ื ืืืืฅ. ืืจืึทื ืกื.: ืืขืจ ืืืืจ ืคืื ืืขื ืึทืจืืืงื, ืจืืืื ืืขืจืืกืื, ืืื ืืืืขืจ 20 ืืึธืจ ืืขืจืคืึทืจืื ื ืืื ืืืืืืืืืจื ืึทื ืืืืืงืืื ื, ืืื ืืื ืืืึทื ื ืืขืจ CTO ืืื ืืื-ืืจืื ืืขืจ ืคืื Tufin, ืึท ืคืืจืืข ืืืึธืก ืงืจืืืืฅ ืืืืขืจืืืื ืคึผืึธืืืืืง ืคืึทืจืืืึทืืืื ื ืกืึทืืืฉืึทื ื. ืืึธืืฉ ืขืจ ืืขื Kubernetes ื ืขืฅ ืคึผืึทืืึทืกืื ืืื ืึท ืืึทื ืฅ ืฉืืึทืจืง ืืขืฆืืึทื ืคึฟืึทืจ ื ืขืฅ ืกืขืืืขื ืืึทืืืึธื ืืื ืึท ืงื ืืื, ืขืจ ืืืื ืืืืืื ืึทื ืืื ืืขื ืขื ื ืืฉื ืึทืืื ืืจืื ื ืฆื ืื ืกืืจืืืขื ื ืืื ืคืืจ. ืืขืจ ืืึทืืขืจืืึทื (ืืึทื ืฅ ืืืึทืืืืึทื ืึทืก) ืืื ืืืขื ืฆื ืคึฟืึทืจืืขืกืขืจื ืกืคึผืขืฉืึทืืึทืกืฅ 'ืืืืกืืงืืึทื ืคืื ืืขื ืึทืจืืืกืืขืื ืืื ืืขืืคื ืืื ืืึทืื ืื ื ืืืืืง ืงืึทื ืคืืืืขืจืืืฉืึทื ื.
ืืืึทื ื, ืคืืืข ืงืึธืืคึผืึทื ืืขืก ืืขื ืขื ืื ืงืจืืกืื ืืื ืืฉืืืื ื Kubernetes ืฆื ืืืืคื ืืืืขืจ ืึทืคึผืืึทืงืืืฉืึทื ื. ืืขืจ ืืื ืืขืจืขืก ืืื ืืขื ืืืืืืืืืจื ืืื ืึทืืื ืืืื ืึทื ืขืืืขืืข ืจืืคื Kubernetes "ืื ื ืืึทืข ืึธืคึผืขืจืืืืื ื ืกืืกืืขื ืคึฟืึทืจ ืื ืืึทืื ืฆืขื ืืขืจ." ืืืกืืขืืืืืึทื, Kubernetes (ืึธืืขืจ K8s) ืืื ืึธื ืืืื ืฆื ืืืื ืืืืขืจืงื ืืื ืึท ืงืจืืืืฉ ืืืื ืคืื ืื ืืขืฉืขืคื, ืืืึธืก ืจืืงืืืืืขืจื ืื ืึธืจืืึทื ืืืึทืฆืืข ืคืื โโืืขืจืืืึทืงืกื ืืขืฉืขืคื ืคึผืจืึทืกืขืกืึทื, ืึทืจืืึทื ืืขืจืขืื ื ื ืขืฅ ืืืืขืจืืืื.
ืคึฟืึทืจ ืืืืขืจืืืื ืคึผืจืึธืคืขืกืกืืึธื ืึทืืก ืืืึธืก ืืขื ืขื ืคึผืึทืืึทืื ืืืจื ืืจืืขืื ืืื Kubernetes, ืื ืคืึทืงืืืฉ ืืชืืืืช ืงืขื ืืืื ืื ืคืขืืืงืืึทื ืคึผืึธืืืืืง ืคืื ืื ืคึผืืึทืืคืึธืจืืข: ืืึธืื ืึทืืฅ.
ืืขืจ ืคืืจืขืจ ืืืขื ืืขืืคึฟื ืืืจ ืคึฟืึทืจืฉืืืื ืื ืื ืขืจืืขื ืกืืจืืงืืืจ ืคืื ื ืขืฅ ืคึผืึทืืึทืกืื; ืคึฟืึทืจืฉืืืื ืืื ืืื ืึทื ืืขืจืฉ ืคืื ืื ืึผืืืื ืคึฟืึทืจ ืจืขืืืืขืจ ืคืืจืขืืืึทืืืก. ืขืก ืืืขื ืืืื ืืขืงื ืขืืืขืืข ืคึผืืืคืึธืื ืืื ืฆืืฉืืขืื ืจืขืงืึทืืึทื ืืืืฉืึทื ื ืฆื ืืึทืืืึธืจืขื ืขื ืึทืคึผืืึทืงืืืฉืึทื ื ืืืืฃ Kubernetes.
Kubernetes ื ืขืฅ ืคึผืึทืืึทืกืื
ืื ืงืืืขืจื ืขืืขืก ื ืขืฅ ืคึผืึธืืืืืง ืืขืงืึทื ืืืึทื ืึทืืึทืื ืืืจ ืฆื ืคืืจื ืื ืื ืืขืจืึทืงืฉืึทื ืคืื ืึทืคึผืืึทืงืืืฉืึทื ื ืืืคึผืืืื ืืืืฃ ืืขืจ ืคึผืืึทืืคืึธืจืืข ืืื ืื ื ืขืฅ ืฉืืืืข (ืื ืืจืื ืืื ืื OSI ืืึธืืขื). ื ืขืฅ ืคึผืึทืืึทืกืื ืคืขืื ืขืืืขืืข ืคืื โโโโืื ืึทืืืึทื ืกืืจืืข ืคึฟืขืึดืงืืืื ืคืื ืืึธืืขืจื ืคืืืจืืืึทืืืก, ืึทืืึท ืืื OSI Layer 7 ืขื ืคืึธืจืกืืึทื ื ืืื ืกืึทืงืึธื ืข ืืืืขืงืฉืึทื, ืึธืืขืจ ืืื ืฆืืฉืืขืื ืึท ืืงืขืจืืืง ืืืจืื ืคืื ื ืขืฅ ืืืืขืจืืืื ืืืึธืก ืืื ืึท ืืื ืกืืึทืจืืื ื ืคืื ื.
ื ืขืฅ ืคึผืึทืืึทืกืื ืงืึธื ืืจืึธื ืงืึธืืื ืืงืึทืฆืืข ืฆืืืืฉื ืคึผืึธืืก
ืืืขืจืงืืึธืืื ืืื ืงืืืขืจื ืขืืขืก ืืขื ืขื ืคืื ืื ืืขืจืืขืืืืื ืืืืขืจ ืคึผืึธืืก, ืืืึธืก ืฆืื ืืืคืฉืืขืื ืืื ืคืื ืืืื ืึธืืขืจ ืืขืจ ืงืึทื ืืืื ืขืจื ืืืคึผืืืื ืฆืืืึทืืขื. Kubernetes ืึทืกืืื ื ืืขืืขืจ ืคึผืึธื ืึทื IP ืึทืืจืขืก ืืืึธืก ืืื ืฆืืืจืืืืขื ืคึฟืื ืื ืืขืจืข ืคึผืึธืืก. Kubernetes ื ืขืฅ ืคึผืึทืืึทืกืื ืฉืืขืื ืึทืงืกืขืก ืจืขืื ืคึฟืึทืจ ืืจืืคึผืขืก ืคืื ืคึผืึธืืก ืืื ืื ืืขืืืข ืืืขื ืืื ืืืืขืจืืืื ืืจืืคึผืขืก ืืื ืื ืืืึธืืงื ืืขื ืขื ืืขื ืืฆื ืฆื ืงืึธื ืืจืึธืืืจื ืึทืงืกืขืก ืฆื ืืืืจืืืึทื ืืึทืฉืื ืื ืกืืึทื ืกืื.
