtet\u00eb: t\u00eb lejohet \u00e7do gj\u00eb.<\/p>\n<p>Ky udh\u00ebzues do t\u00eb ndihmoj\u00eb n\u00eb kuptimin e brend\u00ebsis\u00eb s\u00eb politikave rrjetore; do t\u00eb shpjegoj\u00eb se si dallohen ato nga rregullat p\u00ebr firewalle t\u00eb zakonshme. Gjithashtu, do t\u00eb p\u00ebrmenden disa pengesa dhe do t\u00eb jepen rekomandime q\u00eb ndihmojn\u00eb n\u00eb mbrojtjen e aplikacioneve n\u00eb Kubernetes.<\/p>\n<h2>Politikat rrjetore t\u00eb Kubernetes<\/h2>\n<p>\nMekanizmi i politikave rrjetore t\u00eb Kubernetes lejon menaxhimin e nd\u00ebrveprimeve t\u00eb aplikacioneve t\u00eb vendosura n\u00eb platform\u00eb n\u00eb nivelin rrjetor (nivi i tret\u00eb n\u00eb modelin OSI). Politikat rrjetore nuk kan\u00eb disa karakteristika t\u00eb avancuara t\u00eb firewalleve moderne, si kontrolli n\u00eb nivelin 7 t\u00eb OSI dhe zbulesa e k\u00ebrc\u00ebnimeve, megjithat\u00eb ato ofrojn\u00eb nj\u00eb nivel t\u00eb baz\u00ebs s\u00eb siguris\u00eb rrjetore, q\u00eb sh\u00ebrben si nj\u00eb pik\u00eb e mir\u00eb nisjeje.<\/p>\n<h2>\u0421\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u044e\u0442 \u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u0438 \u043c\u0435\u0436\u0434\u0443 pod&#8217;\u0430\u043c\u0438<\/h2>\n<p>\n\u0420\u0430\u0431\u043e\u0447\u0438\u0435 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0432 Kubernetes \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u044e\u0442\u0441\u044f \u043f\u043e pod\u2019\u0430\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u043e\u0441\u0442\u043e\u044f\u0442 \u0438\u0437 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u043b\u0438 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432, \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u0442\u044b\u0445 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e. Kubernetes \u043f\u0440\u0438\u0441\u0432\u0430\u0438\u0432\u0430\u0435\u0442 \u043a\u0430\u0436\u0434\u043e\u043c\u0443 pod\u2019\u0443 IP-\u0430\u0434\u0440\u0435\u0441, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0439 \u0438\u0437 \u0434\u0440\u0443\u0433\u0438\u0445 pod&#8217;\u043e\u0432. \u0421\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 Kubernetes \u0437\u0430\u0434\u0430\u044e\u0442 \u043f\u0440\u0430\u0432\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0434\u043b\u044f \u0433\u0440\u0443\u043f\u043f pod&#8217;\u043e\u0432 \u0442\u0430\u043a\u0438\u043c \u0436\u0435 \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u043a\u0430\u043a \u0433\u0440\u0443\u043f\u043f\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432 \u043e\u0431\u043b\u0430\u043a\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u043a \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u0430\u043c \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d.<\/p>\n<h2>Definimi i politikave rrjetore<\/h2>\n<p>\nSi dhe burimet e tjera t\u00eb Kubernetes, politikave rrjetore u jan\u00eb caktuar n\u00eb gjuh\u00ebn YAML. N\u00eb shembullin m\u00eb posht\u00eb, aplikacioni <code>balance<\/code> i jepet akses n\u00eb <code>postgres<\/code>:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.postgres\n  namespace: default\nspec:\n  podSelector:\n    matchLabels:\n      app: postgres\n  ingress:\n  - from:\n    - podSelector:\n        matchLabels:\n          app: balance\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Nj\u00eb hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/ff5857af2641e62558b035bab9c413dc.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>(<b>Sh\u00ebn. p\u00ebrk.<\/b>: ky ekran i kapur, ashtu si t\u00eb gjith\u00eb imazhet e ngjashme q\u00eb do t\u00eb pasojn\u00eb, \u00ebsht\u00eb krijuar jo me mjetet native t\u00eb Kubernetes, por me ndihm\u00ebn e mjetit Tufin Orca, i cili \u00ebsht\u00eb zhvilluar nga kompania e autorit t\u00eb artikullit origjinal dhe p\u00ebrmendet n\u00eb fund t\u00eb materialit.<\/i><\/p>\n<p>P\u00ebr t\u00eb p\u00ebrcaktuar politik\u00ebn tuaj t\u00eb rrjetit, do t\u00eb nevojiten njohuri bazike t\u00eb YAML. Ky gjuh\u00eb \u00ebsht\u00eb e bazuar n\u00eb hap\u00ebsira (t\u00eb p\u00ebrcaktuara me hap\u00ebsira, jo me tab). Nj\u00eb element me hap\u00ebsir\u00eb i p\u00ebrket elementit m\u00eb t\u00eb af\u00ebrt me hap\u00ebsir\u00eb n\u00eb t\u00eb sip\u00ebrme. Nj\u00eb element i ri i list\u00ebs fillon me nj\u00eb defis, t\u00eb gjith\u00eb element\u00ebt e tjer\u00eb kan\u00eb form\u00ebn <i>\u00e7el\u00ebs-vler\u00eb<\/i>.<\/p>\n<p>Pasi t\u00eb keni p\u00ebrshkruar politik\u00ebn n\u00eb YAML, p\u00ebrdorni <noindex><a rel=\"nofollow\" href=\"https:\/\/kubernetes.io\/docs\/reference\/kubectl\/kubectl\/\">kubectl<\/a><\/noindex>, p\u00ebr ta krijuar at\u00eb n\u00eb klasterin:<\/p>\n<pre><code class=\"bash\">kubectl create -f policy.yaml<\/code><\/pre>\n<p><\/p>\n<h2>Specifikimi i politik\u00ebs s\u00eb rrjetit<\/h2>\n<p>\nSpecifikimi i politik\u00ebs s\u00eb rrjetit Kubernetes p\u00ebrfshin kat\u00ebr elemente:<\/p>\n<ol>\n<li> <code>podSelector<\/code>: \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u0435\u0442 pod&#8217;\u044b, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u044d\u0442\u043e\u0439 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u043e\u0439 (\u0446\u0435\u043b\u0438) \u2014 \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0439;<\/li>\n<li> <code>policyTypes<\/code>: tregon se cilat lloje politikash jan\u00eb t\u00eb p\u00ebrfshira n\u00eb k\u00ebt\u00eb: ingress dhe\/apo egress - opcionale, megjithat\u00eb rekomandoj ta shkruani qart\u00eb n\u00eb t\u00eb gjitha rastet;<\/li>\n<li> <code>ingress<\/code>: p\u00ebrcakton trafikun e lejuar <b>t\u00eb ardhsh\u00ebm<\/b> \u0442\u0440\u0430\u0444\u0438\u043a \u0432 \u0446\u0435\u043b\u0435\u0432\u044b\u0435 pod&#8217;\u044b \u2014 \u043d\u0435\u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0439;<\/li>\n<li> <code>egress<\/code>: p\u00ebrcakton trafikun e lejuar <b>trafiku i daljes<\/b> \u0442\u0440\u0430\u0444\u0438\u043a \u0438\u0437 \u0446\u0435\u043b\u0435\u0432\u044b\u0445 pod&#8217;\u043e\u0432 \u2014 \u043d\u0435\u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0439.<\/li>\n<\/ol>\n<p>\nNj\u00eb shembull, e marr\u00eb nga faqja Kubernetes (un\u00eb e z\u00ebvend\u00ebsova <code>role<\/code> n\u00eb <code>app<\/code>), tregon se si p\u00ebrdoren t\u00eb kat\u00ebr element\u00ebt:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: test-network-policy\n  namespace: default\nspec:\n  podSelector:    # &lt;&lt;&lt;&lt;\n    matchLabels:\n      app: db\n  policyTypes:    # &lt;&lt;&lt;&lt;\n  - Ingress\n  - Egress\n  ingress:        # &lt;&lt;&lt;&lt;\n  - from:\n    - ipBlock:\n        cidr: 172.17.0.0\/16\n        except:\n        - 172.17.1.0\/24\n    - namespaceSelector:\n        matchLabels:\n          project: myproject\n    - podSelector:\n        matchLabels:\n          role: frontend\n    ports:\n    - protocol: TCP\n      port: 6379\n  egress:         # &lt;&lt;&lt;&lt;\n  - to:\n    - ipBlock:\n        cidr: 10.0.0.0\/24\n    ports:\n    - protocol: TCP\n      port: 5978<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Nj\u00eb hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/f01e748410564756d6272095093e52e2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<img decoding=\"async\" alt=\"Nj\u00eb hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/997282073ee6b5c4d6b7af45cdc11295.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKini\u00e7on p\u00ebrshtatni se t\u00eb kat\u00ebr element\u00ebt jan\u00eb t\u00eb panevojshme. T\u00eb detyruesh\u00ebm \u00ebsht\u00eb vet\u00ebm <code>podSelector<\/code>, parametrat tjer\u00eb mund t\u00eb p\u00ebrdoren sipas d\u00ebshir\u00ebs.<\/p>\n<p>N\u00ebse lihet jasht\u00eb <code>policyTypes<\/code>, politika do t\u00eb interpretohet si m\u00eb posht\u00eb:<\/p>\n<ul>\n<li> Default, supozohet se ajo definon an\u00ebn e ingress. N\u00ebse n\u00eb politik\u00eb nuk ka udh\u00ebzime t\u00eb qarta p\u00ebr k\u00ebt\u00eb, sistemi do ta konsideroj\u00eb se t\u00eb gjith\u00eb trafiku \u00ebsht\u00eb i ndaluar.<\/li>\n<li> Sjellja n\u00eb an\u00ebn e egress do t\u00eb p\u00ebrcaktohet nga pranimi ose mungesa e parametrave p\u00ebrkat\u00ebs t\u00eb egress.<\/li>\n<\/ul>\n<p>\nP\u00ebr t\u00eb shmangur gabimet, rekomandoj <b>t\u00eb citohet gjithmon\u00eb qart\u00eb <code>policyTypes<\/code><\/b>.<\/p>\n<p>Sipas logjik\u00ebs s\u00eb m\u00ebsip\u00ebrme, n\u00eb rast se parametrat <code>ingress<\/code> dhe\/ose <code>egress<\/code> jan\u00eb l\u00ebn\u00eb jasht\u00eb, politika do t\u00eb ndaloj\u00eb t\u00eb gjith\u00eb trafikun (shih \"Rregulli i pastrimit\" m\u00eb posht\u00eb).