ืืขืจ ืฆืื ืคืื ืืขื ืึทืจืืืงื ืืื ืฆื ืืึทืงืขื ืขื ืื ืืืืขื ืขืจ ืฆื ืื ืืึทืกืืงืก ืคืื ื ืขืืืืึธืจืงืื ื ืืื ืึธื ืคืืจืื ื ื ืขืฅ ืคึผืึทืืึทืกืื ืืื Kubernetes, ืืื ืืขืืื ื ืืื ืื ืืจืื-ืคึผืึทืจืืื Calico ืคึผืืืืื ืืืึธืก ืืงืกืืขื ืื ื ืึธืจืืึทื ืงืืืคึผืึทืืืืึทืืื. ืฆืืืืืขื ืื ืืืขื, ืื ืื ืคืื ืงืึทื ืคืืืืขืจืืืฉืึทื ืืื ืขืืืขืืข ืคึฟืขืึดืงืืืื ืืืขื ืืืื ืืขืืึทื ืกืืจืืืืื ืืื ืคืึทืงืืืฉ ืืืืฉืคืืื ืคืื ืืื ืืืขืจ ืึทืคึผืขืจืืืืื ื ืืขืจืคืึทืจืื ื.
ื ืฉื ืขื ืืงืืื ืฆื Kubernetes ื ืขืืืืึธืจืงืื ื ืึทืคึผืคึผืืืึทื ืกืข
ื ืงืืืขืจื ืขืืขืก ืงื ืืื ืงืขื ืขื ื ืื ืืืื ืืืึทืืืฉืึทื ื ืึธื ืึท ื ืขืฅ. ืืืจ ืืึธืื ืฉืืื ืืจืืืก ืืึทืืขืจืืึทืืก ืืืืฃ ืืืืขืจ ืืึทืกืืงืก: ""ืืื"'.
ืืื ืืขื ืงืึธื ืืขืงืกื ืคืื ืืขื ืึทืจืืืงื, ืขืก ืืื ืืืืืืืง ืฆื ืืึธื ืึทื K8s ืืื ืืื ื ืืฉื ืคืึทืจืึทื ืืืืึธืจืืืขื ืคึฟืึทืจ ื ืขืฅ ืงืึทื ืขืงืืืืืืื ืฆืืืืฉื ืงืึทื ืืืื ืขืจื ืืื ื ืึธืืื: ืคึฟืึทืจ ืืขื, ืคืึทืจืฉืืื CNI ืคึผืืืืื ืก (Container Networking Interface). ืืขืจ ืืืขืื ืืขื ืืึทืืจืืฃ ืืืจ .
ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืื ืืขืจืกื ืคึผืจืึธืกื ืคืื ืื ืคึผืืืืื ืก ืืื - ืืื ืคืื ื ืขืฅ ืงืึทื ืขืงืืืืืืื ืฆืืืืฉื ืึทืืข ืงื ืืื ื ืึธืืื ืืืจื ืจืืืืื ื ืืจืืงื ืืืืฃ ืืขืืขืจ ื ืึธืืข, ืึทืกืืื ืื ื ืึท ืกืืื ืขื ืฆื ืขืก. ืึธืืขืจ, ืืึทื ืฅ ืืื ืึทื ืจืขืืืึทืืืืืื ืึทืงืกืขืกืึทืืืืืื ืืื ื ืื ืฉืืขื ืืืง ืืืืืืืืืง. ืฆื ืฆืืฉืืขืื ืึท ืืื ืคืื ืืื ืืืึทื ืืคืืขืืื ืืขืจืืงืืื ืืื ืืขื ืงื ืืื, ืขืก ืืื ื ืืืืืง ืฆื ืื ืขืจืืืื ืืื ืื ืงืึทื ืคืืืืขืจืืืฉืึทื ืคืื ืื ืคืืืจืืืึทื. ืืื ืึทืืืขืืืื, ืขืก ืืื ืืขืฉืืขืื ืืื ืืขืจ ืื ืงืึธื ืืจืึธื ืคืื ืืขืจ ืืขืืืืงืขืจ CNI, ืืืึธืก ืืื ืืืึธืก ืงืืื ืื ืืขืจืืืขื ืืฉืึทื ื ืคืื ืืจืื-ืคึผืึทืจืืื ืืื ืืคึผืืึทืืืขืก ืงืขื ืขื ืืืื ืื ืืขืจืคึผืจืึทืืึทื ืคืึทืืฉ ืึธืืขืจ ืืืื ืึธืจืืจื ืืึธืจ.