ืืขืคืื ืืจื ื ืขืืืืึธืจืง ืคึผืึทืืึทืกืื
ืืื ืื ืืขืจืข Kubernetes ืจืขืกืืจืกื, ื ืขืฅ ืคึผืึทืืึทืกืื ืืขื ืขื ืกืคึผืขืกืืคืืขื ืืื YAML. ืืื ืืขื ืืืึทืฉืคึผืื ืืื ืื, ืื ืึทืคึผืืึทืงืืืฉืึทื balance ืฆืืืจืื ืฆื postgres:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default.postgres
namespace: default
spec:
podSelector:
matchLabels:
app: postgres
ingress:
- from:
- podSelector:
matchLabels:
app: balance
policyTypes:
- Ingress
(ื ืืืืฅ. ืืจืึทื ืกื.: ืืขื ืกืงืจืขืขื ืฉืึธื, ืืื ืึทืืข ืกืึทืืกืึทืงืืืึทื ื ืขื ืืขื ืึธื ืขืก, ืืื ืืขืืืขื ืืืฉืืคื ื ืืฉื ื ืืฆื ืืขืืืืจื Kubernetes ืืืฉืืจืื, ืึธืืขืจ ืืื ืื Tufin Orca ืืขืฆืืึทื, ืืืึธืก ืืื ืืขืืืขืืึธืคึผืขื ืืืจื ืื ืคืืจืืข ืคืื โโืืขืจ ืืืืจ ืคืื ืืขืจ ืึธืจืืืื ืขื ืึทืจืืืงื ืืื ืืืึธืก ืืื ืืขืจืืื ื ืืื ืื ืกืืฃ ืคืื ืืขื ืืึทืืขืจืืึทื.)
ืฆื ืืขืคืื ืืจื ืืืื ืืืืืขื ืข ื ืขืฅ ืคึผืึธืืืืืง, ืืืจ ืืึทืจืคึฟื ืืงืขืจืืืง ืืืืกื ืคืื YAML. ืื ืฉืคึผืจืึทื ืืื ืืืืืจื ืืืืฃ ืื ืืขื ืืืืฉืึทื (ืกืคึผืขืกืืคืืขื ืืืจื ืกืคึผืืืกืึทื ืืื ืืื ืืึทืืก). ืึทื ืื ืืขื ืืื ืขืืขืืขื ื ืืขืืขืจื ืฆื ืื ื ืืจืึทืกื ืื ืืขื ืืื ืขืืขืืขื ื ืืืืื ืืื. ื ื ืืึทืข ืจืฉืืื ืขืืขืืขื ื ืืืืื ืืื ืึท ืืืคืขื, ืึทืืข ืื ืืขืจืข ืขืืขืืขื ืื ืืึธืื ืื ืคืึธืจืขื ืฉืืืกื-ืืืขืจื.
ืืืืื ืืืกืงืจืืืื ืื ืคึผืึธืืืืืง ืืื YAML, ื ืืฆื ืฆื ืฉืึทืคึฟื ืขืก ืืื ืื ืงื ืืื:
kubectl create -f policy.yamlื ืขืฅ ืคึผืึธืืืืืง ืกืคึผืขืกืืคืืงืึทืืืึธื
ืื Kubernetes ื ืขืฅ ืคึผืึธืืืืืง ืืึทืฉืจืืึทืืื ื ืืืื ืคืืจ ืขืืขืืขื ืื:
-
podSelector: ืืืคืืื ื ืื ืคึผืึธืืก ืึทืคืขืงืืึทื ืืืจื ืืขื ืคึผืึธืืืืืง (ืืึทืจืืึทืฅ) - ืคืืจืืื ืื; -
policyTypes: ืื ืืืงืืืฅ ืืืึธืก ืืืืคึผืก ืคืื ืคึผืึทืืึทืกืื ืืขื ืขื ืึทืจืืึทื ืืขืจืขืื ื ืืื ืืขื: ืื ืืจืขืกืก ืืื / ืึธืืขืจ ืขืืจืขืกืก - ืึทืคึผืฉืึทื ืึทื, ืึธืืขืจ ืืื ืจืขืงืึธืืขื ืืืจื ืืคืืจืืฉ ืฆื ืกืคึผืขืฆืืคืืฆืืจื ืขืก ืืื ืึทืืข ืงืึทืกืขืก; -
ingress: ืืืคืืื ื ืขืจืืืืื ืื ืงืึทืืื ื ืคืึทืจืงืขืจ ืฆื ืฆืื ืคึผืึธืืก - ืึทืคึผืฉืึทื ืึทื; -
egress: ืืืคืืื ื ืขืจืืืืื ืึทืืืืึธืืื ื ืคืึทืจืงืขืจ ืคืื ืฆืื ืคึผืึธืืก ืืื ืึทืคึผืฉืึทื ืึทื.
ืืืึทืฉืคึผืื ืืขื ืืืขื ืคืื ืื Kubernetes ืืืขืืืืืื (ืืื ืจืืคึผืืืืกื role ืืืืฃ app), ืืืืืื ืืื ืึทืืข ืคืืจ ืขืืขืืขื ืื ืืขื ืขื ืืขื ืืฆื:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: test-network-policy
namespace: default
spec:
podSelector: # <<<
matchLabels:
app: db
policyTypes: # <<<
- Ingress
- Egress
ingress: # <<<
- from:
- ipBlock:
cidr: 172.17.0.0/16
except:
- 172.17.1.0/24
- namespaceSelector:
matchLabels:
project: myproject
- podSelector:
matchLabels:
role: frontend
ports:
- protocol: TCP
port: 6379
egress: # <<<
- to:
- ipBlock:
cidr: 10.0.0.0/24
ports:
- protocol: TCP
port: 5978
ืืืืข ืืึธื ืึทื ืึทืืข ืคืืจ ืขืืขืืขื ืื ืืึธื ื ืื ืืึธืื ืฆื ืืืื ืึทืจืืึทื ืืขืจืขืื ื. ืขืก ืืื ืืืืื ืืึทื ืืึทืืึธืจื podSelector, ืื ืืขืจืข ืคึผืึทืจืึทืืขืืขืจืก ืงืขื ืขื ืืืื ืืขืืืืื ื ืืื ืืขืืืืื.
ืืืื ืืืจ ืคืึทืจืืึธืื policyTypes, ืื ืคึผืึธืืืืืง ืืืขื ืืืื ืื ืืขืจืคึผืจืึทืืึทื ืืื ืืืื:
- ืืืจื ืคืขืืืงืืึทื, ืขืก ืืื ืื ืืขื ืืืขื ืึทื ืขืก ืืืคืืื ื ืื ืื ืืจืขืกืก ืืืึทื. ืืืื ืื ืคึผืึธืืืืืง ืืื ื ืืฉื ืืึธืื ืืขื ืืคืืจืืฉ, ืื ืกืืกืืขื ืืืขื ืืืขืจื ืขืืขื ืึทื ืึทืืข ืคืึทืจืงืขืจ ืืื ืคึผืจืึธืืืืืึทืืึทื.
- ืื ื ืึทืืืจ ืืืืฃ ืื ืขืืจืขืกืก ืืืึทื ืืืขื ืืืื ืืืฉืืืกื ืืืจื ืืขื ืืืึทืืืึทื ืึธืืขืจ ืึทืืืขืง ืคืื ืื ืงืึธืจืึทืกืคึผืึทื ืืื ื ืขืืจืขืกืก ืคึผืึทืจืึทืืขืืขืจ.
ืฆื ืืืกืืืืื ืืืกืืืืงืก ืืื ืจืขืงืึธืืขื ืืืจื ืฉืืขื ืืืง ืืึทืื ืขืก ืืงืกืคึผืืืกืึทื policyTypes.
ืืืื ืฆื ืื ืืืืื ืืึธืืืง, ืืืื ืื ืคึผืึทืจืึทืืขืืขืจืก ingress ืืื / ืึธืืขืจ egress ืืืืขืจืืขืืืคึผืขืจื, ืื ืคึผืึธืืืืืง ืืืขื ืืืืงืขื ืขื ืึทืืข ืคืึทืจืงืขืจ (ืืขื "ืกืืจืืคึผืื ื ืืขืจืฉื" ืืื ืื).
ืคืขืืืงืืึทื ืคึผืึธืืืืืง ืืื ืืึธืื
ืืืื ืงืืื ืคึผืึทืืึทืกืื ืืขื ืขื ืืืคืืื ื, Kubernetes ืึทืืึทืื ืึทืืข ืคืึทืจืงืขืจ ืืืจื ืคืขืืืงืืึทื. ืึทืืข ืคึผืึธืืก ืงืขื ืขื ืคืจืืื ืืืขืงืกื ืืื ืคึฟืึธืจืืึทืฆืืข ืฆืืืืฉื ืืื. ืคึฟืื ืึท ืืืืขืจืืืื ืคึผืขืจืกืคึผืขืงืืืื, ืืึธืก ืงืขื ืืืกืงืืืขื ืงืึทืื ืืขืจืื ืืืึทืืืื, ืึธืืขืจ ืืขืืขื ืงื ืึทื Kubernetes ืืื ืขืจืืืืฉื ืึทืื ืืืืืื ื ืืืจื ืืขืืืขืืึธืคึผืขืจืก ืฆื ืืขืื ืึทืคึผืืึทืงืืืฉืึทื ืื ืืขืจืึธืคึผืขืจืึทืืืืืื. ื ืขืืืืึธืจืง ืคึผืึทืืึทืกืื ืืขื ืขื ืฆืืืขืืขืื ืฉืคึผืขืืขืจ.