<\/p>\n<h2>Politika e parazgjedhur - lejo<\/h2>\n<p>\n\u0415\u0441\u043b\u0438 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u043d\u0435 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u044b, Kubernetes \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u0435\u0442 \u0432\u0435\u0441\u044c \u0442\u0440\u0430\u0444\u0438\u043a. \u0412\u0441\u0435 pod&#8217;\u044b \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e \u043c\u043e\u0433\u0443\u0442 \u043e\u0431\u043c\u0435\u043d\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0435\u0439 \u043c\u0435\u0436\u0434\u0443 \u0441\u043e\u0431\u043e\u0439. \u0421 \u0442\u043e\u0447\u043a\u0438 \u0437\u0440\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u044d\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u044c\u0441\u044f \u043d\u0435\u043b\u043e\u0433\u0438\u0447\u043d\u044b\u043c, \u043d\u043e \u0432\u0441\u043f\u043e\u043c\u043d\u0438\u0442\u0435 \u043e \u0442\u043e\u043c, \u0447\u0442\u043e Kubernetes \u0438\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u043b\u0441\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c\u0438 \u0441 \u0446\u0435\u043b\u044c\u044e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0442\u044c \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439. \u0421\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u0431\u044b\u043b\u0438 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u044b \u043f\u043e\u0437\u0436\u0435.<\/p>\n<h2>Hap\u00ebsirat em\u00ebrore<\/h2>\n<p>\nHap\u00ebsirat em\u00ebrore (Namespaces) jan\u00eb mekanizmi i bashk\u00ebpunimit n\u00eb Kubernetes. Ato jan\u00eb t\u00eb destinuara p\u00ebr t\u00eb izoluara ambientet logjike nga nj\u00ebra-tjetra, nd\u00ebrkoh\u00eb q\u00eb ndarja e t\u00eb dh\u00ebnave mes hap\u00ebsirave nga default lejohet.<\/p>\n<p>Si shumica e komponenteve t\u00eb Kubernetes, politikat e rrjetit jetojn\u00eb n\u00eb nj\u00eb hap\u00ebsir\u00eb t\u00eb caktuar em\u00ebrore. N\u00eb bllokun <code>metadata<\/code> mund t\u00eb shkruhet se kujt hap\u00ebsire i p\u00ebrket politika:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: test-network-policy\n  namespace: my-namespace  # &lt;&lt;&lt;\nspec:\n...<\/code><\/pre>\n<p>\nN\u00ebse hap\u00ebsira em\u00ebrore n\u00eb metadata nuk \u00ebsht\u00eb shprehur qart\u00eb, sistemi do t\u00eb p\u00ebrdor\u00eb hap\u00ebsir\u00ebn em\u00ebrore t\u00eb caktuar n\u00eb kubectl (nga default <code>namespace=default<\/code>):<\/p>\n<pre><code class=\"bash\">kubectl apply -n my-namespace -f namespace.yaml<\/code><\/pre>\n<p>\nUn\u00eb rekomandoj <b>t\u00eb specifikohet qart\u00eb hap\u00ebsira em\u00ebrore<\/b>, p\u00ebrve\u00e7 n\u00ebse po shkruani nj\u00eb politik\u00eb q\u00eb \u00ebsht\u00eb e destinuar p\u00ebr disa hap\u00ebsira emri nj\u00ebher\u00ebsh.<\/p>\n<p><b>Themelor<\/b> element <code>podSelector<\/code> \u0432 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0435 \u0431\u0443\u0434\u0435\u0442 \u0432\u044b\u0431\u0438\u0440\u0430\u0442\u044c pod\u2019\u044b \u0438\u0437 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u0438\u043c\u0435\u043d, \u043a \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u043f\u0440\u0438\u043d\u0430\u0434\u043b\u0435\u0436\u0438\u0442 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430 (\u043e\u043d \u043b\u0438\u0448\u0435\u043d \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a pod&#8217;\u0430\u043c \u0438\u0437 \u0434\u0440\u0443\u0433\u043e\u0433\u043e \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u0438\u043c\u0451\u043d).<\/p>\n<p>\u0410\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c podSelector&#8217;\u044b <b>n\u00eb blloqet ingress dhe egress<\/b> mund t\u00eb zgjedhin pod\u2019\u00eb vet\u00ebm nga hap\u00ebsira e tyre emri, p\u00ebrve\u00e7 n\u00ebse nuk i bashkoni ato me <code>namespaceSelector<\/code> (\u043e\u0431 \u044d\u0442\u043e\u043c \u043f\u043e\u0439\u0434\u0435\u0442 \u0440\u0435\u0447\u044c \u0432 \u0440\u0430\u0437\u0434\u0435\u043b\u0435 \u00ab\u0424\u0438\u043b\u044c\u0442\u0440 \u043f\u043e \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430\u043c \u0438\u043c\u0435\u043d \u0438 pod&#8217;\u0430\u043c\u00bb).<\/p>\n<h2>Rregullat e em\u00ebrtes\u00ebs s\u00eb politikave<\/h2>\n<p>\nEmrat e politikave jan\u00eb unik\u00eb brenda nj\u00eb hap\u00ebsire emri. Dy politika me t\u00eb nj\u00ebjt\u00ebn em\u00ebr n\u00eb nj\u00eb hap\u00ebsir\u00eb nuk mund t\u00eb ekzistojn\u00eb, por mund t\u00eb ket\u00eb politika me emra t\u00eb nj\u00ebjt\u00eb n\u00eb hap\u00ebsira t\u00eb ndryshme. Kjo \u00ebsht\u00eb e dobishme kur d\u00ebshironi t\u00eb p\u00ebrs\u00ebrisni t\u00eb nj\u00ebjt\u00ebn politik\u00eb n\u00eb disa hap\u00ebsira.<\/p>\n<p>M\u00eb p\u00eblqeu ve\u00e7an\u00ebrisht nj\u00eb nga metodat e em\u00ebrtes\u00ebs. Kjo p\u00ebrfshin kombinimin e emrit t\u00eb hap\u00ebsir\u00ebs emri me pod\u2019\u00ebt target.<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.postgres  # &lt;&lt;&lt;&lt;\n  namespace: default\nspec:\n  podSelector:\n    matchLabels:\n      app: postgres\n  ingress:\n  - from:\n    - podSelector:\n        matchLabels:\n          app: admin\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Nj\u00eb hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/18318c320d6e37eeb01c51f251550639.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Etiketat<\/h2>\n<p>\nEtiketat mund t\u00eb bashk\u00ebngjiten objekteve Kubernetes si pod-\u00ebt dhe hap\u00ebsirat em\u00ebrore. Etiketat (<i>etiketat<\/i> \u2014 shenjat) jan\u00eb ekuivalenti i etiketave n\u00eb re. Politikat e rrjetit t\u00eb Kubernetes p\u00ebrdorin etiketat p\u00ebr t\u00eb p\u00ebrzgjedhur <b>pod&#8217;\u043e\u0432<\/b>, t\u00eb cilave ata iu referohen:<\/p>\n<pre><code class=\"plaintext\">podSelector:\n  matchLabels:\n    role: db<\/code><\/pre>\n<p>\n\u2026 ose <b>hap\u00ebsirat em\u00ebrore<\/b>, \u043a \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u043e\u043d\u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u044e\u0442\u0441\u044f. \u0412 \u044d\u0442\u043e\u043c \u043f\u0440\u0438\u043c\u0435\u0440\u0435 \u0432\u044b\u0431\u0438\u0440\u0430\u044e\u0442\u0441\u044f \u0432\u0441\u0435 pod&#8217;\u044b \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430\u0445 \u0438\u043c\u0435\u043d \u0441 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u043c\u0438 \u043b\u0435\u0439\u0431\u043b\u0430\u043c\u0438:<\/p>\n<pre><code class=\"plaintext\">namespaceSelector:\n  matchLabels:\n    project: myproject<\/code><\/pre>\n<p>\nNj\u00eb k\u00ebshill\u00eb: gjat\u00eb p\u00ebrdorimit <code>namespaceSelector<\/code> <b>sigurohuni q\u00eb hap\u00ebsirat em\u00ebrore t\u00eb p\u00ebrzgjedhura p\u00ebrmbajn\u00eb etiket\u00ebn e duhur<\/b>. Mbani mend se hap\u00ebsirat em\u00ebrore t\u00eb integruara si <code>default<\/code> dhe <code>kubectl -n kube-system edit cm kubelet-config-1.16<\/code>, n\u00eb m\u00ebnyr\u00eb t\u00eb paracaktuar, nuk p\u00ebrmbajn\u00eb etiketa.<\/p>\n<p>P\u00ebr t\u00eb shtuar nj\u00eb etiket\u00eb n\u00eb hap\u00ebsir\u00ebn em\u00ebrore, mund ta b\u00ebni si m\u00eb posht\u00eb:<\/p>\n<pre><code class=\"bash\">kubectl label namespace default namespace=default<\/code><\/pre>\n<p>\nN\u00eb k\u00ebt\u00eb rast, hap\u00ebsira n\u00eb seksionin <code>metadata<\/code> duhet t\u00eb referohet n\u00eb emrin aktual t\u00eb hap\u00ebsir\u00ebs, jo n\u00eb etiket\u00eb:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: test-network-policy\n  namespace: default   # &lt;&lt;&lt;&lt;\nspec:\n...<\/code><\/pre>\n<p><\/p>\n<h2>Burimi dhe adresati<\/h2>\n<p>\n\u041f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u0434\u043b\u044f \u0431\u0440\u0430\u043d\u0434\u043c\u0430\u0443\u044d\u0440\u043e\u0432 \u0441\u043e\u0441\u0442\u043e\u044f\u0442 \u0438\u0437 \u043f\u0440\u0430\u0432\u0438\u043b \u0441 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430\u043c\u0438 \u0438 \u0430\u0434\u0440\u0435\u0441\u0430\u0442\u0430\u043c\u0438. \u0421\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 Kubernetes \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u044e\u0442\u0441\u044f \u0434\u043b\u044f \u0446\u0435\u043b\u0438 \u2014 \u043d\u0430\u0431\u043e\u0440\u0430 \u0438\u0437 pod&#8217;\u043e\u0432, \u043a \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u043e\u043d\u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u044e\u0442\u0441\u044f, \u0430 \u0437\u0430\u0442\u0435\u043c \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u044e\u0442 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0434\u043b\u044f \u0432\u0445\u043e\u0434\u044f\u0449\u0435\u0433\u043e (ingress) \u0438\/\u0438\u043b\u0438 \u0438\u0441\u0445\u043e\u0434\u044f\u0449\u0435\u0433\u043e (egress) \u0442\u0440\u0430\u0444\u0438\u043a\u0430. \u0412 \u043d\u0430\u0448\u0435\u043c \u043f\u0440\u0438\u043c\u0435\u0440\u0435 \u0446\u0435\u043b\u044c\u044e \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u0431\u0443\u0434\u0443\u0442 \u0432\u0441\u0435 pod\u2019\u044b \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u0438\u043c\u0435\u043d <code>default<\/code> me etiket\u00eb me \u00e7el\u00ebsin <code>app<\/code> dhe vler\u00ebn <code>db<\/code>:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: test-network-policy\n  namespace: default\nspec:\n  podSelector:\n    matchLabels:\n      app: db   # &lt;&lt;&lt;\n  policyTypes:\n  - Ingress\n  - Egress\n  ingress:\n  - from:\n    - ipBlock:\n        cidr: 172.17.0.0\/16\n        except:\n        - 172.17.1.0\/24\n    - namespaceSelector:\n        matchLabels:\n          project: myproject\n    - podSelector:\n        matchLabels:\n          role: frontend\n    ports:\n    - protocol: TCP\n      port: 6379\n  egress:\n  - to:\n    - ipBlock:\n        cidr: 10.0.0.0\/24\n    ports:\n    - protocol: TCP\n      port: 5978<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Nj\u00eb hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/5fcb3f78e26ae1ed5635541ad69ef69f.