ืืื "ืืืืก ืคืื ืื ืงืขืกืื" ืคึฟืึทืจ ืึธืจืืึทื ืืืืื ื ื ืขืฅ ืคึผืึธืืืืืง ืคืึทืจืืืึทืืืื ื ืืื ืึท Kubernetes ืงื ืืื ืืื ืฆืืืขืฉืืขืื . ืื ืืืื, ืคืื ืื ืืขืจืืขืืืืื ืืืืขืจ ืืืืกืืขืงืืืื ื ืึธืืขื ืกืคึผืืืกืึทื, ืงืขื ืึทื ืืืึทืืื ืึผืืืื ืฆื ืืืคืขืจืขื ืฉืืืื ืึทืงืกืขืก ืคืื ืืืื ืึทืคึผืืึทืงืืืฉืึทื ืฆื ืื ืืขืจื. ืขืก ืืืื ืึทืืึทืื ืืืจ ืฆื ืงืึทื ืคืืืืขืจ ืึทืงืกืขืกืึทืืืืืื ืฆืืืืฉื ืกืคึผืขืฆืืคืืฉ ืคึผืึธืืก, ืื ืืืืืจืึทื ืืึทื ืฅ (ื ืึทืืขืกืคึผืึทืกืขืก) ืึธืืขืจ ืืืึทืงืก ืคืื IP ืึทืืจืขืกืขืก:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: test-network-policy
namespace: default
spec:
podSelector:
matchLabels:
role: db
policyTypes:
- Ingress
- Egress
ingress:
- from:
- ipBlock:
cidr: 172.17.0.0/16
except:
- 172.17.1.0/24
- namespaceSelector:
matchLabels:
project: myproject
- podSelector:
matchLabels:
role: frontend
ports:
- protocol: TCP
port: 6379
egress:
- to:
- ipBlock:
cidr: 10.0.0.0/24
ports:
- protocol: TCP
port: 5978ืืึธืก ืืื ื ืืฉื ืื ืืขืจืกื ืคึผืจืืืืืืื ืืืึทืฉืคึผืื ืคืื ืงืขื ืึทืืึธื ืืื ืคึฟืึทืจ ืึทืืข ืืืกืงืขืจืืืืฉ ืื ืคืึทืจืืึทื ื ืฆื ืคึฟืึทืจืฉืืืื ืื ืืึธืืืง ืคืื ืืื ื ืขืฅ ืคึผืึทืืึทืกืื ืึทืจืืขื. ืึธืืขืจ, ืืืจ ืืืขืื ื ืึธื ืคึผืจืืืืจื ืฆื ืคึฟืึทืจืฉืืืื ืื ืืจืื ื ืคึผืจืื ืกืึทืคึผืึทืื ืืื ืืขืืืึธืืก ืคืื ืคึผืจืึทืกืขืกืื ื ืคืึทืจืงืขืจ ืคืืึธืื ื ืืฆื ื ืขืฅ ืคึผืึทืืึทืกืื ...
ืขืก ืืื ืืึทืืืฉืืงืึทื ืึทื ืขืก ืืขื ืขื 2 ืืืืคึผืก ืคืื ืคืึทืจืงืขืจ: ืึทืจืืึทื ืื ืคึผืึธื (ืื ืืจืขืกืก) ืืื ืึทืืืืึธืืื ื ืคืื ืขืก (ืขืืจืขืกืก).
ืึทืงืืืึทืืื, ืคึผืึธืืืืืง ืืื ืฆืขืืืืื ืืื ืื 2 ืงืึทืืขืืึธืจืืขืก ืืืืืจื ืืืืฃ ืืขืจ ืจืืืืื ื ืคืื ืืึทืืืขืืื ื.
ืืขืจ ืืืืึทืืขืจ ืคืืจืืื ืื ืึทืืจืืืืื ืืื ืึท ืกืขืืขืงืืึธืจ; ืืขืจ, ืืืืฃ ืืืขืืขื ืืขืจ ืืื ืืืื. ืืึธืก ืงืขื ืืืื ืึท ืคึผืึธื (ืึธืืขืจ ืึท ืืจืืคึผืข ืคืื โโืคึผืึธืืก) ืึธืืขืจ ืึท ืกืืืืืืข (ื"ื ืึท ื ืึทืืขืกืคึผืึทืกืข). ืึท ืืืืืืืง ืืขืืึทื: ืืืืืข ืืืืคึผืก ืคืื ืื ืึทืืืืฉืขืงืฅ ืืืื ืึทื ืืืึทืืื ืึท ืคืืจืืข (ืคืืจืืข ืืื Kubernetes ืืขืจืืื ืึธืืึธืืืข) - ืืึธืก ืืขื ืขื ืื ืืืึธืก ืคึผืึทืืึทืืืฉืึทื ื ืึทืจืืขืื ืืื.
ืืื ืึทืืืฉืึทื ืฆื ืึท ืขื ืืืขื ื ืืืขืจ ืคืื ืกืขืืขืงืืึธืจืก ืคึฟืึทืจืืืื ืืงืืข ืืืจื ืขืืืขืืข ืกืึธืจื ืคืื ืคืืจืืข, ืขืก ืืื ืืขืืืขื ืฆื ืฉืจืืึทืื ืึผืืืื ืืื "ืืึธืื / ืืืืงืขื ืขื ืึทืืฅ / ืึทืืขืืขื" ืืื ืคืึทืจืฉืืืขื ืข ืืืขืจืืืืฉืึทื ื. ืคึฟืึทืจ ืืขื ืฆืืืขืง, ืงืึทื ืกืืจืึทืงืฉืึทื ื ืคืื ืื ืคืึธืจืขื ืืขื ืขื ืืขื ืืฆื:
podSelector: {}
ingress: []
policyTypes:
- Ingress- ืืื ืืขื ืืืึทืฉืคึผืื, ืึทืืข ืคึผืึธืืก ืืื ืื ืกืืืืืืข ืืขื ืขื ืืคืืขืฉืืขืื ืคืื ืื ืงืึทืืื ื ืคืึทืจืงืขืจ. ืื ืคืึทืจืงืขืจื ื ืึทืืืจ ืงืขื ืขื ืืืื ืึทืืฉืืืื ืืื ืื ืคืืืืขื ืืข ืงืึทื ืกืืจืึทืงืฉืึทื:
podSelector: {}
ingress:
- {}
policyTypes:
- Ingressืกืืืืืึทืจืื ืคึฟืึทืจ ืึทืืืืึธืืื ื:
podSelector: {}
policyTypes:
- Egress- ืฆื ืงืขืจ ืขืก ืึทืืืขืง. ืืื ืืึธ ืก ืืืึธืก ืฆื ืึทืจืืึทื ื ืขืืขื:
podSelector: {}
egress:
- {}
policyTypes:
- Egressืฆืืจืืง ืฆื ืื ืืจืืจื ืคืื ืึท CNI ืคึผืืืืื ืคึฟืึทืจ ืึท ืงื ืืื, ืขืก ืืื ืืืื ืฆื ืืืืขืจืงื ืึทื ื ืื ืืขืืขืจ ื ืขืฅ ืคึผืืืืื ืฉืืืฆื NetworkPolicy. ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืื ืฉืืื ืืขืจืืื ื ืคืืึทื ืึทื ืืื ื ืืฉื ืืืืกื ืืื ืฆื ืงืึทื ืคืืืืขืจ ื ืขืฅ ืคึผืึทืืึทืกืื, โโืืืึธืก ืืื ืืขืจ ืืึทืึทืืืขืจ ืจืืคึผืึทืืึทืืึธืจื. ืึทื ืึธืืืขืจื ืึทืืืื ืืื ืืืื ืืขืจืืื ื ืืึธืจื - ืึทื ืขืคึฟื ืืงืืจ ืคึผืจืืืขืงื , ืืืึธืก ืืืืืืืืง ืืงืกืคึผืึทื ืื ืื ื ืึธืจืืึทื ืืึทื ื ืคืื Kubernetes APIs ืืื ืืขืจืืื ืขื ืคืื ื ืขืฅ ืคึผืึทืืึทืกืื.