ื ืึธืืขื ืกืคึผืืืกืึทื
Namespaces ืืขื ืขื ืื Kubernetes ืืืืึทืจืืขื ืืขืงืึทื ืืืึทื. ืืื ืืขื ืขื ืืืืืื ื ืฆื ืืืึธืืืจื ืืึทืืืฉืืงืึทื ืื ืืืืืจืึทื ืืึทื ืฅ ืคืื ืืขืืขืจ ืื ืืขืจืขืจ, โโืืฉืขืช ืงืึธืืื ืืงืึทืฆืืข ืฆืืืืฉื ืกืคึผืืืกืึทื ืืื ืขืจืืืืื ืืืจื ืคืขืืืงืืึทื.
ืืื ืจืืึฟ Kubernetes ืงืึทืืคึผืึธืื ืึทื ืฅ, ื ืขืฅ ืคึผืึทืืึทืกืื ืืขืื ืืื ืึท ืกืคึผืขืฆืืคืืฉ ื ืึทืืขืกืคึผืึทืกืข. ืืื ืื ืืืึธืง metadata ืืืจ ืงืขื ืขื ืกืคึผืขืฆืืคืืฆืืจื ืืืึธืก ืคึผืืึทืฅ ืื ืคึผืึธืืืืืง ืืขืืขืจื ืฆื:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: test-network-policy
namespace: my-namespace # <<<
spec:
...
ืืืื ืื ื ืึทืืขืกืคึผืึทืกืข ืืื ื ืืฉื ืืคืืจืืฉ ืกืคึผืขืกืืคืืขื ืืื ืื ืืขืืึทืืึทืืึท, ืื ืกืืกืืขื ืืืขื ื ืืฆื ืื ื ืึทืืขืกืคึผืึทืกืข ืกืคึผืขืกืืคืืขื ืืื kubectl (ืืืจื ืคืขืืืงืืึทื namespace=default):
kubectl apply -n my-namespace -f namespace.yamlืืื ืจืขืงืืืขื ืืืจ ืกืคึผืขืฆืืคืืฆืืจื ืื ื ืึธืืขื ืกืคึผืึทืกืืคืืงืื, ืกืืึทืื ืืืจ ืฉืจืืึทืื ืึท ืคึผืึธืืืืืง ืืืึธืก ืืึทืจืืึทืฅ ืงืืืคื ื ืึธืืขื ืกืคึผืืืกืึทื ืืื ืึทืืึธื.
ืืืืคึผื ืขืืขืืขื ื podSelector ืืื ืืขืจ ืคึผืึธืืืืืง ืืืขื ืืืืกืงืืืึทืื ืคึผืึธืืก ืคืื ืื ื ืึทืืขืกืคึผืึทืกืข ืฆื ืืืึธืก ืื ืคึผืึธืืืืืง ืืขืืขืจื (ืขืก ืืื ืืขืืืืงื ื ืึทืงืกืขืก ืฆื ืคึผืึธืืก ืคืื ืื ืื ืืขืจ ื ืึทืืขืกืคึผืึทืกืข).
ืกืืืืืึทืจืื, ืคึผืึธืืกืขืืขืงืืึธืจืก ืืื ืึทืืจืขืกืืื ืืื ืึทืจืืืกืืึทื ื ืืืึทืงืก ืงืขื ืขื ืืืืื ืืืืกืงืืืึทืื ืคึผืึธืืก ืคืื ืืืืขืจ ืืืืื ื ืึธืืขื ืคึผืืึทืฅ, ืกืืึทืื ืคืื ืงืืจืก ืืืจ ืคืึทืจืืื ืื ืืื ืืื namespaceSelector (ืืึธืก ืืืขื ืืืื ืืืกืงืึทืกื ืืื ืื ืึธืคึผืืืืืื ื "ืคืืืืขืจ ืืืจื ื ืึธืืขื ืกืคึผืืืกืึทื ืืื ืคึผืึธืืก").
ืคึผืึธืืืืืง ื ืึทืืื ื ืึผืืืื
ืคึผืึธืืืืืง ื ืขืืขื ืืขื ืขื ืืื ืฆืืง ืืื ืืขืจ ืืขืืืืงืขืจ ื ืึทืืขืกืคึผืึทืกืข. ืขืก ืงืขื ืขื ื ืืฉื ืืืื ืฆืืืื ืคึผืึทืืึทืกืื ืืื ืื ืืขืืืข ื ืึธืืขื ืืื ืื ืืขืืืข ืคึผืืึทืฅ, ืึธืืขืจ ืขืก ืงืขื ืขื ืืืื ืคึผืึทืืึทืกืื ืืื ืื ืืขืืืข ื ืึธืืขื ืืื ืคืึทืจืฉืืืขื ืข ืกืคึผืืืกืึทื. ืืึธืก ืืื ื ืืฆืืง ืืืขื ืืืจ ืืืืื ืฆื ืฆืืืืืื ืื ืืขืืืข ืคึผืึธืืืืืง ืืืืขืจ ืงืืืคื ืกืคึผืืืกืึทื.
ืืื ืกืคึผืขืฆืืขื ืืื ืืืื ืขืจ ืคืื ืื ื ืึทืืื ื ืืขืืืึธืืก. ืขืก ืืืฉืืืื ืคืื ืงืึทืืืืื ืื ื ืื ื ืึธืืขื ืคืื ืื ื ืึธืืขื ืืื ืื ืฆืื ืคึผืึธืืก. ืืืฉื:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default.postgres # <<<
namespace: default
spec:
podSelector:
matchLabels:
app: postgres
ingress:
- from:
- podSelector:
matchLabels:
app: admin
policyTypes:
- Ingress
ืืึทืืขืืก
ืืืจ ืงืขื ืขื ืฆืืืฉืขืคึผืขื ืื ืื ืืึทืืขืืก ืฆื Kubernetes ืึทืืืืฉืขืงืฅ, ืึทืืึท ืืื ืคึผืึธืืก ืืื ื ืึธืืขื ืกืคึผืืืกืึทื. ืืึทืืขืืก (ืืึทืืขืืก - ืืึทืืก) ืืขื ืขื ืื ืขืงืืืืืืึทืืขื ื ืคืื ืืึทืืก ืืื ืื ืืืึธืืงื. Kubernetes ื ืขืฅ ืคึผืึทืืึทืกืื ื ืืฆื ืืึทืืขืืก ืฆื ืืืืกืงืืืึทืื ืคึผืึธืืกืฆื ืืืึธืก ืืื ืฆืืืืืื:
podSelector:
matchLabels:
role: dbโฆ ืึธืืขืจ ื ืึธืืขื ืกืคึผืืืกืึทืืฆื ืืืึธืก ืืื ืฆืืืืืื. ืืขืจ ืืืืฉืคึผืื ืกืึทืืขืงืฅ ืึทืืข ืคึผืึธืืก ืืื ื ืึธืืขื ืกืคึผืืืกืึทื ืืื ืื ืงืึธืจืึทืกืคึผืึทื ืืื ื ืืึทืืขืืก:
namespaceSelector:
matchLabels:
project: myproject
ืืืื ืืืึธืจืขื ืขื: ืืืขื ื ืืฆื namespaceSelector ืืึทืื ืืืืขืจ ืึทื ืื ื ืึธืืขื ืกืคึผืืืกืึทื ืืืจ ืืืืกืงืืืึทืื ืึทื ืืืึทืืื ืื ืจืืืืืง ืคืืจืืข. ืืืื ืึทืืืขืจ ืึทื ืืขืืืื-ืืื ื ืึทืืขืกืคึผืึทืกืขืก ืึทืืึท ืืื default ะธ kube-system, ืืืจื ืคืขืืืงืืึทื ืืึธื ื ืื ืึทื ืืืึทืืื ืืึทืืขืืก.