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<img decoding=\"async\" alt=\"Nj\u00eb hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/c753f559ecc3ba54f8b55e29851428c4.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nN\u00ebnseksioni <code>ingress<\/code> n\u00eb k\u00ebt\u00eb politik\u00eb hap trafikun e ardhsh\u00ebm n\u00eb pod\u2019\u00ebt e synuar. Me fjal\u00eb t\u00eb tjera, ingress vepron si burim, nd\u00ebrsa q\u00ebllimi \u00ebsht\u00eb adresati p\u00ebrkat\u00ebs. Po ashtu, egress \u00ebsht\u00eb adresati, dhe q\u00ebllimi \u00ebsht\u00eb burimi i tij.<\/p>\n<p><img decoding=\"async\" alt=\"Nj\u00eb hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/a0d865de57a7620849074424770832cd.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>Kjo \u00ebsht\u00eb ekuivalente me dy rregulla p\u00ebr firewalls: Ingress \u2192 Q\u00ebllim; Q\u00ebllim \u2192 Egress.<\/i><\/p>\n<h2>Egress dhe DNS (\u00ebsht\u00eb e r\u00ebnd\u00ebsishme!)<\/h2>\n<p>\nDuke kufizuar trafikun e dalsh\u00ebm, <b>kushtojini v\u00ebmendje t\u00eb ve\u00e7ant\u00eb DNS<\/b> \u2014 Kubernetes e p\u00ebrdor k\u00ebt\u00eb sh\u00ebrbim p\u00ebr t\u00eb lidhur sh\u00ebrbimet me adresat IP. P\u00ebr shembull, politika e m\u00ebposhtme nuk do t\u00eb funksionoj\u00eb, pasi nuk e lejoni aplikacionin <code>balance<\/code> t\u00eb aksesoj\u00eb DNS:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.balance\n  namespace: default\nspec:\n  podSelector:\n    matchLabels:\n      app: balance\n  egress:\n  - to:\n    - podSelector:\n        matchLabels:\n          app: postgres\n  policyTypes:\n  - Egress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Nj\u00eb hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/5857a44cc5e06de708f0d3b5b0f49628.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nMund ta rregulloni k\u00ebt\u00eb duke hapur aksesin n\u00eb sh\u00ebrbimin DNS:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.balance\n  namespace: default\nspec:\n  podSelector:\n    matchLabels:\n      app: balance\n  egress:\n  - to:\n    - podSelector:\n        matchLabels:\n          app: postgres\n  - to:               # &lt;&lt;&lt;&lt;\n    ports:            # &lt;&lt;&lt;&lt;\n    - protocol: UDP   # &lt;&lt;&lt;&lt;\n      port: 53        # &lt;&lt;&lt;&lt;\n  policyTypes:\n  - Egress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Nj\u00eb hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/a396bb2ae94fca94c3b62aef2cb07552.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nElementi i fundit <code>to<\/code> \u2014 bosh, dhe prandaj ai p\u00ebrzgjedh n\u00eb m\u00ebnyr\u00eb indirecte <b>\u0432\u0441\u0435 pod&#8217;\u044b \u0432\u043e \u0432\u0441\u0435\u0445 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430\u0445 \u0438\u043c\u0435\u043d<\/b>, duke lejuar <code>balance<\/code> d\u00ebrgimin e k\u00ebrkesave DNS n\u00eb sh\u00ebrbimin p\u00ebrkat\u00ebs t\u00eb Kubernetes (zakonisht ai funksionon n\u00eb hap\u00ebsir\u00ebn <code>kubectl -n kube-system edit cm kubelet-config-1.16<\/code>).<\/p>\n<p>Ky qasje funksionon, megjithat\u00eb \u00ebsht\u00eb <b>shum\u00eb leht\u00ebsues dhe i pasigurt<\/b>, pasi lejon d\u00ebrgimin e k\u00ebrkesave DNS jasht\u00eb klasterit.<\/p>\n<p>Mund ta p\u00ebrmir\u00ebsoni k\u00ebt\u00eb me tri hapa t\u00eb radhitur.<\/p>\n<p>1. Lejoni k\u00ebrkesat DNS vet\u00ebm <b>brenda<\/b> p\u00ebr klasterin, duke shtuar <code>namespaceSelector<\/code>:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.balance\n  namespace: default\nspec:\n  podSelector:\n    matchLabels:\n      app: balance\n  egress:\n  - to:\n    - podSelector:\n        matchLabels:\n          app: postgres\n  - to:\n    - namespaceSelector: {} # &lt;&lt;&lt;\n    ports:\n    - protocol: UDP\n      port: 53\n  policyTypes:\n  - Egress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Nj\u00eb hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/5920a043229676e0780d691d302c5ade.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n2. Lejoni DNS-requests vet\u00ebm n\u00eb hap\u00ebsir\u00ebn e emrave <code>kubectl -n kube-system edit cm kubelet-config-1.16<\/code>.<\/p>\n<p>P\u00ebr k\u00ebt\u00eb duhet t\u00eb shtoni nj\u00eb etiket\u00eb n\u00eb hap\u00ebsir\u00ebn e emrave <code>kubectl -n kube-system edit cm kubelet-config-1.16<\/code>: <code>kubectl label namespace kube-system namespace=kube-system<\/code> \u2014 dhe ta p\u00ebrfshini n\u00eb politik\u00ebn me <code>namespaceSelector<\/code>:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.balance\n  namespace: default\nspec:\n  podSelector:\n    matchLabels:\n      app: balance\n  egress:\n  - to:\n    - podSelector:\n        matchLabels:\n          app: postgres\n  - to:\n    - namespaceSelector:         # &lt;&lt;&lt;\n        matchLabels:             # &lt;&lt;&lt;\n          namespace: kube-system # &lt;&lt;&lt;\n    ports:\n    - protocol: UDP\n      port: 53\n  policyTypes:\n  - Egress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Nj\u00eb hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/2a1dd0975c58e6d277baffc7c3ac6e48.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n3. Paranoik\u00ebt mund t\u00eb shkojn\u00eb edhe m\u00eb tej dhe t\u00eb kufizojn\u00eb DNS-requests p\u00ebr nj\u00eb sh\u00ebrbim t\u00eb caktuar DNS n\u00eb <code>kubectl -n kube-system edit cm kubelet-config-1.16<\/code>. \u0412 \u0440\u0430\u0437\u0434\u0435\u043b\u0435 \u00ab\u0424\u0438\u043b\u044c\u0442\u0440 \u043f\u043e \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430\u043c \u0438\u043c\u0435\u043d \u0418 pod&#8217;\u0430\u043c\u00bb \u0431\u0443\u0434\u0435\u0442 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043d\u043e, \u043a\u0430\u043a \u044d\u0442\u043e\u0433\u043e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f.<\/p>\n<p>Nj\u00eb alternativ\u00eb tjet\u00ebr \u00ebsht\u00eb t\u00eb lejoni DNS n\u00eb nivelin e hap\u00ebsir\u00ebs s\u00eb emrave. N\u00eb k\u00ebt\u00eb rast, nuk do t\u00eb nevojitet q\u00eb ta hapni p\u00ebr \u00e7do sh\u00ebrbim:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.dns\n  namespace: default\nspec:\n  podSelector: {} # &lt;&lt;&lt;\n  egress:\n  - to:\n    - namespaceSelector: {}\n    ports:\n    - protocol: UDP\n      port: 53\n  policyTypes:\n  - Egress<\/code><\/pre>\n<p>\nBosht <code>podSelector<\/code> zgjedh t\u00eb gjith\u00eb pod\u2019\u00ebt n\u00eb hap\u00ebsir\u00ebn e emrave.<\/p>\n<p><img decoding=\"async\" alt=\"Nj\u00eb hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/5d6b627b69da980477b3910fbf4de6c1.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>P\u00ebrputhja e par\u00eb dhe rendi i rregullave<\/h2>\n<p>\nN\u00eb bllokadat e zakonshme, veprimi (\u00abLejo\u00bb ose \u00abNdalo\u00bb) n\u00eb lidhje me paket\u00ebn p\u00ebrcaktohet nga rregulli i par\u00eb q\u00eb plot\u00ebsohet. <b>N\u00eb Kubernetes, rendi i politikave nuk ka r\u00ebnd\u00ebsi.<\/b><\/p>\n<p>\u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, \u043a\u043e\u0433\u0434\u0430 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u043d\u0435 \u0437\u0430\u0434\u0430\u043d\u044b, \u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u0438 \u043c\u0435\u0436\u0434\u0443 pod&#8217;\u0430\u043c\u0438 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u044b \u0438 \u043e\u043d\u0438 \u043c\u043e\u0433\u0443\u0442 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e \u043e\u0431\u043c\u0435\u043d\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0435\u0439. \u041a\u0430\u043a \u0442\u043e\u043b\u044c\u043a\u043e \u0432\u044b \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442\u0435 \u0444\u043e\u0440\u043c\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438, \u043a\u0430\u0436\u0434\u044b\u0439 pod, \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0439 \u0445\u043e\u0442\u044f \u0431\u044b \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u043d\u0438\u0445, \u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u0441\u044f \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0432 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0438 \u0441 \u0434\u0438\u0437\u044a\u044e\u043d\u043a\u0446\u0438\u0435\u0439 (\u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0438\u043c \u0418\u041b\u0418) \u0432\u0441\u0435\u0445 \u043f\u043e\u043b\u0438\u0442\u0438\u043a, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0435\u0433\u043e \u0432\u044b\u0431\u0440\u0430\u043b\u0438. Pod\u2019\u044b, \u043d\u0435 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0435 \u043a\u0430\u043a\u043e\u0439-\u043b\u0438\u0431\u043e \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u043e\u0439, \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c\u0438.<\/p>\n<p>I nj\u00ebjti sjellje mund t\u00eb ndryshohet duke p\u00ebrdorur nj\u00eb rregull pastrimi.<\/p>\n<h2>Rregulli i pastrimit (\u00abNdalo\u00bb)<\/h2>\n<p>\nPolitikat e bllokadave zakonisht ndalojn\u00eb \u00e7do trafiku q\u00eb nuk \u00ebsht\u00eb lejuar n\u00eb m\u00ebnyr\u00eb t\u00eb qart\u00eb.