ืืึทืงืืืขื ืฆื ืืืืกื ืงืึทืืืงืึธ: ืืขืึธืจืืข
ืื ืงืึทืืืงืึธ ืคึผืืืืื ืงืขื ืขื ืืืื ืืขืืืืื ื ืืื ืื ืึทืืจืืืฉืึทื ืืื ืคืืึทื ืึทื (ืกืืืคึผืจืึธืืืฉืขืงื ) ืึธืืขืจ ืื ืืืคึผืขื ืืึทื ืืื, ืงืึทืืืขืจืื ื ืืืืืข ื ืขืฅ ืงืึทื ืขืงืืืืืืื ืืื ืึทืืืืืืึทืืืืืื ืคืึทืจืืืึทืืืื ื ืงืืืคึผืึทืืืืึทืืื.
ืืืึธืก ืึทืคึผืขืจืืื ืึทืืื ืืื ื ืืฆื ืื K8s "ืืึธืงืกืขื" ืืืืืื ื ืืื ืื ืึทืคึผื ืฉืืขืื ืคืื Calico?
ืืึธ ืก ืืืึธืก ืืื ืืขืืืื ืืื ื ืขืืืืึธืจืง ืคึผืึธืืืืืง:
- ืคึผืึทืืึทืืืฉืึทื ื ืืขื ืขื ืืืืจืขื ืขืฆื ืืืจื ืื ืกืืืืืืข;
- ืคึผืึทืืึทืกืื ืืขื ืขื ืืขืืืขื ืื ืฆื ืคึผืึธืืก ืื ืืขืฆืืืื ื ืืื ืืึทืืขืืก;
- ืึผืืืื ืงืขื ืขื ืืืื ืืขืืืขื ืื ืฆื ืคึผืึธืืก, ืื ืืืืืจืึทื ืืึทื ืฅ ืึธืืขืจ ืกืืื ืขืฅ;
- ืึผืืืื ืงืขื ืขื ืึทื ืืืึทืืื ืคึผืจืึธืืึธืงืึธืืก, ืืขืืืืกื ืึธืืขืจ ืกืืืืึธืืืฉ ืคึผืึธืจื ืกืคึผืขืกืึทืคืึทืงืืืฉืึทื ื.
ืืึธ ืก ืืื ืงืึทืืืงืึธ ืืงืกืืขื ืื ืื ืคืึทื ืืงืฉืึทื ื:
- ืคึผืึทืืึทืกืื ืงืขื ืขื ืืืื ืืขืืืขื ืื ืฆื ืงืืื ืืืืคืขืฅ: ืคึผืึธื, ืงืึทื ืืืื ืขืจ, ืืืืจืืืึทื ืืึทืฉืื ืึธืืขืจ ืฆืืืื ื;
- ืึผืืืื ืงืขื ืขื ืึทื ืืืึทืืื ืึท ืกืคึผืขืฆืืคืืฉ ืงืึทืืฃ (ืคืึทืจืืืขืจ, ืืขืจืืืืืขื ืืฉ, ืืึธืืื ื);
- ืืขืจ ืฆืื ืึธืืขืจ ืืงืืจ ืคืื ืึผืืืื ืงืขื ืขื ืืืื ืึท ืคึผืึธืจื, ืึท ืงืืื ืคืื ืคึผืึธืจืฅ, ืคึผืจืึธืืึธืงืึธืืก, ืืืืคึผ ืึธืืขืจ ICMP ืึทืืจืืืืืฅ, IP ืึธืืขืจ ืกืืื ืขื (4 ืึธืืขืจ 6 ืืืจ), ืงืืื ืกืขืืขืงืืึธืจืก (ื ืึธืืขืก, ืืื ืืช, ืื ืืืืืจืึทื ืืึทื ืฅ);
- ืึทืืืืืืึธื ืึทืืื, ืืืจ ืงืขื ืขื ืจืขืืืืืจื ืื ืืืจืืคืึธืจ ืคืื ืคืึทืจืงืขืจ ื ืืฆื DAT ืกืขืืืื ืืก ืืื ืคืึทืจืงืขืจ ืคืึธืจืืืขืจืืื ื ืคึผืึทืืึทืกืื.
ืืขืจ ืขืจืฉืืขืจ ืงืึทืืืฅ ืืืืฃ GitHub ืืื ืื ืงืึทืืืงืึธ ืจืืคึผืึทืืึทืืึธืจื ืืึทืืขืก ืฆืืจืืง ืฆื ืืืื 2016, ืืื ืึท ืืึธืจ ืฉืคึผืขืืขืจ ืื ืคึผืจืืืขืงื ืืขื ืืืขื ืึท ืืืืื ื ืฉืืขืืข ืืื ืึธืจืืึทื ืืืืื ื ืงืืืขืจื ืขืืขืก ื ืขืฅ ืงืึทื ืขืงืืืืืืื - ืืึธืก ืืื ืขืืืืืึทื ืกื, ืืืฉื, ืืืจื ืื ืืืขืจืืืืง ืจืขืืืืืึทืื, :
ืคืืืข ืืจืืืก ืืขืจืืื ืกืึทืืืฉืึทื ื ืืื K8s, ืึทืืึท ืืื , , ืืื ืื ืืขืจืข ืื ืืขืืืืื ืฆื ืจืขืงืึธืืขื ืืืจื ืขืก ืคึฟืึทืจ ื ืืฆื.