ืืืจ ืงืขื ืขื ืืืืื ืึท ืคืืจืืข ืฆื ืึท ืคึผืืึทืฅ ืืื ืืึธืก:
kubectl label namespace default namespace=default
ืืื ืืขืจ ืืขืืืืงืขืจ ืฆืืื, ื ืึธืืขื ืกืคึผืืืก ืืื ืื ืึธืคึผืืืืืื ื metadata ืืึธื ืึธืคึผืฉืืงื ืฆื ืื ืคืึทืงืืืฉ ืคึผืืึทืฅ ื ืึธืืขื, ื ืืฉื ืื ืคืืจืืข:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: test-network-policy
namespace: default # <<<
spec:
...ืืงืืจ ืืื ืืขืกืืื ืืืฉืึทื
ืคืืจืขืืืึทืื ืคึผืึทืืึทืกืื ืฆืื ืืืคืฉืืขืื ืืื ืคืื ืึผืืืื ืืื ืงืืืืื ืืื ืืขืกืืึทื ืืืฉืึทื ื. Kubernetes ื ืขืฅ ืคึผืึทืืึทืกืื ืืขื ืขื ืืืคืืื ื ืคึฟืึทืจ ืึท ืฆืื - ืึท ืกืืื ืคืื ืคึผืึธืืก ืฆื ืืืึธืก ืืื ืฆืืืืืื - ืืื ืืขืืึธืื ืฉืืขืื ืึผืืืื ืคึฟืึทืจ ืื ืืจืขืกืก ืืื / ืึธืืขืจ ืืืจืขืกืก ืคืึทืจืงืขืจ. ืืื ืืื ืืืขืจ ืืืืฉืคึผืื, ืื ืฆืื ืคืื ืื ืคึผืึธืืืืืง ืืืขื ืืืื ืึทืืข ืคึผืึธืืก ืืื ืื ื ืึทืืขืกืคึผืึทืกืข default ืืื ืคืืจืืข ืืื ืฉืืืกื app ืืื ืื ืืืขืจื db:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: test-network-policy
namespace: default
spec:
podSelector:
matchLabels:
app: db # <<<
policyTypes:
- Ingress
- Egress
ingress:
- from:
- ipBlock:
cidr: 172.17.0.0/16
except:
- 172.17.1.0/24
- namespaceSelector:
matchLabels:
project: myproject
- podSelector:
matchLabels:
role: frontend
ports:
- protocol: TCP
port: 6379
egress:
- to:
- ipBlock:
cidr: 10.0.0.0/24
ports:
- protocol: TCP
port: 5978
ืกืืืกืขืงืฆืืข ingress ืืื ืืขื ืคึผืึธืืืืืง, ืึธืคึผืขื ืก ืื ืงืึทืืื ื ืคืึทืจืงืขืจ ืฆื ืื ืฆืื ืคึผืึธืืก. ืืื ืื ืืขืจืข ืืืขืจืืขืจ, ืื ืืจืขืกืก ืืื ืืขืจ ืืงืืจ ืืื ืฆืื ืืื ืื ืงืึธืจืึทืกืคึผืึทื ืืื ื ืืขืกืืื ืืืฉืึทื. ืคึผืื ืงื ืึทืืื, ืขืืจืขืกืก ืืื ืื ืืขืกืืื ืืืฉืึทื ืืื ืฆืื ืืื ืืืึทื ืืงืืจ.
ืืึธืก ืืื ืขืงืืืืืืึทืืขื ื ืฆื ืฆืืืื ืคืืืจืืืึทื ืึผืืืื: ืื ืืจืขืกืก โ ืฆืื; ืฆืื โ ืึทืจืืืกืืึทื ื.
Egress ืืื DNS (ืืืืืืืง!)
ืืืจื ืืืืืืขื ืึทืืืืึธืืื ื ืคืึทืจืงืขืจ, ืืึทืฆืึธืื ืกืคึผืขืฆืืขื ืืคืืขืจืงืืึทืืงืืึทื ืฆื ืื ืก - Kubernetes ื ืืฆื ืืขื ืืื ืกื ืฆื ืืึทืคึผืข ืืึทืืื ืื ืืก ืฆื IP ืึทืืจืขืกืขืก. ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืื ืคืืืืขื ืืข ืคึผืึธืืืืืง ืืืขื ื ืืฉื ืึทืจืืขืื ืืืืึทื ืืืจ ืืึธื ื ืืฉื ืขืจืืืืื ืื ืึทืคึผืืึทืงืืืฉืึทื balance ืฆืืืจืื ืื ืก:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default.balance
namespace: default
spec:
podSelector:
matchLabels:
app: balance
egress:
- to:
- podSelector:
matchLabels:
app: postgres
policyTypes:
- Egress
ืืืจ ืงืขื ืขื ืคืึทืจืจืืืื ืขืก ืืืจื ืขืคื ืึทืงืกืขืก ืฆื ืื ืื ืก ืืื ืกื:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default.balance
namespace: default
spec:
podSelector:
matchLabels:
app: balance
egress:
- to:
- podSelector:
matchLabels:
app: postgres
- to: # <<<
ports: # <<<
- protocol: UDP # <<<
port: 53 # <<<
policyTypes:
- Egress
ืืขืฆืืข ืขืืขืืขื ื to ืืื ืืืืืืง, ืืื ืืขืจืืืขืจ ืขืก ืืื ืึทืฆืึทื ืกืึทืืขืงืฅ ืึทืืข ืคึผืึธืืก ืืื ืึทืืข ื ืึธืืขื ืกืคึผืืืกืึทื, ืืขืจืืืืื ืืืง balance ืฉืืงื ืื ืก ืงืืืืจืื ืฆื ืื ืฆืื ืขืืขื Kubernetes ืืื ืกื (ืืืืฉืึทืืืึทืื ืคืืืกื ืืืง ืืื ืื ืคึผืืึทืฅ kube-system).
ืืขื ืฆืืืึทื ื ืึทืจืืขื, ืึธืืขืจ ืขืก ืฆืืคืื ืคึผืขืจืืืกืืื ืืื ืื ืกืึทืงืืขืจ, ืืืืึทื ืขืก ืึทืืึทืื ืื ืก ืงืืืืจืื ืฆื ืืืื ืืืจืขืงืืขื ืึทืจืืืก ืื ืงื ืืื.
ืืืจ ืงืขื ืขื ืคึฟืึทืจืืขืกืขืจื ืขืก ืืื ืืจืื ืกืึทืงืกืขืกืืื ืกืืขืคึผืก.
1. ืืึธืื ืื ืก ืงืืืืจืื ืืืืื ืื ืงื ืืื ืืืจื ืึทืืื ื namespaceSelector:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default.balance
namespace: default
spec:
podSelector:
matchLabels:
app: balance
egress:
- to:
- podSelector:
matchLabels:
app: postgres
- to:
- namespaceSelector: {} # <<<
ports:
- protocol: UDP
port: 53
policyTypes:
- Egress
2. ืืึธืื ืื ืก ืงืืืืจืื ืืืืื ืืื ื ืึทืืขืกืคึผืืืก kube-system.
ืฆื ืืึธื ืืึธืก, ืืืจ ืืึทืจืคึฟื ืฆื ืืืืื ืึท ืคืืจืืข ืฆื ืื ื ืึธืืขื kube-system: kubectl label namespace kube-system namespace=kube-system - ืืื ืฉืจืืึทืื ืขืก ืึทืจืึธืคึผ ืืื ืคึผืึธืืืืืง ื ืืฆื namespaceSelector:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default.balance
namespace: default
spec:
podSelector:
matchLabels:
app: balance
egress:
- to:
- podSelector:
matchLabels:
app: postgres
- to:
- namespaceSelector: # <<<
matchLabels: # <<<
namespace: kube-system # <<<
ports:
- protocol: UDP
port: 53
policyTypes:
- Egress
3. ืคึผืึทืจืึทื ืึธืื ืืขื ืืฉื ืงืขื ืขื ืืืื ืืคืืื ืืืืึทืืขืจ ืืื ืืึทืืจืขื ืขืฆื ืื ืก ืงืืืืจืื ืฆื ืึท ืกืคึผืขืฆืืคืืฉ ืื ืก ืืื ืกื ืืื kube-system. ืืขืจ ืึธืคึผืืืืืื ื "ืคืืืืขืจ ืืืจื ื ืึธืืขื ืกืคึผืืืกืึทื ืืื ืคึผืึธืืก" ืืืขื ืืึธืื ืืืจ ืืื ืฆื ืืขืจืืจืืืื ืืขื.
ืื ืื ืืขืจ ืึธืคึผืฆืืข ืืื ืฆื ืกืึธืืืืข DNS ืืืืฃ ืื ื ืึทืืขืกืคึผืึทืกืข ืืืจืื. ืืื ืืขื ืคืึทื, ืขืก ืืืขื ื ืื ืืึทืจืคึฟื ืฆื ืืืื ืืขืขืคื ื ืคึฟืึทืจ ืืขืืขืจ ืืื ืกื:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default.dns
namespace: default
spec:
podSelector: {} # <<<
egress:
- to:
- namespaceSelector: {}
ports:
- protocol: UDP
port: 53
policyTypes:
- Egress
ืืืืืืง podSelector ืกืึทืืขืงืฅ ืึทืืข ืคึผืึธืืก ืืื ืื ื ืึทืืขืกืคึผืึทืกืข.