<\/p>\n<p><b>N\u00eb Kubernetes nuk ka veprimi \u00abndalo\u00bb (deny)<\/b>, \u043e\u0434\u043d\u0430\u043a\u043e \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u043e\u0433\u043e \u044d\u0444\u0444\u0435\u043a\u0442\u0430 \u043c\u043e\u0436\u043d\u043e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0441 \u043e\u0431\u044b\u0447\u043d\u043e\u0439 (\u0440\u0430\u0437\u0440\u0435\u0448\u0430\u044e\u0449\u0435\u0439) \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u043e\u0439, \u0432\u044b\u0431\u0440\u0430\u0432 \u043f\u0443\u0441\u0442\u0443\u044e \u0433\u0440\u0443\u043f\u043f\u0443 pod&#8217;\u043e\u0432-\u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u0432 (ingress):<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: deny-all\n  namespace: default\nspec:\n  podSelector: {}\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Nj\u00eb hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/8b3ced50ec5a1de70940d53f467966fe.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u042d\u0442\u0430 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430 \u0432\u044b\u0431\u0438\u0440\u0430\u0435\u0442 \u0432\u0441\u0435 pod&#8217;\u044b \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u0438\u043c\u0435\u043d \u0438 \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 ingress \u043d\u0435\u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u043c, \u0437\u0430\u043f\u0440\u0435\u0449\u0430\u044f \u0432\u0435\u0441\u044c \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439 \u0442\u0440\u0430\u0444\u0438\u043a.<\/p>\n<p>N\u00eb m\u00ebnyr\u00eb t\u00eb ngjashme, mund t\u00eb kufizoni t\u00eb gjith\u00eb trafikun e dal\u00ebs nga hap\u00ebsira e emrit:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: deny-all-egress\n  namespace: default\nspec:\n  podSelector: {}\n  policyTypes:\n  - Egress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Nj\u00eb hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/be22e11efef0098f2665331c09d748f2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nMbani parasysh se <b>\u043b\u044e\u0431\u044b\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438, \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u044e\u0449\u0438\u0435 \u0442\u0440\u0430\u0444\u0438\u043a \u043a pod&#8217;\u0430\u043c \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u0438\u043c\u0435\u043d, \u0431\u0443\u0434\u0443\u0442 \u0438\u043c\u0435\u0442\u044c \u043f\u0440\u0438\u043e\u0440\u0438\u0442\u0435\u0442 \u043d\u0430\u0434 \u044d\u0442\u0438\u043c \u043f\u0440\u0430\u0432\u0438\u043b\u043e\u043c<\/b> (ngjash\u00ebm me shtimin e nj\u00eb rregulli leht\u00ebsues para nj\u00eb rregulli ndaluese n\u00eb konfigurimin e firewall-it).<\/p>\n<h2>Lejo t\u00eb gjitha (Any-Any-Any-Allow)<\/h2>\n<p>\nP\u00ebr t\u00eb krijuar politik\u00ebn \"Lejo t\u00eb gjitha\", duhet t\u00eb plot\u00ebsoni politik\u00ebn ndaluese t\u00eb m\u00ebsip\u00ebrme me nj\u00eb element t\u00eb zbraz\u00ebt <code>ingress<\/code>:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: allow-all\n  namespace: default\nspec:\n  podSelector: {}\n  ingress: # &lt;&lt;&lt;\n  - {}     # &lt;&lt;&lt;\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Nj\u00eb hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/7322351493211388fe772b8dc270108d.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAjo hap aksesin nga <b>\u0432\u0441\u0435\u0445 pod&#8217;\u043e\u0432 \u0432\u043e \u0432\u0441\u0435\u0445 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430\u0445 \u0438\u043c\u0435\u043d (\u0438 \u0432\u0441\u0435\u0445 IP) \u043a \u043b\u044e\u0431\u043e\u043c\u0443 pod\u2019\u0443 \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u0438\u043c\u0435\u043d <code>default<\/code><\/b>. Nj\u00eb sjellje e till\u00eb \u00ebsht\u00eb e aktivizuar nga default, prandaj zakonisht nuk ka nevoj\u00eb t\u00eb p\u00ebrcaktohet m\u00eb tej. Megjithat\u00eb, ndonj\u00ebher\u00eb mund t\u00eb jet\u00eb e nevojshme t\u00eb \u00e7aktivizoni p\u00ebrkoh\u00ebsisht disa leje specifike p\u00ebr t\u00eb diagnostikuar nj\u00eb problem.<\/p>\n<p>Rregulli mund t\u00eb ngushtohet dhe t\u00eb lejoj\u00eb akses vet\u00ebm n\u00eb <b>\u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u043d\u0430\u0431\u043e\u0440\u0443 pod&#8217;\u043e\u0432<\/b> (<code>app:balance<\/code>) n\u00eb hap\u00ebsir\u00ebn e emrave <code>default<\/code>:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: allow-all-to-balance\n  namespace: default\nspec:\n  podSelector:\n    matchLabels:\n      app: balance\n  ingress: \n  - {}\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Nj\u00eb hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/d8c9cb85003f489acec815d1c2b53497.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPolitika e m\u00ebposhtme lejon t\u00eb gjith\u00eb trafikun e ardhsh\u00ebm (ingress) dhe dal\u00ebs (egress), duke p\u00ebrfshir\u00eb aksesin n\u00eb \u00e7do IP jasht\u00eb grumbullit:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: allow-all\nspec:\n  podSelector: {}\n  ingress:\n  - {}\n  egress:\n  - {}\n  policyTypes:\n  - Ingress\n  - Egress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Nj\u00eb hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/2477f18d3d228f80bc5169d9ec3be2fc.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<img decoding=\"async\" alt=\"Nj\u00eb hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/3502b892713cdac8850e812b2eff3ea3.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Kombinimi i disa politikave<\/h2>\n<p>\n\u041f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u044f\u044e\u0442\u0441\u044f \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0418\u041b\u0418 \u043d\u0430 \u0442\u0440\u0435\u0445 \u0443\u0440\u043e\u0432\u043d\u044f\u0445; \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u044f \u043a\u0430\u0436\u0434\u043e\u0433\u043e pod&#8217;\u0430 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u0432 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0438 \u0441 \u0434\u0438\u0437\u044a\u044e\u043d\u043a\u0446\u0438\u0435\u0439 \u0432\u0441\u0435\u0445 \u043f\u043e\u043b\u0438\u0442\u0438\u043a, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0435\u0433\u043e \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442:<\/p>\n<p>1. N\u00eb fushat <code>from<\/code> dhe <code>to<\/code> mund t\u00eb p\u00ebrcaktohen tre lloje element\u00ebsh (t\u00eb gjith\u00eb ata kombinohen p\u00ebrmes OREDHE):<\/p>\n<ul>\n<li> <code>namespaceSelector<\/code> \u2014 zgjat t\u00ebr\u00eb hap\u00ebsir\u00ebn e emrave;<\/li>\n<li> <code>podSelector<\/code> \u2014 zgjat pod\u2019ash;<\/li>\n<li> <code>ipBlock<\/code> \u2014 zgjat n\u00ebndeg\u00ebn.<\/li>\n<\/ul>\n<p>\nN\u00eb k\u00ebt\u00eb rast, numri i element\u00ebve (edhe n\u00ebse jan\u00eb t\u00eb nj\u00ebjt\u00eb) n\u00eb n\u00ebnshkrime <code>from<\/code>\/<code>to<\/code> nuk \u00ebsht\u00eb i kufizuar. T\u00eb gjith\u00eb ata do t\u00eb kombinohen me logjik\u00ebn OREDHE.<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.postgres\n  namespace: default\nspec:\n  ingress:\n  - from:\n    - podSelector:\n        matchLabels:\n          app: indexer\n    - podSelector:\n        matchLabels:\n          app: admin\n  podSelector:\n    matchLabels:\n      app: postgres\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Nj\u00eb hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/717e745720f39260a8508fb2b2bb6f65.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n2. Brendi i politik\u00ebs <code>ingress<\/code> mund t\u00eb ket\u00eb shum\u00eb elemente <code>from<\/code> (bashkohen me LOGJIKOREN O). Po ashtu, brendi <code>egress<\/code> mund t\u00eb p\u00ebrfshij\u00eb shum\u00eb elemente <code>to<\/code> (po ashtu bashkohen me DISJUNKSHEN):<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.postgres\n  namespace: default\nspec:\n  ingress:\n  - from:\n    - podSelector:\n        matchLabels:\n          app: indexer\n  - from:\n    - podSelector:\n        matchLabels:\n          app: admin\n  podSelector:\n    matchLabels:\n      app: postgres\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Nj\u00eb hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/b579e1f4b97acd92fb38cd6703aa1983.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n3. Politikat e ndryshme gjithashtu bashkohen me LOGJIKOREN O<\/p>\n<p>Por kur ato bashkohen, ka nj\u00eb kufizim q\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/medium.com\/sainsburys-engineering\/considerations-with-k8s-networkpolicy-cee7eacf5469\">caktova<\/a><\/noindex> <noindex><a rel=\"nofollow\" href=\"https:\/\/medium.com\/@chriscooney\">Chris Cooney<\/a><\/noindex>: Kubernetes mund t\u00eb kombinoj\u00eb politikat vet\u00ebm me ndryshme <code>policyTypes<\/code> (<code>Ingress<\/code> ose <code>Egress<\/code>). Politikat q\u00eb p\u00ebrcaktojn\u00eb ingress (ose egress) do t\u00eb tejkalojn\u00eb nj\u00ebra-tjetr\u00ebn.<\/p>\n<h2>Lidhja nd\u00ebrmjet hap\u00ebsirave t\u00eb emrave<\/h2>\n<p>\nSipas parazgjedhjes, shk\u00ebmbimi i informacionit nd\u00ebrmjet hap\u00ebsirave t\u00eb emrave \u00ebsht\u00eb i lejuar. K\u00ebt\u00eb mund ta ndryshoni me nj\u00eb politik\u00eb ndaluese q\u00eb do t\u00eb kufizoj\u00eb trafikun dal\u00ebs dhe\/ose hyj\u00ebs n\u00eb hap\u00ebsir\u00ebn e emrit (shih 'Rregulli i pastrimit' m\u00eb lart).