ืืื ืคึฟืึทืจ ืคืึธืจืฉืืขืืื ื, ืึทืืฅ ืืื ืืจืืืก ืืึธ. ืืื ืืขืกืืื ื ืืืืขืจ ืคึผืจืึธืืืงื, ืื ืงืึทืืืงืึธ ืึทื ืืืืืงืืื ื ืืึทื ืฉืึทืคึฟื ืืขืืึทื ืกืืจืืืืื ืึทืกืืจืึทื ืึทืืืงืึทื ืคืึธืจืฉืืขืืื ื, ืคืืืกื ืืืง ืืขืจ ืืื 50000 ืงืึทื ืืืื ืขืจื ืืืืฃ 500 ืืฉืืืืช ื ืึธืืื ืืื ืึท ืฉืึทืคืื ื ืงืืจืก ืคืื 20 ืงืึทื ืืืื ืขืจื ืคึผืขืจ ืกืขืงืื ืืข. ืงืืื ืคืจืืืืขืืขื ืืขื ืขื ืืืืขื ืึทืคืืื ืืื ืกืงืืืืื ื. ืืืขืืืข ืจืขืืืืืืื ืฉืืื ืืื ืื ืืขืืื ืคืื ืืขืจ ืขืจืฉืืขืจ ืืืขืจืกืืข. ืคืจืืึท ืฉืืืืืื ืคืึธืืงืืกืื ื ืืืืฃ ืืจืืคึผืื ืืื ืืืื ืงืึทื ืกืึทืืฉืึทื ืืืื ืืึทืฉืืขืืืงื ืื ืคืึธืจืฉืืขืืื ื ืคืื Calico ืืื ืงืืืึทื ืืื ืืื ืืื ืคืืึทื ืึทื. :
ืื ืคึผืจืืืขืงื ืืื ืืขืืืขืืึธืคึผืื ื ืืืืขืจ ืืขืฉืืืื ื, ืขืก ืฉืืืฆื ืึทืจืืขื ืืื ืคืึธืืงืก ืกืึทืืืฉืึทื ื ืืขืจืืื K8s, OpenShift, OpenStack, ืขืก ืืื ืืขืืืขื ืฆื ื ืืฆื Calico ืืืขื ืืืคึผืืืืื ื ืึท ืงื ืืื ื ืืฆื , ืขืก ืืขื ืขื ืจืขืคืขืจืขื ืฆื ืฆื ืื ืงืึทื ืกืืจืึทืงืฉืึทื ืคืื ืกืขืจืืืืก ืืขืฉ ื ืขืืืืึธืจืงืก ( ืืขืืืืื ื ืืื ืงืึทื ืืืฉืึทื ืืงืฉืึทื ืืื Istio).
ืคึผืจืึทืงืืืกืื ืืื ืงืึทืืืงืึธ
ืืื ืึทืืืขืืืื ืคืึทื ืคืื ื ืืฆื ืืืึทื ืื ืงืืืขืจื ืขืืขืก, ืื ืกืืึธืืื ื CNI ืงืืื ืึทืจืึธืคึผ ืฆื ื ืืฆื ืื ืืขืงืข calico.yaml, , ืืืจื ื ืืฆื kubectl apply -f.
ืืื ืึท ืืขืจืฉื, ืื ืงืจืึทื ื ืืืขืจืกืืข ืคืื โโืื ืคึผืืืืื ืืื ืงืึทืืคึผืึทืืึทืืึทื ืืื ืื ืืขืฆืืข 2-3 ืืืขืจืกืืขืก ืคืื Kubernetes: ืึธืคึผืขืจืึทืฆืืข ืืื ืขืืืขืจืข ืืืขืจืกืืขืก ืืื ื ืืฉื ืืขืกืืขื ืืื ืืื ื ืืฉื ืืขืจืึทื ืืื. ืืืื ืื ืืขืืืขืืึธืคึผืขืจืก, Calico ืืืืคื ืืืืฃ ืืื ืืงืก ืงืขืจื ืึทืื ืืขืืขืจ 3.10 ืืื CentOS 7, Ubuntu 16 ืึธืืขืจ Debian 8, ืืืืฃ ืฉืคึผืืฅ ืคืื ืืคึผืืึทืืืขืก ืึธืืขืจ IPVS.