ืขืจืฉืืขืจ ืืืืึทืื ืืื ืืขืจืฉื ืกืืจ
ืืื ืงืึทื ืืืขื ืฉืึทื ืึทื ืคืืจืขืืืึทืืืก, ืืขืจ ืงืึทืืฃ (ืึทืืึทื ืึธืืขืจ ืึธืคึผืืืืงืขื ืขื) ืืืืฃ ืึท ืคึผืึทืงืึทื ืืื ืืืฉืืืกื ืืืจื ืืขืจ ืขืจืฉืืขืจ ืืขืจืฉื ืึทื ืขืก ืกืึทืืืกืคืืื. ืืื Kubernetes, ืืขืจ ืกืืจ ืคืื ืคึผืึทืืึทืกืื ืืื ื ืืฉื ืขื ืื.
ืืืจื ืคืขืืืงืืึทื, ืืืขื ืงืืื ืคึผืึทืืึทืกืื ืืขื ืขื ืืึทืฉืืืื, ืงืึธืืื ืืงืึทืฆืืข ืฆืืืืฉื ืคึผืึธืืก ืืขื ืขื ืขืจืืืืื ืืื ืืื ืงืขื ืขื ืคืจืืื ืืืขืงืกื ืืื ืคึฟืึธืจืืึทืฆืืข. ืึทืืึธื ืืืจ ืึธื ืืืืื ืคืึธืจืืืืืจื ืคึผืึทืืึทืกืื, โโืืขืืขืจ ืคึผืึธื ืึทืคืขืงืืึทื ืืืจื ืืืึท ืืื ืืกืืขืจ ืืืื ืขืจ ืคืื ืืื ืืืขืจื ืืคืืขืืื ืืขืจื ืืืื ืื ืืืกืืืฉืื ืงืืืึธื (ืืึทืืืฉืืงืึทื OR) ืคืื ืึทืืข ืื ืคึผืึทืืึทืกืื ืืืึธืก ืืึธืื ืืืืกืืขืงืืืื ืขืก. ืคึผืึธืืก ืืืึธืก ืืขื ืขื ื ืืฉื ืึทืคืขืงืืึทื ืืืจื ืงืืื ืคึผืึธืืืืืง ืืืืืื ืึธืคื.
ืืืจ ืงืขื ืขื ืืืืฉื ืืขื ื ืึทืืืจ ืืื ืึท ืกืืจืืคึผืื ื ืืขืจืฉื.
ืกืืจืืคึผืื ื ืืขืจืฉื ("ืืืืงืขื ืขื")
ืคืืจืขืืืึทืื ืคึผืึทืืึทืกืื ืืืคึผืืงืื ืืืืงืขื ืขื ืงืืื ืคืึทืจืงืขืจ ืืืึธืก ืืื ื ืืฉื ืืคืืจืืฉ ืขืจืืืืื.
ืขืก ืืื ืงืืื ืึธืคึผืืืืงืขื ืื ื ืงืึทืืฃ ืืื Kubernetes, ืึธืืขืจ, ืึท ืขื ืืขื ืืืืจืงืื ื ืงืขื ืขื ืืืื ืึทืืฉืืืื ืืื ืึท ืจืขืืืืขืจ (ืคึผืขืจืืืกืืื) ืคึผืึธืืืืืง ืืืจื ืกืึทืืขืงืืื ื ืึท ืืืืืืง ืืจืืคึผืข ืคืื โโืืงืืจ ืคึผืึธืืก (ืื ืืจืขืกืก):
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: deny-all
namespace: default
spec:
podSelector: {}
policyTypes:
- Ingress
ืื ืคึผืึธืืืืืง ืกืึทืืขืงืฅ ืึทืืข ืคึผืึธืืก ืืื ืื ื ืึทืืขืกืคึผืึทืกืข ืืื ืืึธืื ืื ืืจืขืกืก ืึทื ืืืคืืื ื, ืืืืงืขื ืขื ืึทืืข ืื ืงืึทืืื ื ืคืึทืจืงืขืจ.
ืืื ืึท ืขื ืืขื ืืืขื, ืืืจ ืงืขื ืขื ืืึทืืจืขื ืขืฆื ืึทืืข ืึทืืืืึธืืื ื ืคืึทืจืงืขืจ ืคืื ืึท ื ืึทืืขืกืคึผืืืก:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: deny-all-egress
namespace: default
spec:
podSelector: {}
policyTypes:
- Egress
ืืืืข ืืึธื ืึทื ืงืืื ื ืึธื ืคึผืึทืืึทืกืื ืืืึธืก ืืึธืื ืคืึทืจืงืขืจ ืฆื ืคึผืึธืืก ืืื ืื ื ืึทืืขืกืคึผืึทืกืข ืืืขื ื ืขืืขื ืคึผืจืืืืึทื ืก ืืืืขืจ ืืขื ืืขืจืฉื (ืขื ืืขื ืฆื ืืืืื ืึทื ืืึธืื ืืขืจืฉื ืืืืืขืจ ืึท ืืืืงืขื ืขื ืืขืจืฉื ืืื ืึท ืคืืืจืืืึทื ืงืึทื ืคืืืืขืจืืืฉืึทื).
ืืึธืื ืึทืืฅ (ืขื ื-ืขื ื-ืขื ื-ืึทืืึทื)
ืฆื ืฉืึทืคึฟื ืึทื ืึทืืึทื ืึทืืข ืคึผืึธืืืืืง, ืืืจ ืืึทืจืคึฟื ืฆื ืืขืกืึธืคืข ืื ืึธืคึผืืืืงืขื ืื ื ืคึผืึธืืืืืง ืืืืื ืืื ืึท ืืืืืืง ืขืืขืืขื ื ingress:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-all
namespace: default
spec:
podSelector: {}
ingress: # <<<
- {} # <<<
policyTypes:
- Ingress
ืขืก ืึทืืึทืื ืึทืงืกืขืก ืคึฟืื ืึทืืข ืคึผืึธืืก ืืื ืึทืืข ื ืึทืืขืกืคึผืึทืกืขืก (ืืื ืึทืืข IP) ืฆื ืงืืื ืคึผืึธื ืืื ืื ื ืึทืืขืกืคึผืึทืกืข default. ืืขื ืึธืคึผืคืืจืื ื ืืื ืขื ืืืืึทืื ืืืจื ืคืขืืืงืืึทื, ืึทืืื ืขืก ืืืืฉืึทืืืึทืื ื ืื ืืึทืจืคึฟื ืฆื ืืืื ืืืคืืื ื ืืืืึทืืขืจ. ืึธืืขืจ, ืืื ืืืจ ืงืขื ืืึทืจืคึฟื ืฆื ืืขืืคึผืขืจืขืจืึทืื ืืืกืืืืึทื ืขืืืขืืข ืกืคึผืขืฆืืคืืฉ ืคึผืขืจืืืฉืึทื ื ืฆื ืืืึทืื ืึธืืืจื ืืขื ืคึผืจืึธืืืขื.
ืื ืืขืจืฉื ืงืขื ืขื ืืืื ื ืขืจืึธืื ืฆื ืืึธืื ืึทืงืกืขืก ืืืืื ืฆื ืึท ืกืคึผืขืฆืืคืืฉ ืืึทื ื ืคืื ืคึผืึธืืก (app:balance) ืืื ืื ื ืึธืืขื ืคึผืืึทืฅ default:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-all-to-balance
namespace: default
spec:
podSelector:
matchLabels:
app: balance
ingress:
- {}
policyTypes:
- Ingress
ืื ืคืืืืขื ืืข ืคึผืึธืืืืืง ืึทืืึทืื ืึทืืข ืื ืืจืขืกืก ืืื ืืืจืขืกืก ืคืึทืจืงืขืจ, ืึทืจืืึทื ืืขืจืขืื ื ืึทืงืกืขืก ืฆื ืงืืื IP ืึทืจืืืก ืื ืงื ืืื:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-all
spec:
podSelector: {}
ingress:
- {}
egress:
- {}
policyTypes:
- Ingress
- Egress
ืงืึทืืืืื ืื ื ืงืืืคื ืคึผืึทืืึทืกืื
ืคึผืึทืืึทืกืื ืืขื ืขื ืงืึทืืืืื ื ื ืืฆื ืืึทืืืฉืืงืึทื ืึธืืขืจ ืืื ืืจืืึท ืืขืืืขืืก; ืื ืคึผืขืจืืืฉืึทื ื ืคืื ืืขืืขืจ ืคึผืึธื ืืขื ืขื ืืึทืฉืืืื ืืื ืืืื ืืื ืื ืืืกืืืฉืื ืงืืืึธื ืคืื ืึทืืข ืคึผืึทืืึทืกืื ืืืึธืก ืืืืจืงื ืขืก:
1. ืืื ืื ืคืขืืืขืจ from ะธ to ืืจืื ืืืืคึผืก ืคืื ืขืืขืืขื ืื ืงืขื ืขื ืืืื ืืืคืืื ื (ืึทืืข ืคืื โโืืืึธืก ืืขื ืขื ืงืึทืืืืื ื ืืื OR):
-
namespaceSelector- ืกืึทืืขืงืฅ ืื ืืื ืฆืข ื ืึธืืขื ืคึผืืึทืฅ; -
podSelector- ืกืึทืืขืงืฅ ืคึผืึธืืก; -
ipBlockโ ืกืึทืืขืงืฅ ืึท ืกืืื ืขื.