<\/p>\n<p>Duke bllokuar q \uc811\uadfcin n\u00eb hap\u00ebsir\u00ebn e emrave (shih \u201eRregullin e pastrimit\u201c m\u00eb lart), mund t\u00eb b\u00ebni p\u00ebrjashtime nga politika ndaluese duke lejuar lidhjet nga nj\u00eb hap\u00ebsir\u00eb emrash t\u00eb caktuar me <code>namespaceSelector<\/code>:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: database.postgres\n  namespace: database\nspec:\n  podSelector:\n    matchLabels:\n      app: postgres\n  ingress:\n  - from:\n    - namespaceSelector: # &lt;&lt;&lt;\n        matchLabels:\n          namespace: default\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Nj\u00eb hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/5a3d2baed1ff9b813ef0651fe500ad8a.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSi rezultat, t\u00eb gjitha pod'\u00ebt n\u00eb hap\u00ebsir\u00ebn e emrave <code>default<\/code> \u043f\u043e\u043b\u0443\u0447\u0430\u0442 \u0434\u043e\u0441\u0442\u0443\u043f \u043a pod&#8217;\u0430\u043c <code>postgres<\/code> n\u00eb hap\u00ebsir\u00ebn e emrave <code>database<\/code>. Por \u00e7far\u00eb n\u00ebse d\u00ebshironi t\u00eb hapni aksesin n\u00eb <code>postgres<\/code> \u0442\u043e\u043b\u044c\u043a\u043e \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u044b\u043c pod&#8217;\u0430\u043c \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u0438\u043c\u0435\u043d <code>default<\/code>?<\/p>\n<h2>\u0424\u0438\u043b\u044c\u0442\u0440 \u043f\u043e \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430\u043c \u0438\u043c\u0435\u043d \u0418 pod&#8217;\u0430\u043c<\/h2>\n<p>\nKubernetes version 1.11 dhe m\u00eb lart lejon kombinimin e operator\u00ebve <code>namespaceSelector<\/code> dhe <code>podSelector<\/code> me an\u00eb t\u00eb logjik\u00ebs AND. Kjo duket k\u00ebshtu:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: database.postgres\n  namespace: database\nspec:\n  podSelector:\n    matchLabels:\n      app: postgres\n  ingress:\n  - from:\n    - namespaceSelector:\n        matchLabels:\n          namespace: default\n      podSelector: # &lt;&lt;&lt;\n        matchLabels:\n          app: admin\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Nj\u00eb hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/e933e449d9f9c10505e45930d1477b2c.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPse e shikon k\u00ebt\u00eb si AND n\u00eb vend t\u00eb zakonshm\u00ebs OR?<\/p>\n<p>Merrni parasysh se <code>podSelector<\/code> nuk fillon me nj\u00eb pik\u00eb. N\u00eb YAML kjo do t\u00eb thot\u00eb q\u00eb <code>podSelector<\/code> dhe elementi q\u00eb i paraprinig <code>namespaceSelector<\/code> i p\u00ebrkasin t\u00eb nj\u00ebjtit element t\u00eb list\u00ebs. Prandaj ato bashkohen me logjik\u00ebn AND.<\/p>\n<p>Shtimi i nj\u00eb hije para <code>podSelector<\/code> do t\u00eb sjell\u00eb krijimin e nj\u00eb elementi t\u00eb ri t\u00eb list\u00ebs, i cili do t\u00eb kombinohet me at\u00eb q\u00eb e parakalon <code>namespaceSelector<\/code> n\u00ebp\u00ebrmjet logjik\u00ebs ORE.<\/p>\n<p>\u0427\u0442\u043e\u0431\u044b \u0432\u044b\u0431\u0440\u0430\u0442\u044c pod&#8217;\u044b \u0441 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u043c \u043b\u0435\u0439\u0431\u043b\u043e\u043c <b>n\u00eb t\u00eb gjitha hap\u00ebsirat e emrave<\/b>, shkruani bosh <code>namespaceSelector<\/code>:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: database.postgres\n  namespace: database\nspec:\n  podSelector:\n    matchLabels:\n      app: postgres\n  ingress:\n  - from:\n    - namespaceSelector: {}\n      podSelector:\n        matchLabels:\n          app: admin\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Nj\u00eb hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/e79e4a8067fa254f85fa8be105c3ad34.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Etiketat multiple kombinohen me AND<\/h2>\n<p>\nRregullat p\u00ebr firewall me shum\u00eb objektiva (host, rrjete, grupe) kombinohen me logjik\u00ebn ORE. Rregulli n\u00eb vijim do t\u00eb funksionoj\u00eb n\u00ebse burimi i paket\u00ebs p\u00ebrputhet me <code>Host_1<\/code> OSE <code>Host_2<\/code>:<\/p>\n<pre><code class=\"plaintext\">| Burimi | Destinacioni | Sh\u00ebrbimi | Veprimi |\n| ----------------------------------------|\n| Host_1 | Subnet_A    | HTTPS   | Lejo  |\n| Host_2 |             |         |        |\n| ----------------------------------------|<\/code><\/pre>\n<p>\nNga ana tjet\u00ebr, n\u00eb Kubernetes etiketat e ndryshme n\u00eb <code>podSelector<\/code> ose <code>namespaceSelector<\/code> kombinohen me logjik\u00ebn AND. P\u00ebr shembull, rregulli n\u00eb vijim do t\u00eb zgjedh\u00eb pod\u2019\u00ebt q\u00eb kan\u00eb t\u00eb dy etiketat <code>role=db<\/code> DHE <code>version=v2<\/code>:<\/p>\n<pre><code class=\"plaintext\">podSelector:\n  matchLabels:\n    role: db\n    version: v2<\/code><\/pre>\n<p>\n\u0422\u0430 \u0436\u0435 \u043b\u043e\u0433\u0438\u043a\u0430 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u043a\u043e \u0432\u0441\u0435\u043c \u0442\u0438\u043f\u0430\u043c \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u043e\u0432: \u0441\u0435\u043b\u0435\u043a\u0442\u043e\u0440\u0430\u043c \u0446\u0435\u043b\u0435\u0439 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438, \u0441\u0435\u043b\u0435\u043a\u0442\u043e\u0440\u0430\u043c pod&#8217;\u043e\u0432 \u0438 \u0441\u0435\u043b\u0435\u043a\u0442\u043e\u0440\u0430\u043c \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432 \u0438\u043c\u0435\u043d.<\/p>\n<h2>Subnetet dhe IP adresat (IPBlocks)<\/h2>\n<p>\nP\u00ebr segmentimin e rrjetit, firewall-et p\u00ebrdorin VLAN, adresat IP dhe subnetet.<\/p>\n<p>\u0412 Kubernetes IP-\u0430\u0434\u0440\u0435\u0441\u0430 \u043f\u0440\u0438\u0441\u0432\u0430\u0438\u0432\u0430\u044e\u0442\u0441\u044f pod&#8217;\u0430\u043c \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0438 \u043c\u043e\u0433\u0443\u0442 \u0447\u0430\u0441\u0442\u043e \u043c\u0435\u043d\u044f\u0442\u044c\u0441\u044f, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0434\u043b\u044f \u0432\u044b\u0431\u043e\u0440\u0430 pod&#8217;\u043e\u0432 \u0438 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432 \u0438\u043c\u0435\u043d \u0432 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430\u0445 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u043b\u0435\u0439\u0431\u043b\u044b.<\/p>\n<p>Subnetet (<code>ipBlocks<\/code>) \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u043f\u0440\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0438 \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u043c\u0438 (ingress) \u0438\u043b\u0438 \u0438\u0441\u0445\u043e\u0434\u044f\u0449\u0438\u043c\u0438 (egress) \u0432\u043d\u0435\u0448\u043d\u0438\u043c\u0438 (North-South) \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f\u043c\u0438. \u041a \u043f\u0440\u0438\u043c\u0435\u0440\u0443, \u044d\u0442\u0430 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430 \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u0432\u0441\u0435\u043c pod&#8217;\u0430\u043c \u0438\u0437 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u0438\u043c\u0435\u043d <code>default<\/code> qasje n\u00eb sh\u00ebrbimin DNS t\u00eb Google:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: egress-dns\n  namespace: default\nspec:\n  podSelector: {}\n  policyTypes:\n  - Egress\n  egress:\n  - to:\n    - ipBlock:\n        cidr: 8.8.8.8\/32\n    ports:\n    - protocol: UDP\n      port: 53<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Nj\u00eb hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/42e1194e28331e667a094f19c88e0934.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u041f\u0443\u0441\u0442\u043e\u0439 \u0441\u0435\u043b\u0435\u043a\u0442\u043e\u0440 pod&#8217;\u043e\u0432 \u0432 \u044d\u0442\u043e\u043c \u043f\u0440\u0438\u043c\u0435\u0440\u0435 \u043e\u0437\u043d\u0430\u0447\u0430\u0435\u0442 \u00ab\u0432\u044b\u0431\u0440\u0430\u0442\u044c \u0432\u0441\u0435 pod\u2019\u044b \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u0438\u043c\u0435\u043d\u00bb.<\/p>\n<p>Kjo politik\u00eb hap qasje vet\u00ebm n\u00eb 8.8.8.8; \u00e7do qasje n\u00eb adresat IP t\u00eb tjera \u00ebsht\u00eb e ndaluar. Pra, n\u00eb thelb, keni bllokuar qasjen n\u00eb sh\u00ebrbimin e brendsh\u00ebm DNS t\u00eb Kubernetes. N\u00ebse gjithsesi d\u00ebshironi ta hapni at\u00eb, specifikoni k\u00ebt\u00eb n\u00eb m\u00ebnyr\u00eb t\u00eb qart\u00eb.<\/p>\n<p>Zakonisht <code>ipBlocks<\/code> dhe <code>podSelectors<\/code> \u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0432\u0437\u0430\u0438\u043c\u043e\u0438\u0441\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0438\u043c\u0438, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0435 IP-\u0430\u0434\u0440\u0435\u0441\u0430 pod&#8217;\u043e\u0432 \u043d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0432 <code>ipBlocks<\/code>. Duke specifikuar <b>\u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0435 IP pod&#8217;\u043e\u0432<\/b>, \u0432\u044b \u0444\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0440\u0430\u0437\u0440\u0435\u0448\u0438\u0442\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a\/\u043e\u0442 pod&#8217;\u043e\u0432 \u0441 \u044d\u0442\u0438\u043c\u0438 \u0430\u0434\u0440\u0435\u0441\u0430\u043c\u0438. \u041d\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0435 \u0432\u044b \u043d\u0435 \u0431\u0443\u0434\u0435\u0442\u0435 \u0437\u043d\u0430\u0442\u044c, \u043a\u0430\u043a\u043e\u0439 IP-\u0430\u0434\u0440\u0435\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c, \u0438\u043c\u0435\u043d\u043d\u043e \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0438\u0445 \u043d\u0435 \u0441\u0442\u043e\u0438\u0442 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c \u0434\u043b\u044f \u0432\u044b\u0431\u043e\u0440\u0430 pod&#8217;\u043e\u0432.