ืืคืืขืืื ืืขืจืืงืืื ืืื ืืขืจ ืกืืืื
ืคึฟืึทืจ ืึท ืืขื ืขืจืึทื ืคืืจืฉืืื ื, ืืึธืืืจ ืงืืงื ืืื ืึท ืคึผืฉืื ืคืึทื ืฆื ืคึฟืึทืจืฉืืืื ืืื ื ืขืฅ ืคึผืึทืืึทืกืื ืืื ืื ืงืึทืืืงืึธ ื ืึธืืืืืฉืึทื ืืขื ืขื ืึทื ืืขืจืฉ ืคืื ื ืึธืจืืึทื ืึธื ืขืก ืืื ืืื ืืขืจ ืฆืืืึทื ื ืฆื ืฉืึทืคึฟื ืึผืืืื ืกืืืคึผืืึทืคืืื ืืืืขืจ ืจืืืึทืืืืืื ืืื ืงืึทื ืคืืืืขืจืืืฉืึทื ืืืืืืงืืื:
ืขืก ืืขื ืขื 2 ืืืขื ืึทืคึผืืึทืงืืืฉืึทื ื ืืืคึผืืืื ืืื ืืขื ืงื ืืื: ืืื Node.js ืืื PHP, ืืืื ืขืจ ืคืื ืืืึธืก ื ืืฆื Redis. ืฆื ืคืึทืจืฉืคึผืึทืจื ืึทืงืกืขืก ืฆื Redis ืคึฟืื PHP, ืืฉืขืช ืืืจ ืืึทืืื ืงืึทื ืขืงืืืืืืื ืืื Node.js, ื ืึธืจ ืฆืืืืืื ืื ืคืืืืขื ืืข ืคึผืึธืืืืืง:
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
name: allow-redis-nodejs
spec:
podSelector:
matchLabels:
service: redis
ingress:
- from:
- podSelector:
matchLabels:
service: nodejs
ports:
- protocol: TCP
port: 6379ืืกืขื ืฉืึทืื, ืืืจ ืขืจืืืืื ืื ืงืึทืืื ื ืคืึทืจืงืขืจ ืฆื ืื Redis ืคึผืึธืจื ืคึฟืื Node.js. ืืื ืืื ืืืื ืงืืืจ ื ืืฉื ืคืืจืืืื ืขืคืขืก ืื ืืขืจืฉ. ืืื ืืึทืื ืืื NetworkPolicy ืืื ืืจืืืก, ืึทืืข ืกืขืืขืงืืึธืจืก ืืขืจืืื ื ืืื ืขืก ืึธื ืืืืื ืฆื ืืืื ืืคืืขืืื ืืขืจื, ืกืืึทืื ืึทื ืืขืจืฉ ืกืคึผืขืกืืคืืขื. ืึธืืขืจ, ืื ืืคืืขืืื ืืขืจืืงืืื ืึผืืืื ืืึธื ื ืื ืฆืืืืืื ืฆื ืื ืืขืจืข ืึทืืืืฉืขืงืฅ ืืืึธืก ืืขื ืขื ื ืืฉื ืืืืขืงื ืืืจื ืื ืกืขืืขืงืืึธืจ.
ืื ืืืืฉืคึผืื ื ืืฆื apiVersion ืงืืืขืจื ืขืืขืก ืืืืก ืคืื ืื ืงืขืกืื, ืึธืืขืจ ืืึธืจื ืืฉื ืคึผืจืืืืขื ืฅ ืืืจ ืคืื ื ืืฆื ืขืก . ืืขืจ ืกืื ืืึทืงืก ืืึธืจื ืืื ืืขืจ ืืืืืืื, ืึทืืื ืืืจ ืืืขื ืืึทืจืคึฟื ืฆื ืจืืจืืื ืื ืืขืจืฉื ืคึฟืึทืจ ืื ืืืืื ืคืึทื ืืื ืื ืคืืืืขื ืืข ืคืึธืจืขื:
apiVersion: crd.projectcalico.org/v1
kind: NetworkPolicy
metadata:
name: allow-redis-nodejs
spec:
selector: service == 'redis'
ingress:
- action: Allow
protocol: TCP
source:
selector: service == 'nodejs'
destination:
ports:
- 6379
ืื ืืืืื-ืืขืจืืื ื ืงืึทื ืกืืจืึทืงืฉืึทื ื ืคึฟืึทืจ ืึทืืึทืืื ื ืึธืืขืจ ืคืืจืืืืงืขื ืขื ืึทืืข ืคืึทืจืงืขืจ ืืืจื ืื ืจืขืืืืขืจ NetworkPolicy API ืึทื ืืืึทืืื ืงืึทื ืกืืจืึทืงืฉืึทื ื ืืื ืงืืึทืืขืจื ืืืึธืก ืืขื ืขื ืฉืืืขืจ ืฆื ืคึฟืึทืจืฉืืืื ืืื ืืขืืขื ืงืขื. ืืื ืื ืคืึทื ืคืื Calico, ืฆื ืืืืฉื ืื ืืึธืืืง ืคืื ืึท ืคืืืจืืืึทื ืืขืจืฉื ืฆื ืื ืคืึทืจืงืขืจื, ื ืึธืจ ืืืืฉื action: Allow ืืืืฃ action: Deny.
ืืคืืขืืื ืืขืจืืงืืื ืืืจื ืกืืืืืืข
ืืืฆื ืืืึทืืืฉืึทื ืึท ืกืืืืึทืฆืืข ืืื ืึท ืึทืคึผืืึทืงืืืฉืึทื ืืืฉืขื ืขืจืืืฅ ืืขืฉืขืคื ืืขืืจืืงืก ืคึฟืึทืจ ืืึทืืืื ื ืืื ืคึผืจืึธืืขืืืขืืก ืืื ืืืืึทืืขืจ ืึทื ืึทืืืกืืก ืืื Grafana. ืื ืืคึผืืึธืึทื ืงืขื ืึทื ืืืึทืืื ืฉืคึผืืจืขืืืืืง ืืึทืื, ืืืึธืก ืืื ืืืืืขืจ ืขืคื ืืืขื ืงืขื ืืืง ืืืจื ืคืขืืืงืืึทื. ืืื ืก ืืึทืืึทืืื ืื ืืึทืื ืคืื ืคึผืจืืื ื ืืืืื:
ืคึผืจืึธืืขืืืขืืก, ืืื ืึท ืืขืจืฉื, ืืื ืืขืฉืืขืื ืืื ืึท ืืึทืืื ืืขืจ ืืื ืกื ืกืืืืืืข - ืืื ืืขื ืืืึทืฉืคึผืื, ืขืก ืืืขื ืืืื ืึท ื ืึทืืขืกืคึผืึทืกืข ืืื ืืึธืก:
apiVersion: v1
kind: Namespace
metadata:
labels:
module: prometheus
name: kube-prometheus
ืคืขืื metadata.labels ืืึธืก ืืึธื ืืื ืึทืจืืืกืืขืืืืื ื ืืฉื ืงืืื ืฆืืคืึทื. ืืื ืืขืจืืื ื ืืืืื, namespaceSelector (ืืื ืืืื podSelector) ืึทืคึผืขืจืืืฅ ืืื ืืึทืืขืืก. ืืขืจืืืขืจ, ืฆื ืืึธืื ืืขืืจืืงืก ืฆื ืืืื ืืขื ืืืขื ืคืื ืึทืืข ืคึผืึธืืก ืืืืฃ ืึท ืกืคึผืขืฆืืคืืฉ ืคึผืึธืจื, ืืืจ ืืืขื ืืึธืื ืฆื ืืืืื ืขืืืขืืข ืกืึธืจื ืคืื ืคืืจืืข (ืึธืืขืจ ื ืขืืขื ืคืื ืืืืืกืืื ื ืึธื ืขืก) ืืื ืฆืืืืืื ืึท ืงืึทื ืคืืืืขืจืืืฉืึทื ืืื:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-metrics-prom
spec:
podSelector: {}
ingress:
- from:
- namespaceSelector:
matchLabels:
module: prometheus
ports:
- protocol: TCP
port: 9100ืืื ืืืื ืืืจ ื ืืฆื ืงืึทืืืงืึธ ืคึผืึทืืึทืกืื, โโืื ืกืื ืืึทืงืก ืืืขื ืืืื ืืื ืืึธืก:
apiVersion: crd.projectcalico.org/v1
kind: NetworkPolicy
metadata:
name: allow-metrics-prom
spec:
ingress:
- action: Allow
protocol: TCP
source:
namespaceSelector: module == 'prometheus'
destination:
ports:
- 9100ืืื ืึทืืืขืืืื, ืืืจื ืึทืืื ื ืื ืืืืคึผืก ืคืื ืคึผืึทืืึทืกืื ืคึฟืึทืจ ืกืคึผืขืฆืืคืืฉ ืืืืขืจืคืขื ืืฉื, ืืืจ ืงืขื ืขื ืืึทืฉืืฆื ืงืขืื ืืืืืข ืึธืืขืจ ืึทืงืกืึทืืขื ืืึทื ืื ืืขืจืคืืจืึทื ืก ืืื ืื ืึธืคึผืขืจืึทืฆืืข ืคืื โโืึทืคึผืืึทืงืืืฉืึทื ื ืืื ืืขื ืงื ืืื.
ืืขืจ ืืขืกืืขืจ ืคืืจ, ืืืื ืื ืงืจืืืืืขืจื ืคืื ืงืึทืืืงืึธ, ืืื ืื "ืคืึทืจืฉืคึผืึทืจื ืึทืืฅ ืืื ืืคืืจืืฉ ืขืคึฟืขื ืขื ืืืึธืก ืืืจ ืืึทืจืคึฟื" ืฆืืืึทื ื, ืืึทืงืืืืขื ืืึทื ืืื (ืื ืืขืจืข ื ืึธืืืืื ืึท ืขื ืืขื ืฆืืืึทื ื - ืกืคึผืขืฆืืขื ืืื ).
ื ืืฆื ื ืึธื ืงืึทืืืงืึธ ืึธืืืืฉืขืงืฅ
ืืึธืื ืืืจ ืืขืจืืึธื ืขื ืืืจ ืึทื ืืืจื ืื ืขืงืกืืขื ืืขื ืืึทื ื ืคืื ืงืึทืืืงืึธ ืึทืคึผืืก ืืืจ ืงืขื ืขื ืจืขืืืืืจื ืื ืึทืืืืืืึทืืืืึทืื ืคืื ื ืึธืืื, ื ืื ืืืืืืขื ืฆื ืคึผืึธืืก. ืืื ืื ืคืืืืขื ืืข ืืืึทืฉืคึผืื ื ืืฆื GlobalNetworkPolicy ืื ืคืืืืงืืื ืฆื ืคืึธืจื ICMP ืจืืงืืืขืก ืืื ืืขื ืงื ืืื ืืื ืคึฟืึทืจืืึทืื (ืืืฉื, ืคึผืื ืืก ืคืื ืึท ืคึผืึธื ืฆื ืึท ื ืึธืืข, ืฆืืืืฉื ืคึผืึธืืก ืึธืืขืจ ืคึฟืื ืึท ื ืึธืืข ืฆื ืึทื IP ืคึผืึธื):
apiVersion: crd.projectcalico.org/v1
kind: GlobalNetworkPolicy
metadata:
name: block-icmp
spec:
order: 200
selector: all()
types:
- Ingress
- Egress
ingress:
- action: Deny
protocol: ICMP
egress:
- action: Deny
protocol: ICMP
ืืื ืื ืืืืื ืคืึทื, ืขืก ืืื ื ืึธื ืืขืืืขื ืคึฟืึทืจ ืงื ืืื ื ืึธืืื ืฆื "ืืขืจืืจืืืื ืืื" ืฆื ืืขืืขืจ ืื ืืขืจืขืจ ืืืจื ICMP. ืืื ืืขื ืขื ืื ืืื ืจืืืึทืืืื ืืืจื ืืืื GlobalNetworkPolicy, ืืขืืืขื ืื ืฆื ืึทื ืขื ืืืื HostEndpoint:
apiVersion: crd.projectcalico.org/v1
kind: GlobalNetworkPolicy
metadata:
name: deny-icmp-kube-02
spec:
selector: "role == 'k8s-node'"