ืืขืจืฆื, ืื ื ืืืขืจ ืคืื ืขืืขืืขื ืื (ืืคืืื ืืืืขื ืืงืึทื ืึธื ืขืก) ืืื ืกืึทืืกืขืงืฉืึทื ื from/to ื ืื ืืืืจืขื ืขืฆื. ืึทืืข ืคืื โโืืื ืืืขื ืืืื ืงืึทืืืืื ื ืืืจื ืืึทืืืฉืืงืึทื OR.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default.postgres
namespace: default
spec:
ingress:
- from:
- podSelector:
matchLabels:
app: indexer
- podSelector:
matchLabels:
app: admin
podSelector:
matchLabels:
app: postgres
policyTypes:
- Ingress
2. ืื ืืขืจ ืคึผืึธืืืืืง ืึธืคึผืืืืืื ื ingress ืงืขื ืขื ืืึธืื ืคืืืข ืขืืขืืขื ืื from (ืงืึทืืืืื ื ืืืจื ืืึทืืืฉืืงืึทื OR). ืกืืืืืึทืจืื, ืึธืคึผืืืืืื ื egress ืงืขื ืึทืจืืึทื ื ืขืืขื ืคืืืข ืขืืขืืขื ืื to (ืืืื ืงืึทืืืืื ื ืืืจื ืืืกืืืฉืื ืงืืืึธื):
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default.postgres
namespace: default
spec:
ingress:
- from:
- podSelector:
matchLabels:
app: indexer
- from:
- podSelector:
matchLabels:
app: admin
podSelector:
matchLabels:
app: postgres
policyTypes:
- Ingress
3. ืคืึทืจืฉืืืขื ืข ืคึผืึทืืึทืกืื ืืขื ืขื ืืืื ืงืึทืืืืื ื ืืื ืืึทืืืฉืืงืึทื OR
ืืืขืจ ืืืขื ืงืึทืืืืื ืื ื ืืื, ืขืก ืืื ืืืื ืืึทืืจืขื ืขืฆืื ื ืืืืฃ ืืืึธืก : Kubernetes ืงืขื ืขื ืืืืื ืคืึทืจืืื ืื ืคึผืึทืืึทืกืื ืืื ืคืึทืจืฉืืืขื ืข policyTypes (Ingress ืึธืืขืจ Egress). ืคึผืึทืืึทืกืื ืืืึธืก ืืืคืืื ืื ื ืื ืืจืขืกืก (ืึธืืขืจ ืืืจืขืกืก) ืืืขื ืึธืืืืขืจืจืืื ืืขืืขืจ ืื ืืขืจืข.
ืฉืืืืืช ืฆืืืืฉื ื ืึธืืขื ืกืคึผืืืกืึทื
ืืืจื ืคืขืืืงืืึทื, ืืื ืคึฟืึธืจืืึทืฆืืข ืืึทื ืืืืืื ื ืฆืืืืฉื ื ืึธืืขื ืกืคึผืืืกืึทื ืืื ืขืจืืืืื. ืืขื ืงืขื ืขื ืืืื ืคืืจืขื ืืขืจื ืืืจื ื ืืฆื ืึท ืืืืงืขื ืขื ืคึผืึธืืืืืง ืืืึธืก ืืืขื ืืึทืืจืขื ืขืฆื ืคืึทืจืงืขืจ ืึทืืืืึธืืื ื ืืื / ืึธืืขืจ ืื ืงืึทืืื ื ืืื ืื ื ืึทืืขืกืคึผืึทืกืข (ืืขื "ืกืืจืืคึผืื ื ืจืื" ืืืืื).
ืึทืืึธื ืืืจ ืืึธืื ืืคืืขืฉืืขืื ืึทืงืกืขืก ืฆื ืึท ื ืึทืืขืกืคึผืึทืกืข (ืืขื ืื "ืกืืจืืคึผืื ื ืจืื" ืืืืื), ืืืจ ืงืขื ืขื ืืึทืื ืืืืกื ืขืืขื ืฆื ืื ืคืืจืืืืงืขื ืขื ืคึผืึธืืืืืง ืืืจื ืึทืืึทืืื ื ืงืึทื ืขืงืฉืึทื ื ืคืื ืึท ืกืคึผืขืฆืืคืืฉ ื ืึธืืขื ืกืคึผืืืก ื ืืฆื namespaceSelector:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: database.postgres
namespace: database
spec:
podSelector:
matchLabels:
app: postgres
ingress:
- from:
- namespaceSelector: # <<<
matchLabels:
namespace: default
policyTypes:
- Ingress
ืืื ืึท ืจืขืืืืืึทื, ืึทืืข ืคึผืึธืืก ืืื ืื ื ืึทืืขืกืคึผืึทืกืข default ืืืขื ืืึธืื ืฆืืืจืื ืฆื ืคึผืึธืืก postgres ืืื ื ืึธืืขื ืคึผืืึทืฅ database. ืืืขืจ ืืืึธืก ืืืื ืืืจ ืืืืื ืฆื ืขืคืขื ืขื ืึทืงืกืขืก ืฆื postgres ืืืืื ืกืคึผืขืฆืืคืืฉ ืคึผืึธืืก ืืื ืื ื ืึทืืขืกืคึผืึทืกืข default?
ืคืืืืขืจ ืืืื ื ืึธืืขื ืกืคึผืืืกืึทื ืืื ืคึผืึธืืก
Kubernetes ืืืขืจืกืืข 1.11 ืืื ืืขืืขืจ ืึทืืึทืื ืืืจ ืฆื ืคืึทืจืืื ืื ืึธืคึผืขืจืืืืขืจื namespaceSelector ะธ podSelector ื ืืฆื ืืึทืืืฉืืงืึทื AND. ืขืก ืงืืงื ืืื ืืึธืก:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: database.postgres
namespace: database
spec:
podSelector:
matchLabels:
app: postgres
ingress:
- from:
- namespaceSelector:
matchLabels:
namespace: default
podSelector: # <<<
matchLabels:
app: admin
policyTypes:
- Ingress
ืคืืจืืืืก ืืื ืืึธืก ืื ืืขืจืคึผืจืึทืืึทื ืืื AND ืึทื ืฉืืึธื ืคืื ืื ืืขืืืืื ืืืขื OR?
ืืืืขืจืง ืื podSelector ืืืืื ืืื ื ืืฉื ืื ืืื ื ืงืืืฃ. ืืื YAML ืืึธืก ืืืื ื ืึทื podSelector ืืื ืฉืืืืขื ืืืง ืคืึทืจ ืืื namespaceSelector ืึธืคึผืฉืืงื ืฆื ืืขืจ ืืขืืืืงืขืจ ืจืฉืืื ืขืืขืืขื ื. ืืขืจืืืขืจ, ืืื ืืขื ืขื ืงืึทืืืืื ื ืืื ืืึทืืืฉืืงืึทื AND.
ืึทืืื ื ืึท ืืืคืขื ืคืจืืขืจ podSelector ืืืขื ืจืขืืืืืึทื ืืื ืื ืืืขืจืืืฉืึทื ืก ืคืื ืึท ื ืืึท ืจืฉืืื ืขืืขืืขื ื, ืืืึธืก ืืืขื ืืืื ืงืึทืืืืื ื ืืื ืื ืคืจืืขืจืืืงืข ืืืื ืขืจ namespaceSelector ื ืืฆื ืืึทืืืฉืืงืึทื OR.