<\/p>\n<p>\u0412 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043a\u043e\u043d\u0442\u0440-\u043f\u0440\u0438\u043c\u0435\u0440\u0430 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430 \u0432\u043a\u043b\u044e\u0447\u0430\u0435\u0442 \u0432\u0441\u0435 IP \u0438, \u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e, \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f \u043a\u043e \u0432\u0441\u0435\u043c \u0434\u0440\u0443\u0433\u0438\u043c pod&#8217;\u0430\u043c:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: egress-any\n  namespace: default\nspec:\n  podSelector: {}\n  policyTypes:\n  - Egress\n  egress:\n  - to:\n    - ipBlock:\n        cidr: 0.0.0.0\/0<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Nj\u00eb hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/d99dfdead1c96b071b1643cb5c572878.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u041c\u043e\u0436\u043d\u043e \u043e\u0442\u043a\u0440\u044b\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0442\u043e\u043b\u044c\u043a\u043e \u043a \u0432\u043d\u0435\u0448\u043d\u0438\u043c IP, \u0438\u0441\u043a\u043b\u044e\u0447\u0438\u0432 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0435 IP-\u0430\u0434\u0440\u0435\u0441\u0430 pod&#8217;\u043e\u0432. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0435\u0441\u043b\u0438 \u043f\u043e\u0434\u0441\u0435\u0442\u044c \u0432\u0430\u0448\u0435\u0433\u043e pod&#8217;\u0430 10.16.0.0\/14:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: egress-any\n  namespace: default\nspec:\n  podSelector: {}\n  policyTypes:\n  - Egress\n  egress:\n  - to:\n    - ipBlock:\n        cidr: 0.0.0.0\/0\n        except:\n        - 10.16.0.0\/14<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Nj\u00eb hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/b157cfe0f1cd4677cf0defd9fdfa8a13.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Portat dhe protokollet<\/h2>\n<p>\n\u041e\u0431\u044b\u0447\u043d\u043e pod&#8217;\u044b \u0441\u043b\u0443\u0448\u0430\u044e\u0442 \u043e\u0434\u0438\u043d \u043f\u043e\u0440\u0442. \u042d\u0442\u043e \u043e\u0437\u043d\u0430\u0447\u0430\u0435\u0442, \u0447\u0442\u043e \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u043e\u0441\u0442\u043e \u043d\u0435 \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0442\u044c \u043d\u043e\u043c\u0435\u0440\u0430 \u043f\u043e\u0440\u0442\u043e\u0432 \u0432 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430\u0445 \u0438 \u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0432\u0441\u0435 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u0412\u043f\u0440\u043e\u0447\u0435\u043c, \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u0434\u0435\u043b\u0430\u0442\u044c \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u043b\u0443\u0447\u0430\u044f\u0445 \u0432\u0441\u0435 \u0436\u0435 \u043c\u043e\u0436\u043d\u043e \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0442\u044c \u043f\u043e\u0440\u0442\u044b:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.postgres\n  namespace: default\nspec:\n  ingress:\n  - from:\n    - podSelector:\n        matchLabels:\n          app: indexer\n    - podSelector:\n        matchLabels:\n          app: admin\n    ports:             \n      - port: 443      \n        protocol: TCP  \n      - port: 80       \n        protocol: TCP  \n  podSelector:\n    matchLabels:\n      app: postgres\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Nj\u00eb hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/4c778cd46c54e2ae0f4527ffa9e1e740.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nVini rehat se selegjini <code>portet<\/code> aplikohet n\u00eb t\u00eb gjitha elementet n\u00eb bllok <code>to<\/code> ose <code>from<\/code>, ku p\u00ebrmban. N\u00ebse d\u00ebshironi t\u00eb p\u00ebrcaktoni porte t\u00eb ndryshme p\u00ebr grupe t\u00eb ndryshme elementesh, ndan\u00eb <code>ingress<\/code> ose <code>egress<\/code> n\u00eb disa n\u00ebnndarje me <code>to<\/code> ose <code>from<\/code> dhe n\u00eb secil\u00ebn shkruani portet tuaja:<\/p>\n<pre><code class=\"plaintext\">apiVersion: networking.k8s.io\/v1\nkind: NetworkPolicy\nmetadata:\n  name: default.postgres\n  namespace: default\nspec:\n  ingress:\n  - from:\n    - podSelector:\n        matchLabels:\n          app: indexer\n    ports:             \n     - port: 443       \n       protocol: TCP   \n  - from:\n    - podSelector:\n        matchLabels:\n          app: admin\n    ports:             \n     - port: 80        \n       protocol: TCP   \n  podSelector:\n    matchLabels:\n      app: postgres\n  policyTypes:\n  - Ingress<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Nj\u00eb hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/b9ac1d8af491e992cac0be184005a278.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nFunksioni i porteve p\u00ebr her\u00eb t\u00eb par\u00eb:<\/p>\n<ul>\n<li> N\u00ebse e lini plot\u00ebsisht jasht\u00eb p\u00ebrkufizimin e porteve (<code>portet<\/code>), kjo do t\u00eb thot\u00eb t\u00eb gjitha protokollet dhe t\u00eb gjitha portet;<\/li>\n<li> N\u00ebse e lini jasht\u00eb p\u00ebrkufizimin e protokollit (<code>protokolli<\/code>), kjo do t\u00eb thot\u00eb TCP;<\/li>\n<li> N\u00ebse e lini jasht\u00eb p\u00ebrkufizimin e portit (<code>port<\/code>), kjo do t\u00eb thot\u00eb t\u00eb gjitha portet.<\/li>\n<\/ul>\n<p>\nPraktika m\u00eb e mir\u00eb: mos u mb\u00ebshtetni n\u00eb vlerat e paracaktuar, jepni ato q\u00eb ju nevojiten qart\u00eb.<\/p>\n<p>\u041e\u0431\u0440\u0430\u0442\u0438\u0442\u0435 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435, \u0447\u0442\u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0440\u0442\u044b pod&#8217;\u043e\u0432, \u0430 \u043d\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 (\u043f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435 \u043e\u0431 \u044d\u0442\u043e\u043c \u0432 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u043c \u043f\u0430\u0440\u0430\u0433\u0440\u0430\u0444\u0435).<\/p>\n<h2>\u041f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u044b \u0434\u043b\u044f pod&#8217;\u043e\u0432 \u0438\u043b\u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432?<\/h2>\n<p>\n\u041e\u0431\u044b\u0447\u043d\u043e pod\u2019\u044b \u0432 Kubernetes \u043e\u0431\u0440\u0430\u0449\u0430\u044e\u0442\u0441\u044f \u0434\u0440\u0443\u0433 \u043a \u0434\u0440\u0443\u0433\u0443 \u0447\u0435\u0440\u0435\u0437 \u0441\u0435\u0440\u0432\u0438\u0441 \u2014 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0439 \u0431\u0430\u043b\u0430\u043d\u0441\u0438\u0440\u043e\u0432\u0449\u0438\u043a \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438, \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0442\u0440\u0430\u0444\u0438\u043a \u043a pod&#8217;\u0430\u043c, \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u044e\u0449\u0438\u043c \u0441\u0435\u0440\u0432\u0438\u0441. \u041c\u043e\u0436\u043d\u043e \u043f\u043e\u0434\u0443\u043c\u0430\u0442\u044c, \u0447\u0442\u043e \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u044e\u0442 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0435\u0440\u0432\u0438\u0441\u0430\u043c, \u043d\u043e \u044d\u0442\u043e \u043d\u0435 \u0442\u0430\u043a. <b>\u0421\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 Kubernetes \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0442 \u0441 \u043f\u043e\u0440\u0442\u0430\u043c\u0438 pod&#8217;\u043e\u0432, \u0430 \u043d\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432.<\/b><\/p>\n<p>\u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0435\u0441\u043b\u0438 \u0441\u0435\u0440\u0432\u0438\u0441 \u0441\u043b\u0443\u0448\u0430\u0435\u0442 80-\u0439 \u043f\u043e\u0440\u0442, \u043d\u043e \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442 \u0442\u0440\u0430\u0444\u0438\u043a \u043d\u0430 \u043f\u043e\u0440\u0442 8080 \u0441\u0432\u043e\u0438\u0445 pod&#8217;\u043e\u0432, \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0435 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0443\u043a\u0430\u0437\u0430\u0442\u044c \u0438\u043c\u0435\u043d\u043d\u043e 8080.<\/p>\n<p>\u041f\u043e\u0434\u043e\u0431\u043d\u044b\u0439 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u043f\u0440\u0438\u0437\u043d\u0430\u0442\u044c \u043d\u0435\u043e\u043f\u0442\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u043c: \u043f\u0440\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0438 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0433\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0441\u0435\u0440\u0432\u0438\u0441\u0430 (\u043f\u043e\u0440\u0442\u044b \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0441\u043b\u0443\u0448\u0430\u044e\u0442 pod&#8217;\u044b) \u043f\u0440\u0438\u0434\u0435\u0442\u0441\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438.<\/p>\n<p>Nj\u00eb qasje e re arkitektonike duke p\u00ebrdorur Service Mesh <i>(p.sh., shih p\u00ebr Istio m\u00eb posht\u00eb \u2014 sh\u00ebnimi i p\u00ebrkthyesit.)