order: 0
ingress:
- action: Allow
protocol: ICMP
egress:
- action: Allow
protocol: ICMP
---
apiVersion: crd.projectcalico.org/v1
kind: HostEndpoint
metadata:
name: kube-02-eth0
labels:
role: k8s-node
spec:
interfaceName: eth0
node: kube-02
expectedIPs: ["192.168.2.2"]ืื VPN ืคืึทื
ืฆืื ืกืืฃ, ืืื ืืืขื ืืขืื ืึท ืืืืขืจ ืคืึทืงืืืฉ ืืืึทืฉืคึผืื ืคืื ื ืืฆื ืงืึทืืืงืึธ ืคืึทื ืืงืฉืึทื ื ืคึฟืึทืจ ืื ืคืึทื ืคืื ื ืึธืขื ื-ืงื ืืื ืื ืืขืจืึทืงืฉืึทื, ืืืขื ืึท ื ืึธืจืืึทื ืืึทื ื ืคืื ืคึผืึทืืึทืกืื ืืื ื ืืฉื ืืขื ืื. ืงืืืืึทื ืฅ ื ืืฆื ืึท VPN ืืื ืขื ืฆื ืึทืงืกืขืก ืื ืืืขื ืึทืคึผืืึทืงืืืฉืึทื, ืืื ืืขื ืึทืงืกืขืก ืืื ืืืืืื ืงืึทื ืืจืึธืืื ืืื ืืืืืืขื ืฆื ืึท ืกืคึผืขืฆืืคืืฉ ืจืฉืืื ืคืื ืกืขืจืืืืกืขืก ืขืจืืืืื ืคึฟืึทืจ ื ืืฆื:
ืงืืืืึทื ืฅ ืคืึทืจืืื ืื ืฆื ืื ืืืคึผื ืืืจื ื ืึธืจืืึทื UDP ืคึผืึธืจื 1194 ืืื, ืืืขื ืงืึธื ื ืขืงืืขื, ืืึทืงืืืขื ืจืืฅ ืฆื ืื ืงื ืืื ืกืืื ืขืฅ ืคืื ืคึผืึธืืก ืืื ืืึทืืื ืื ืืก. ืืึทื ืฅ ืกืืื ืขืฅ ืืขื ืขื ืคึผืืฉื ืึทืืื ื ืืฉื ืฆื ืคืึทืจืืืจื ืกืขืจืืืืกืขืก ืืขืฉืึทืก ืจืืกืืึทืจื ืืื ืึทืืจืขืก ืขื ืืขืจืื ืืขื.
ืืขืจ ืคึผืึธืจื ืืื ืื ืงืึทื ืคืืืืขืจืืืฉืึทื ืืื ื ืึธืจืืึทื, ืืืึธืก ืืืคึผืึธืืืึทื ืขืืืขืืข ื ืืึทื ืกืื ืืืืฃ ืืขื ืคึผืจืึธืฆืขืก ืคืื ืงืึทื ืคืืืืขืจ ืื ืึทืคึผืืึทืงืืืฉืึทื ืืื ืืจืึทื ืกืคืขืจืื ื ืขืก ืฆื ืื Kubernetes ืงื ืืื. ืฆืื ืืืืฉืคึผืื, ืืื ืืขืจ ืืขืืืืงืขืจ AWS LoadBalancer ืคึฟืึทืจ UDP ืืื ืืขืืืขื ืืืฉ ืืื ืื ืกืืฃ ืคืื ืืขืฆืืข ืืึธืจ ืืื ืึท ืืืืืืขื ืจืฉืืื ืคืื ืืงืืืืช, ืืื NodePort ืงืขื ืขื ื ืื ืืืื ืืขืืืืื ื ืจืขืื ืฆื ืืืื ืคืึธืจืืืขืจืืื ื ืืืืฃ ืึทืืข ืงื ืืื ื ืึธืืื ืืื ืขืก ืืื ืืืืืขืืืขื ืฆื ืืืึธื ืื ื ืืืขืจ ืคืื ืกืขืจืืืขืจ ืื ืกืืึทื ืกืื ืคึฟืึทืจ. ืฉืืื ืืึธืืขืจืึทื ืฅ ืฆืืืขืงื. ืคึผืืืก, ืืืจ ืืืขื ืืึธืื ืฆื ืืืืฉื ืื ืคืขืืืงืืึทื ืงืืื ืคืื ืคึผืึธืจืฅ ...
ืืื ืึท ืจืขืืืืืึทื ืคืื ืืืื ืืืจื ืืขืืืขื ืกืึทืืืฉืึทื ื, ืื ืคืืืืขื ืืข ืืื ืืืืกืืขืจืืืืืื:
- ืคึผืึธืืก ืืื VPN ืืขื ืขื ืกืงืขืืืฉืืื ืคึผืขืจ ื ืึธืืข ืืื
hostNetwork, ืืึธืก ืืื, ืฆื ืื ืคืึทืงืืืฉ IP. - ืื ืืื ืกื ืืื ืึทืจืืึทื ืืขืฉืืงื ืึทืจืืืก ืืืจื
ClusterIP. ื ืคึผืึธืจื ืืื ืคืืืืงืื ืืื ืกืืึทืืืจื ืืืืฃ ืื ื ืึธืืข, ืืืึธืก ืืื ืฆืืืจืืืืขื ืคึฟืื ืื ืึทืจืืืก ืืื ืืื ืขืจืืืขืจืืืง ืจืขืืขืจืืืืืฉืึทื ื (ืงืึทื ืืืฉืึทื ืึทื ืืืึทืืืึทื ืคืื ืึท ืคืึทืงืืืฉ IP ืึทืืจืขืก). - ืืืืขืจืืึทื ืื ื ืื ื ืึธืืข ืืืืฃ ืืืึธืก ืื ืคึผืึธื ืจืืื ืืื ืืืืึทืืขืจ ืคืื ืื ืคืึทืจื ืขื ืคืื ืืื ืืืขืจ ืืขืฉืืืืข. ืืื ืืืขื ื ืึธืจ ืืึธืื ืึทื ืืืจ ืงืขื ืขื ืคืึทืจืืื ืื ืื ืกืขืจืืืืก ืฆื ืึท ื ืึธืืข ืึธืืขืจ ืฉืจืืึทืื ืึท ืงืืืื ืกืืืืงืึทืจ ืืื ืกื ืืืึธืก ืืืขื ืืึธื ืืืึธืจ ืื ืงืจืึทื ื IP ืึทืืจืขืก ืคืื ืื ืืืคึผื ืืื ืกื ืืื ืจืขืืึทืืืจื ืื ืื ืก ืจืขืงืึธืจืืก ืจืขืืืกืืจืืจื ืืื ืงืืืืึทื ืฅ - ืืืขืจ ืกืข ืืื ืืขื ืื ืคืึทื ืืึทืืืข.