ืฆื ืืืืกืงืืืึทืื ืคึผืึธืืก ืืื ืึท ืกืคึผืขืฆืืคืืฉ ืคืืจืืข ืืื ืึทืืข ื ืึธืืขื ืกืคึผืืืกืึทื, ืึทืจืืึทื ืืืืืืง namespaceSelector:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: database.postgres
namespace: database
spec:
podSelector:
matchLabels:
app: postgres
ingress:
- from:
- namespaceSelector: {}
podSelector:
matchLabels:
app: admin
policyTypes:
- Ingress
ืงืืืคื ืืึทืืขืืก ืฆืืืึทืืขื ืืื I
ืึผืืืื ืคึฟืึทืจ ืึท ืคืืืจืืืึทื ืืื ืงืืืคื ืึทืืืืฉืขืงืฅ (ืืื ืืช, ื ืขืืืืึธืจืงืก, ืืจืืคึผืขืก) ืืขื ืขื ืงืึทืืืืื ื ืืื ืืึทืืืฉืืงืึทื OR. ืื ืคืืืืขื ืืข ืืขืจืฉื ืืืขื ืึทืจืืขืื ืืืื ืื ืคึผืึทืงืึทื ืืงืืจ ืฉืืืขืืขืืขื Host_1 ืึธืืขืจ Host_2:
| Source | Destination | Service | Action |
| ----------------------------------------|
| Host_1 | Subnet_A | HTTPS | Allow |
| Host_2 | | | |
| ----------------------------------------|
ืคึฟืึทืจืงืขืจื, ืืื ืงืืืขืจื ืขืืขืก ืื ืคึฟืึทืจืฉืืืืขื ืข ืืึทืืขืืก ืืื podSelector ืึธืืขืจ namespaceSelector ืืขื ืขื ืงืึทืืืืื ื ืืื ืืึทืืืฉืืงืึทื AND. ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืื ืคืืืืขื ืืข ืืขืจืฉื ืืืขื ืืืืกืงืืืึทืื ืคึผืึธืืก ืืืึธืก ืืึธืื ืืืืืข ืืึทืืขืืก, role=db ะ version=v2:
podSelector:
matchLabels:
role: db
version: v2ืืขืจ ืืขืืืืงืขืจ ืืึธืืืง ืึทืคึผืืืื ืฆื ืึทืืข ืืืืคึผืก ืคืื ืึธืคึผืขืจืืืืขืจื: ืคึผืึธืืืืืง ืฆืื ืกืขืืขืงืืึธืจืก, ืคึผืึธื ืกืขืืขืงืืึธืจืก ืืื ื ืึทืืขืกืคึผืึทืกืข ืกืขืืขืงืืึธืจืก.
ืกืืื ืขืฅ ืืื IP ืึทืืจืขืกืขืก (IPBlocks)
ืคืืจืขืืืึทืืืก ื ืืฆื ืืืืึทื ื, IP ืึทืืจืขืกืขืก ืืื ืกืืื ืขืฅ ืฆื ืกืขืืืขื ื ืึท ื ืขืฅ.
ืืื Kubernetes, IP ืึทืืจืขืกืขืก ืืขื ืขื ืึทืกืืื ื ืฆื ืคึผืึธืืก ืืืืืึธืืึทืืืฉ ืืื ืงืขื ืขื ืึธืคื ืืืืฉื, ืึทืืื ืืึทืืขืืก ืืขื ืขื ืืขื ืืฆื ืฆื ืืืืกืงืืืึทืื ืคึผืึธืืก ืืื ื ืึธืืขื ืกืคึผืืืกืึทื ืืื ื ืขืฅ ืคึผืึทืืึทืกืื.
ืกืืื ืขืฅ (ipBlocks) ืืขื ืขื ืืขื ืืฆื ืืืขื ืึธื ืคืืจืื ื ืื ืงืึทืืื ื (ืื ืืจืขืกืก) ืึธืืขืจ ืึทืืืืึธืืื ื (ืืืจืขืกืก) ืคืื ืืจืืืกื ืืืง (ืฆืคืื-ืืจืื) ืงืึทื ืขืงืฉืึทื ื. ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืืขื ืคึผืึธืืืืืง ืึธืคึผืขื ืก ืฆื ืึทืืข ืคึผืึธืืก ืคืื ืื ื ืึทืืขืกืคึผืึทืกืข default ืึทืงืกืขืก ืฆื Google DNS ืืื ืกื:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: egress-dns
namespace: default
spec:
podSelector: {}
policyTypes:
- Egress
egress:
- to:
- ipBlock:
cidr: 8.8.8.8/32
ports:
- protocol: UDP
port: 53
ืื ืืืืืืง ืคึผืึธื ืกืขืืขืงืืึธืจ ืืื ืืขื ืืืึทืฉืคึผืื ืืืื "ืกืขืืขืงืืืจื ืึทืืข ืคึผืึธืืก ืืื ืื ื ืึทืืขืกืคึผืึทืกืข."
ืื ืคึผืึธืืืืืง ืึทืืึทืื ืืืืื ืึทืงืกืขืก ืฆื 8.8.8.8; ืึทืงืกืขืก ืฆื ืงืืื ืื ืืขืจืข IP ืืื ืคึผืจืึธืืืืืึทืืึทื. ืึทืืื, ืืื ืขืกืึทื ืก, ืืืจ ืืึธื ืืคืืขืฉืืขืื ืึทืงืกืขืก ืฆื ืื ืื ืขืจืืขื Kubernetes DNS ืืื ืกื. ืืืื ืืืจ ื ืึธื ืืืืื ืฆื ืขืคืขื ืขื ืขืก, ืึธื ืืืืึทืื ืืขื ืืคืืจืืฉ.
ืืืืฉืึทืืืึทืื ipBlocks ะธ podSelectors ืืขื ืขื ืืืืืฉืืึทืื ืืืกืฉืืืกืืง, ืืื ื ืื ืื ืขืจืืขื IP ืึทืืจืขืกืขืก ืคืื ืคึผืึธืืก ืืขื ืขื ื ืืฉื ืืขื ืืฆื ืืื ipBlocks. ืืืจื ืึธื ืืืืึทืื ืื ืขืจืืขื IP ืคึผืึธืืก, ืืืจ ืืืขื ืึทืงืฉืื ืืึธืื ืงืึทื ืขืงืฉืึทื ื ืฆื / ืคึฟืื ืคึผืึธืืก ืืื ืื ืึทืืจืขืกืขืก. ืืื ืคืืจ, ืืืจ ืืืขื ื ืืฉื ืืืืกื ืืืึธืก IP ืึทืืจืขืก ืฆื ื ืืฆื, ืืืึธืก ืืื ืืืึธืก ืืื ืืึธื ื ืืฉื ืืืื ืืขืืืืื ื ืฆื ืืืืกืงืืืึทืื ืคึผืึธืืก.