<\/i> ndihmon p\u00ebr t\u00eb trajtuar k\u00ebt\u00eb problem.<\/p>\n<h2>A \u00ebsht\u00eb e nevojshme t\u00eb p\u00ebrcaktohen si Ingress ashtu edhe Egress?<\/h2>\n<p>\nP\u00ebrgjigja e shkurt\u00ebr \u00ebsht\u00eb po, p\u00ebr t\u00eb lejuar q\u00eb pod A t\u00eb lidhet me pod-in B, duhet t\u00eb lejohet krijimi i nj\u00eb lidhjeje d\u00ebrguese (p\u00ebr k\u00ebt\u00eb duhet konfigurimi i politik\u00ebs egress), dhe pod-i B duhet t\u00eb ket\u00eb aft\u00ebsin\u00eb p\u00ebr t\u00eb pranuar nj\u00eb lidhje hyr\u00ebse (p\u00ebr k\u00ebt\u00eb, p\u00ebrkat\u00ebsisht, \u00ebsht\u00eb e nevojshme nj\u00eb politik\u00eb ingress).<\/p>\n<p>Megjithat\u00eb, n\u00eb praktik\u00eb, mund t\u00eb mb\u00ebshtetet n\u00eb politik\u00ebn e p\u00ebrbashk\u00ebt q\u00eb lejon lidhjet n\u00eb nj\u00eb ose t\u00eb dyja drejtimet.<\/p>\n<p>N\u00ebse ndonj\u00eb pod-<b>burimi<\/b> zgjidhet nga nj\u00eb ose m\u00eb shum\u00eb <b>egress<\/b>-politika, kufizimet e vendosura mbi t\u00eb do t\u00eb p\u00ebrcaktohen nga disjunksioni i tyre. N\u00eb k\u00ebt\u00eb rast, do t\u00eb jet\u00eb e nevojshme t\u00eb lejohet qart\u00eb lidhja me pod-in-<b>destinatar<\/b>. N\u00ebse pod-i nuk zgjidhet nga ndonj\u00eb politik\u00eb, trafiku i tij d\u00ebrgues (egress) lejohet automatikisht.<\/p>\n<p>\u0410\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u0441\u0443\u0434\u044c\u0431\u0430 pod&#8217;\u0430-<b>destinatar<\/b>, i zgjedhur nga nj\u00eb ose m\u00eb shum\u00eb <b>ingress<\/b>-\u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430\u043c\u0438, \u0431\u0443\u0434\u0435\u0442 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u0442\u044c\u0441\u044f \u0438\u0445 \u0434\u0438\u0437\u044a\u044e\u043d\u043a\u0446\u0438\u0435\u0439. \u0412 \u044d\u0442\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u044f\u0432\u043d\u043e \u0440\u0430\u0437\u0440\u0435\u0448\u0438\u0442\u044c \u0435\u043c\u0443 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0442\u0440\u0430\u0444\u0438\u043a \u043e\u0442 pod&#8217;\u0430-\u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430. \u0415\u0441\u043b\u0438 pod \u043d\u0435 \u0432\u044b\u0431\u0440\u0430\u043d \u043a\u0430\u043a\u043e\u0439-\u043b\u0438\u0431\u043e \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u043e\u0439, \u0432\u0435\u0441\u044c \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439 (ingress) \u0442\u0440\u0430\u0444\u0438\u043a \u0434\u043b\u044f \u043d\u0435\u0433\u043e \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e.<\/p>\n<p>Shih pik\u00ebn \"Stateful ose Stateless\" m\u00eb posht\u00eb.<\/p>\n<h2>Logjet<\/h2>\n<p>\nPolitikat rrjetore Kubernetes nuk kan\u00eb kapacitetin p\u00ebr t\u00eb regjistruar trafikun. Kjo e b\u00ebn t\u00eb v\u00ebshtir\u00eb t\u00eb p\u00ebrcaktohet n\u00ebse politika po funksionon si\u00e7 duhet dhe e komplikon shqyrtimin n\u00eb fush\u00ebn e siguris\u00eb.<\/p>\n<h2>Kontrolli i trafikut ndaj sh\u00ebrbimeve t\u00eb jashtme<\/h2>\n<p>\nPolitikat rrjetore Kubernetes nuk lejojn\u00eb p\u00ebrcaktimin e nj\u00eb emri t\u00eb plot\u00eb domeni (DNS) n\u00eb pjes\u00ebt e egress. Ky fakt sjell nj\u00eb shqet\u00ebsim t\u00eb madh gjat\u00eb p\u00ebrpjekjes p\u00ebr t\u00eb kufizuar trafikun ndaj destinacioneve t\u00eb jashtme pa nj\u00eb adres\u00eb IP fikse (si aws.com).<\/p>\n<h2>Verifikimi i politik\u00ebs<\/h2>\n<p>\nFirewalls do t'ju paralajm\u00ebrojn\u00eb ose madje do t\u00eb refuzojn\u00eb t\u00eb pranojn\u00eb politik\u00ebn e gabuar. Kubernetes gjithashtu b\u00ebn disa verifikime. Kur p\u00ebrcaktoni nj\u00eb politik\u00eb rrjeti p\u00ebrmes kubectl, Kubernetes mund t\u00eb deklaroj\u00eb se ajo \u00ebsht\u00eb e pasakt\u00eb dhe t\u00eb refuzoj\u00eb ta pranoj\u00eb. N\u00eb raste t\u00eb tjera, Kubernetes do ta pranoj\u00eb politik\u00ebn dhe do ta plot\u00ebsoj\u00eb at\u00eb me detajet e humbura. Mund t\u00eb shihen me komand\u00ebn:<\/p>\n<pre><code class=\"plaintext\">kubernetes get networkpolicy  -o yaml<\/code><\/pre>\n<p>\nMbani parasysh se sistemi i verifikimit t\u00eb Kubernetes nuk \u00ebsht\u00eb i pakapsh\u00ebm dhe mund t\u00eb lejoj\u00eb disa lloje gabimesh.<\/p>\n<h2>Ekzekutimi<\/h2>\n<p>\nKubernetes nuk punon vet\u00eb me realizimin e politikave rrjetore, por \u00ebsht\u00eb ve\u00e7se nj\u00eb nyje API q\u00eb e ngarkon pun\u00ebn e kontrollit tek sistemi n\u00ebnkuptimor i quajtur Container Networking Interface (CNI). Caktimi i politikave n\u00eb klusterin Kubernetes pa caktimin e CNI t\u00eb duhur \u00ebsht\u00eb si t\u00eb krijosh politika n\u00eb serverin e menaxhimit t\u00eb firewall-eve pa i instaluar ato m\u00eb pas n\u00eb firewall-e. Ju vet\u00eb duhet t\u00eb siguroheni p\u00ebr pranin\u00eb e nj\u00eb CNI t\u00eb p\u00ebrshtatsh\u00ebm ose, n\u00eb rastin e platformave Kubernetes t\u00eb vendosura n\u00eb cloud, <i>(mund t\u00eb konsultoheni me list\u00ebn e ofruesve <noindex>k\u00ebtu<\/noindex> \u2014 sh\u00ebn. p\u00ebrk.)<\/i>, angazhoni politika rrjetore q\u00eb do t\u00eb vendosnin CNI p\u00ebr ju.<\/p>\n<p>Kujdes, Kubernetes nuk do t'ju paralajm\u00ebroj\u00eb n\u00ebse caktoni nj\u00eb polit t\u00eb rrjetit pa CNI-n\u00eb p\u00ebrkat\u00ebse ndihm\u00ebse.<\/p>\n<h3>Stateful apo Stateless?<\/h3>\n<p>\nT\u00eb gjith\u00eb CNI-t\u00eb e Kubernetes q\u00eb kam hasur ruajn\u00eb gjendjen (p.sh., Calico p\u00ebrdor Linux conntrack). Kjo lejon q\u00eb pod-i t\u00eb marr\u00eb p\u00ebrgjigje p\u00ebr TCP-lidhjen q\u00eb ai ka iniciuar pa nevoj\u00ebn p\u00ebr ta rivendosur at\u00eb. P\u00ebr k\u00ebt\u00eb, nuk di p\u00ebr ndonj\u00eb standard Kubernetes q\u00eb garanton ruajtjen e gjendjes (statefulness).<\/p>\n<h2>Menaxhim i avancuar i politikave t\u00eb siguris\u00eb<\/h2>\n<p>\nJa disa m\u00ebnyra p\u00ebr t\u00eb rritur efikasitetin e zbatimit t\u00eb politikave t\u00eb siguris\u00eb n\u00eb Kubernetes:<\/p>\n<ol>\n<li> Modeli arkitektonik Service Mesh p\u00ebrdor kontejner\u00eb sidecar p\u00ebr t\u00eb ofruar telemetri t\u00eb detajuar dhe kontroll mbi trafikun n\u00eb nivelin e sh\u00ebrbimeve. Si shembull mund t\u00eb p\u00ebrmendim <noindex><a rel=\"nofollow\" href=\"https:\/\/istio.io\/\">Istio<\/a><\/noindex>.<\/li>\n<li> Disa nga ofruesit e CNI e kan\u00eb zgjeruar mjete e tyre p\u00ebr t\u00eb shkuar p\u00ebrtej politikave rrjetore t\u00eb Kubernetes.<\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.tufin.com\/products\/tufin-orca\">Tufin Orca<\/a><\/noindex> siguron transparenc\u00eb dhe automatizim t\u00eb politikave rrjetore t\u00eb Kubernetes.<\/li>\n<\/ol>\n<p>\nPaketa Tufin Orca menaxhon politikat rrjetore t\u00eb Kubernetes (dhe sh\u00ebrben si burim p\u00ebr ekranet e p\u00ebrmendura m\u00eb lart).<\/p>\n<h2>Informacione shtes\u00eb<\/h2>\n<p><\/p>\n<ul>\n<li> <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/ahmetb\/kubernetes-network-policy-recipes\">\u041f\u0440\u0438\u043c\u0435\u0440\u044b \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u043e\u043b\u0438\u0442\u0438\u043a, \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0435 Ahmet Alp Balkan&#8217;\u043e\u043c \u0438\u0437 GKE<\/a><\/noindex>;<\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"https:\/\/kubernetes.io\/docs\/concepts\/services-networking\/network-policies\/\">Dokumentacioni n\u00eb faqen zyrtare t\u00eb Kubernetes<\/a><\/noindex>;<\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"https:\/\/sookocheff.com\/post\/kubernetes\/understanding-kubernetes-networking-model\/\">Udh\u00ebzuesi p\u00ebr modelin rrjetor t\u00eb Kubernetes<\/a><\/noindex>;<\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/Tufin\/test-network-policies\">Skripti p\u00ebr kontrolimin e politikave rrjetore<\/a><\/noindex>.<\/li>\n<\/ul>\n<p><\/p>\n<h2>P\u00ebrfundimi<\/h2>\n<p>\nPolitikat e rrjetit Kubernetes ofrojn\u00eb nj\u00eb grup t\u00eb mir\u00eb mjetesh p\u00ebr segmentimin e klaster\u00ebve, megjithat\u00eb ato jan\u00eb intuitivisht t\u00eb panjohura dhe kan\u00eb shum\u00eb nuanca. Mendoj se p\u00ebr shkak t\u00eb k\u00ebsaj kompleksiteti, politikat e shum\u00eb klaster\u00ebve ekzistues p\u00ebrmbajn\u00eb gabime. Zgjidhjet e mundshme p\u00ebr k\u00ebt\u00eb problem jan\u00eb automatizimi i p\u00ebrcaktimeve t\u00eb politikave ose p\u00ebrdorimi i mjeteve t\u00eb tjera p\u00ebr segmentim.<\/p>\n<p>Shpresoj q\u00eb ky udh\u00ebzues do t\u00eb ndihmoj\u00eb n\u00eb sqarimin e disa pyetjeve dhe n\u00eb zgjidhjen e problemeve me t\u00eb cilat mund t\u00eb p\u00ebrballeni.<\/p>\n<h2>P.S. nga p\u00ebrkthyesi<\/h2>\n<p>\nLexoni gjithashtu n\u00eb blogun ton\u00eb:<\/p>\n<ul>\n<li> \u00abKthehu te mikrosh\u00ebrbimet me Istio\u00bb: <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/438426\/\">pjesa 1 (njoftimi me mund\u00ebsit\u00eb kryesore)<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/440378\/\">pjesa 2 (routinimi, menaxhimi i trafikut)<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/443668\/\">pjesa 3 (siguria)<\/a><\/noindex>;<\/li>\n<li> \u00abUdh\u00ebzuesi ilustruar p\u00ebr nd\u00ebrtimin e rrjetit n\u00eb Kubernetes\u00bb: <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/346304\/\">pjes\u00ebt 1 dhe 2 (modeli rrjetor, rrjetet e mb\u00ebshtjelljes)<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/433382\/\">pjesa 3 (sh\u00ebrbimet dhe procesimi i trafikut)<\/a><\/noindex>;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/440504\/\">Docker dhe Kubernetes n\u00eb mjedise t\u00eb k\u00ebrkuara p\u00ebr siguri<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/436300\/\">9 praktikat m\u00eb t\u00eb mira p\u00ebr sigurimin e Kubernetes<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/417905\/\">11 m\u00ebnyra (jo) p\u00ebr t\u00eb qen\u00eb viktim\u00eb e hakimit n\u00eb Kubernetes<\/a><\/noindex>\u00bb.