ืคึฟืื ืึท ืจืืืื ื ืคึผืขืจืกืคึผืขืงืืืื, ืืืจ ืงืขื ืขื ืืื ืืงืื ืืืขื ืืืคืืฆืืจื ืึท ืืืคึผื ืงืืืขื ื ืืืจื ืืืื IP ืึทืืจืขืก ืืจืืืก ืืืจื ืื ืืืคึผื ืกืขืจืืืขืจ. ืื ืืขืจ ืืื ืึท ืคึผืจืืืืืืื ืืืืฉืคึผืื ืคืื ืืึทืืจืขื ืขืฆื ืึทืืึท ืึท ืงืืืขื ื ืก ืึทืงืกืขืก ืฆื ืกืขืจืืืืกืขืก, ืืืึทืกืืจืืืืื ืืืืฃ ืื ืืืืื-ืืขืจืืื ื Redis:
apiVersion: crd.projectcalico.org/v1
kind: HostEndpoint
metadata:
name: vpnclient-eth0
labels:
role: vpnclient
environment: production
spec:
interfaceName: "*"
node: kube-02
expectedIPs: ["172.176.176.2"]
---
apiVersion: crd.projectcalico.org/v1
kind: GlobalNetworkPolicy
metadata:
name: vpn-rules
spec:
selector: "role == 'vpnclient'"
order: 0
applyOnForward: true
preDNAT: true
ingress:
- action: Deny
protocol: TCP
destination:
ports: [6379]
- action: Allow
protocol: UDP
destination:
ports: [53, 67]ืืึธ, ืงืึทื ืขืงืืื ื ืฆื ืคึผืึธืจื 6379 ืืื ืฉืืจืขื ื ืคึผืจืึธืืืืืึทืืึทื, ืึธืืขืจ ืืื ืืขืจ ืืขืืืืงืขืจ ืฆืืึทื ืื ืึธืคึผืขืจืึทืฆืืข ืคืื โโืื ืื ืก ืืื ืกื ืืื ืืคืืขืืื, ืื ืคืึทื ืืงืฉืึทื ืื ื ืคืื ืืืึธืก ืกืึทืคืขืจื ืืึทื ืฅ ืึธืคื ืืืขื ืฆืืืืขื ืื ื ืึผืืืื. ืืืืึทื, ืืื ืคืจืืขืจ ืืขืจืืื ื, ืืืขื ืึท ืกืขืืขืงืืึธืจ ืืืืก, ืื ืคืขืืืงืืึทื ืึธืคึผืืืืงืขื ืื ื ืคึผืึธืืืืืง ืืื ืืขืืืขื ืื ืฆื ืขืก ืกืืึทืื ืึทื ืืขืจืฉ ืกืคึผืขืกืืคืืขื.
ืจืขืืืืืึทืื ืคืื
ืืืื, ืืื ืื ืึทืืืึทื ืกืืจืืข ืึทืคึผื ืคืื Calico, ืืืจ ืงืขื ืขื ืคืืขืงืกืึทืืึทื ืงืึทื ืคืืืืขืจ ืืื ืืื ืึทืืืงืึทืืื ืืืืฉื ืจืืืื ื ืืื ืืื ืึทืจืื ืืขื ืงื ืืื. ืืื ืึทืืืขืืืื, ืื ื ืืฆื ืงืขื ืงืืงื ืืื ืฆื ืืจืืืขื ืคืืืืึทืื ืืื ืึท ืงืึทื ืึธื, ืืื ืืืคึผืืึทืืขื ืื ื ืึท L3 ื ืขืฅ ืืื BGP ืืื IP-IP ืืึทื ืึทืื ืงืืงื ืืึทื ืกืืจืึทืก ืืื ืึท ืคึผืฉืื ืงืืืขืจื ืขืืขืก ืื ืกืืึทืืืจืื ื ืืืืฃ ืึท ืคืืึทื ื ืขืฅ ... ืึธืืขืจ, ืึทื ืืขืจืฉ ืื ืืขืฆืืึทื ืงืืงื ืืึทื ืฅ ืืืืืึทืืึทื ืืื ื ืืฆืืง .
ืืืึธืืืจื ืึท ืงื ืืื ืฆื ืืจืขืคื ืืืืขืจืืืื ืจืขืงืืืืจืขืืขื ืฅ ืงืขื ื ืืฉื ืฉืืขื ืืืง ืืืื ืคืืืึทืืึทื, ืืื ืืึธืก ืืื ืืื ืงืึทืืืงืึธ (ืึธืืขืจ ืึท ืขื ืืขื ืืืืืื ื) ืงืืื ืฆื ืจืึทืืขืืืขื. ืื ืืืืฉืคืืื ืืขืืขืื ืืื ืืขื ืึทืจืืืงื (ืืื ืืื ืขืจืืืขืจืืืง ืืึธืืืคืืงืึทืืืึธื ืก) ืืขื ืขื ืืขื ืืฆื ืืื ืขืืืขืืข ืื ืกืืึทืืืืฉืึทื ื ืคืื ืืื ืืืขืจ ืงืืืืึทื ืฅ ืืื AWS.
ืคึผืก
ืืืืขื ืขื ืืืื ืืืืฃ ืืื ืืืขืจ ืืืึธื:
- ยซ";
- "ืึทื ืืืืืกืืจืึทืืขื ืืืื ืฆื ื ืขืืืืึธืจืงืื ื ืืื ืงืืืขืจื ืขืืขืก": , ;
- ยซ'.
ืืงืืจ: www.habr.com