<\/li>\n<\/ul>\n<p>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/443190\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u0438\u043c. \u043f\u0435\u0440\u0435\u0432.: \u0410\u0432\u0442\u043e\u0440 \u0441\u0442\u0430\u0442\u044c\u0438 \u2014 Reuven Harrison \u2014 \u0438\u043c\u0435\u0435\u0442 \u0431\u043e\u043b\u0435\u0435 20 \u043b\u0435\u0442 \u043e\u043f\u044b\u0442\u0430 \u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f, \u0430 \u043d\u0430 \u0441\u0435\u0433\u043e\u0434\u043d\u044f\u0448\u043d\u0438\u0439 \u0434\u0435\u043d\u044c \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u043c \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u043e\u043c \u0438 \u0441\u043e\u0443\u0447\u0440\u0435\u0434\u0438\u0442\u0435\u043b\u0435\u043c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Tufin, \u0441\u043e\u0437\u0434\u0430\u044e\u0449\u0435\u0439 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430\u043c\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0420\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u044f \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 Kubernetes \u043a\u0430\u043a \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043c\u043e\u0449\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e \u0434\u043b\u044f \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0438 \u0432 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0435, \u043e\u043d \u0432 \u0442\u043e \u0436\u0435 \u0432\u0440\u0435\u043c\u044f \u0441\u0447\u0438\u0442\u0430\u0435\u0442, \u0447\u0442\u043e \u043e\u043d\u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":24432,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-32641","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0440\u0438\u043c. \u043f\u0435\u0440\u0435\u0432.: \u0410\u0432\u0442\u043e\u0440 \u0441\u0442\u0430\u0442\u044c\u0438 \u2014 Reuven Harrison \u2014 \u0438\u043c\u0435\u0435\u0442 \u0431\u043e\u043b\u0435\u0435 20 \u043b\u0435\u0442 \u043e\u043f\u044b\u0442\u0430 \u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f, \u0430 \u043d\u0430 \u0441\u0435\u0433\u043e\u0434\u043d\u044f\u0448\u043d\u0438\u0439 \u0434\u0435\u043d\u044c \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u043c \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u043e\u043c \u0438 \u0441\u043e\u0443\u0447\u0440\u0435\u0434\u0438\u0442\u0435\u043b\u0435\u043c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Tufin, \u0441\u043e\u0437\u0434\u0430\u044e\u0449\u0435\u0439 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430\u043c\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0420\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u044f \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 Kubernetes \u043a\u0430\u043a \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043c\u043e\u0449\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e \u0434\u043b\u044f \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0438 \u0432 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0435, \u043e\u043d \u0432 \u0442\u043e \u0436\u0435 \u0432\u0440\u0435\u043c\u044f \u0441\u0447\u0438\u0442\u0430\u0435\u0442, \u0447\u0442\u043e \u043e\u043d\u0438\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/vvedenie-v-setevye-politiki-kubernetes-dlya-spetsialistov-po-bezopasnosti\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0432 \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 Kubernetes \u0434\u043b\u044f \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u043e\u0432 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0440\u0438\u043c. \u043f\u0435\u0440\u0435\u0432.: \u0410\u0432\u0442\u043e\u0440 \u0441\u0442\u0430\u0442\u044c\u0438 \u2014 Reuven Harrison \u2014 \u0438\u043c\u0435\u0435\u0442 \u0431\u043e\u043b\u0435\u0435 20 \u043b\u0435\u0442 \u043e\u043f\u044b\u0442\u0430 \u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f, \u0430 \u043d\u0430 \u0441\u0435\u0433\u043e\u0434\u043d\u044f\u0448\u043d\u0438\u0439 \u0434\u0435\u043d\u044c \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u043c \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u043e\u043c \u0438 \u0441\u043e\u0443\u0447\u0440\u0435\u0434\u0438\u0442\u0435\u043b\u0435\u043c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Tufin, \u0441\u043e\u0437\u0434\u0430\u044e\u0449\u0435\u0439 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430\u043c\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0420\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u044f \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 Kubernetes \u043a\u0430\u043a \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043c\u043e\u0449\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e \u0434\u043b\u044f \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0438 \u0432 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0435, \u043e\u043d \u0432 \u0442\u043e \u0436\u0435 \u0432\u0440\u0435\u043c\u044f \u0441\u0447\u0438\u0442\u0430\u0435\u0442, \u0447\u0442\u043e \u043e\u043d\u0438\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/vvedenie-v-setevye-politiki-kubernetes-dlya-spetsialistov-po-bezopasnosti\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:48:11+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:48:11+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Hyrje n\u00eb politikat e rrjetit Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb | ProHoster","description":"Sh\u00ebn. e p\u00ebrk.: Autori i artikullit \u2014 Reuven Harrison \u2014 ka mbi 20 vjet p\u00ebrvoj\u00eb n\u00eb zhvillimin e softuerit, dhe aktualisht \u00ebsht\u00eb drejtor teknik dhe bashk\u00ebthemelues i kompanis\u00eb Tufin, e cila krijon zgjidhje p\u00ebr menaxhimin e politikave t\u00eb siguris\u00eb. Nd\u00ebrsa shqyrton politikat e rrjetit Kubernetes si nj\u00eb mjet mjaft t\u00eb fuqish\u00ebm p\u00ebr segmentimin e rrjetit n\u00eb nj\u00eb klaster, ai gjithashtu e konsideron se ato","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/vvedenie-v-setevye-politiki-kubernetes-dlya-spetsialistov-po-bezopasnosti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0432 \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 Kubernetes \u0434\u043b\u044f \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u043e\u0432 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 | ProHoster","og:description":"\u041f\u0440\u0438\u043c. \u043f\u0435\u0440\u0435\u0432.: \u0410\u0432\u0442\u043e\u0440 \u0441\u0442\u0430\u0442\u044c\u0438 \u2014 Reuven Harrison \u2014 \u0438\u043c\u0435\u0435\u0442 \u0431\u043e\u043b\u0435\u0435 20 \u043b\u0435\u0442 \u043e\u043f\u044b\u0442\u0430 \u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f, \u0430 \u043d\u0430 \u0441\u0435\u0433\u043e\u0434\u043d\u044f\u0448\u043d\u0438\u0439 \u0434\u0435\u043d\u044c \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u043c \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u043e\u043c \u0438 \u0441\u043e\u0443\u0447\u0440\u0435\u0434\u0438\u0442\u0435\u043b\u0435\u043c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Tufin, \u0441\u043e\u0437\u0434\u0430\u044e\u0449\u0435\u0439 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430\u043c\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0420\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u044f \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 Kubernetes \u043a\u0430\u043a \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043c\u043e\u0449\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e \u0434\u043b\u044f \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0438 \u0441\u0435\u0442\u0438 \u0432 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0435, \u043e\u043d \u0432 \u0442\u043e \u0436\u0435 \u0432\u0440\u0435\u043c\u044f \u0441\u0447\u0438\u0442\u0430\u0435\u0442, \u0447\u0442\u043e \u043e\u043d\u0438","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/vvedenie-v-setevye-politiki-kubernetes-dlya-spetsialistov-po-bezopasnosti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:48:11+00:00","article:modified_time":"2019-10-31T18:48:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"32641","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 11:53:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:55:23","updated":"2026-01-21 11:53:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/32641","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=32641"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/32641\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/24432"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=32641"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=32641"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=32641"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}