ืืื ืึท ืืึธืืืึทื ืง ืืืืฉืคึผืื, ืื ืคืืืืขื ืืข ืคึผืึธืืืืืง ืื ืงืืืื ืึทืืข IPs ืืื ืืขืจืืืขืจ ืึทืืึทืื ืึทืงืกืขืก ืฆื ืึทืืข ืื ืืขืจืข ืคึผืึธืืก:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: egress-any
namespace: default
spec:
podSelector: {}
policyTypes:
- Egress
egress:
- to:
- ipBlock:
cidr: 0.0.0.0/0
ืืืจ ืงืขื ื ืืืืื ืขืคึฟืขื ืขื ืึทืงืกืขืก ืฆื ืคืื ืืจืืืกื ืืืง IP, ืึทืืืฅ ืื ืื ืขืจืืขื IP ืึทืืจืขืกืขืก ืคืื ืคึผืึธืืก. ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืืืื ืืืื ืคึผืึธื ืก ืกืืื ืขื ืืื 10.16.0.0/14:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: egress-any
namespace: default
spec:
podSelector: {}
policyTypes:
- Egress
egress:
- to:
- ipBlock:
cidr: 0.0.0.0/0
except:
- 10.16.0.0/14
ืคึผืึธืจืฅ ืืื ืคึผืจืึธืืึธืงืึธืืก
ืืืคึผืืงืึทืืื, ืคึผืึธืืก ืืขืจื ืฆื ืืืื ืคึผืึธืจื. ืืขื ืืืื ืึทื ืืืจ ืงืขื ืขื ืคืฉืื ื ืืฉื ืกืคึผืขืฆืืคืืฆืืจื ืคึผืึธืจื ื ืืืขืจื ืืื ืคึผืึทืืึทืกืื ืืื ืืึธืื ืึทืืฅ ืืื ืคืขืืืงืืึทื. ืึธืืขืจ, ืขืก ืืื ืจืขืงืึทืืขื ืืื ืฆื ืืึทืื ืคึผืึทืืึทืกืื ืืื ืจืืกืืจืืงืืืื ืืื ืืขืืืขื, ืึทืืื ืืื ืขืืืขืืข ืงืึทืกืขืก ืืืจ ืงืขื ืขื ื ืึธื ืกืคึผืขืฆืืคืืฆืืจื ืคึผืึธืจืฅ:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default.postgres
namespace: default
spec:
ingress:
- from:
- podSelector:
matchLabels:
app: indexer
- podSelector:
matchLabels:
app: admin
ports: # <<<
- port: 443 # <<<
protocol: TCP # <<<
- port: 80 # <<<
protocol: TCP # <<<
podSelector:
matchLabels:
app: postgres
policyTypes:
- Ingress
ืืึทืืขืจืงืื ื ืึทื ืื ืกืขืืขืงืืึธืจ ports ืึทืคึผืืืื ืฆื ืึทืืข ืขืืขืืขื ืื ืืื ืืขื ืืืึธืง to ืึธืืขืจ from, ืืืึธืก ืึผืืื. ืฆื ืกืคึผืขืฆืืคืืฆืืจื ืคืึทืจืฉืืืขื ืข ืคึผืึธืจืฅ ืคึฟืึทืจ ืคืึทืจืฉืืืขื ืข ืกืขืฅ ืคืื ืขืืขืืขื ืื, ืฉืคึผืึทืืื ingress ืึธืืขืจ egress ืืื ืขืืืขืืข ืกืึทืืกืขืงืฉืึทื ื ืืื to ืึธืืขืจ from ืืื ืืื ืืขืืขืจ ืคืึทืจืฉืจืืึทืื ืืืื ืคึผืึธืจืฅ:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default.postgres
namespace: default
spec:
ingress:
- from:
- podSelector:
matchLabels:
app: indexer
ports: # <<<
- port: 443 # <<<
protocol: TCP # <<<
- from:
- podSelector:
matchLabels:
app: admin
ports: # <<<
- port: 80 # <<<
protocol: TCP # <<<
podSelector:
matchLabels:
app: postgres
policyTypes:
- Ingress
ืคืขืืืงืืึทื ืคึผืึธืจื ืึธืคึผืขืจืึทืฆืืข:
- ืืืื ืืืจ ืคืึทืจืืึธืื ืื ืคึผืึธืจื ืืขืคึฟืื ืืฆืืข ืืึธืจ (
ports), ืืึธืก ืืืื ืึทืืข ืคึผืจืึธืืึธืงืึธืืก ืืื ืึทืืข ืคึผืึธืจืฅ; - ืืืื ืืืจ ืคืึทืจืืึธืื ืื ืคึผืจืึธืืึธืงืึธื ืืขืคึฟืื ืืฆืืข (
protocol), ืืึธืก ืืืื TCP; - ืืืื ืืืจ ืคืึทืจืืึธืื ืื ืคึผืึธืจื ืืขืคึฟืื ืืฆืืข (
port), ืืึธืก ืืืื ืึทืืข ืคึผืึธืจืฅ.
ืืขืกืืขืจ ืคืืจ: ืื ืืืืกื ื ืืฉื ืคืึทืจืืึธืื ืืืืฃ ืคืขืืืงืืึทื ืืืึทืืืขืก, ืกืคึผืขืฆืืคืืฆืืจื ืืืึธืก ืืืจ ืืึทืจืคึฟื ืืคืืจืืฉ.
ืืืืข ืืึธื ืึทื ืืืจ ืืืื ื ืืฆื ืคึผืึธื ืคึผืึธืจืฅ, ื ืืฉื ืืื ืกื ืคึผืึธืจืฅ (ืืขืจ ืืืืฃ ืืขื ืืื ืืขืจ ืืืืึทืืขืจ ืคึผืึทืจืึทืืจืึทืฃ).
ืืขื ืขื ืคึผืึทืืึทืกืื ืืืคืืื ื ืคึฟืึทืจ ืคึผืึธืืก ืึธืืขืจ ืืึทืืื ืื ืืก?
ืืืคึผืืงืึทืืื, ืคึผืึธืืก ืืื Kubernetes ืึทืงืกืขืก ืืขืืขืจ ืื ืืขืจืข ืืืจื ืึท ืกืขืจืืืืก - ืึท ืืืืจืืืึทื ืืึทืกืข ืืึทืืึทื ืกืขืจ ืืืึธืก ืจืืืขืจืขืงืฅ ืคืึทืจืงืขืจ ืฆื ืื ืคึผืึธืืก ืืืึธืก ืื ืกืืจืืืขื ื ืื ืกืขืจืืืืก. ืืืจ ืงืขื ืืจืึทืืื ืึทื ื ืขืฅ ืคึผืึทืืึทืกืื ืงืึธื ืืจืึธืืืจื ืึทืงืกืขืก ืฆื ืืึทืืื ืื ืืก, ืึธืืขืจ ืืึธืก ืืื ื ืืฉื ืืขืจ ืคืึทื. Kubernetes ื ืขืฅ ืคึผืึทืืึทืกืื ืึทืจืืขื ืืืืฃ ืคึผืึธื ืคึผืึธืจืฅ, ื ืืฉื ืกืขืจืืืืก ืคึผืึธืจืฅ.
ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืืืื ืึท ืืื ืกื ืืืกืึทื ื ืฆื ืคึผืึธืจื 80, ืึธืืขืจ ืจืืืขืจืขืงืฅ ืคืึทืจืงืขืจ ืฆื ืคึผืึธืจื 8080 ืคืื ืืืึทื ืคึผืึธืืก, ืืืจ ืืืื ืกืคึผืขืฆืืคืืฆืืจื ืคึผืื ืงื 8080 ืืื ืื ื ืขืฅ ืคึผืึธืืืืืง.
ืึทืืึท ืึท ืืขืงืึทื ืืืึทื ืืึธื ืืืื ืืขืจืขืื ื ืืื ืกืืืึธืคึผืืืืึทื: ืืืื ืื ืื ืขืจืืขื ืกืืจืืงืืืจ ืคืื ืื ืกืขืจืืืืก (ืื ืคึผืึธืจืฅ ืคืื ืืืึธืก ืคึผืึธืืก ืืขืจื) ืขื ืืขืจืื ืืขื, ืื ื ืขืฅ ืคึผืึทืืึทืกืื ืืืขื ืืืื ืืขืจืืืึทื ืืืงื.
ื ืื ืึทืจืงืึทืืขืงืืฉืขืจืึทื ืฆืืืึทื ื ื ืืฆื ืกืขืจืืืืก ืืขืฉ (ืืืฉื, ืืขื ืืืขืื Istio ืืื ืื - ืืขืขืจืขื ืืืืขืจืืขืฆืื ื) ืึทืืึทืื ืืืจ ืฆื ืงืึธืคึผืข ืืื ืืขื ืคึผืจืึธืืืขื.
ืืื ืขืก ื ืืืืืง ืฆื ืจืขืืืกืืจืืจื ืืืืืข ืื ืืจืขืกืก ืืื ืขืืจืขืกืก?
ืืขืจ ืงืืจืฅ ืขื ืืคึฟืขืจ ืืื ืืึธ, ืึผืื ืคึผืึธื ื ืืึธื ืงืขื ืขื ืืืขืจืืขืื ืืื ืคึผืึธื ื, ืขืก ืืืื ืืืื ืขืจืืืืื ืฆื ืฉืึทืคึฟื ืึท ืึทืืืืึธืืื ื ืคึฟืึทืจืืื ืืื ื (ืคึฟืึทืจ ืืขื ืืืจ ืืึทืจืคึฟื ืฆื ืงืึทื ืคืืืืขืจ ืึทื ืขืืจืขืกืก ืคึผืึธืืืืืง), ืืื ืคึผืึธื ื ืืืื ืงืขื ืขื ืึธื ื ืขืืขื ืึท ืื ืงืึทืืื ื ืงืฉืจ ( ืคึฟืึทืจ ืืขื, ืึทืงืึธืจืืื ืืื, ืืืจ ืืึทืจืคึฟื ืึทื ืื ืืจืขืกืก ืคึผืึธืืืืืง).
ืึธืืขืจ, ืืื ืคืืจ, ืืืจ ืงืขื ืขื ืคืึทืจืืึธืื ืืืืฃ ืื ืคืขืืืงืืึทื ืคึผืึธืืืืืง ืฆื ืืึธืื ืงืึทื ืขืงืฉืึทื ื ืืื ืืืื ืึธืืขืจ ืืืืืข ืืื ืกืืจืืงืฆืืขืก.
ืืืื ืขืืืขืืข ืคึผืึธื-ืืึธืงืขืจ ืืืขื ืืืื ืืืืกืืขืงืืืื ืืืจื ืืืื ืขืจ ืึธืืขืจ ืืขืจ ืึทืจืืืกืืึทื ื-ืคึผืึทืืึทืืืฉืึทื ื, ืื ืจืืกืืจืืงืฉืึทื ื ืืืคึผืึธืืื ืืืืฃ ืขืก ืืืขื ืืืื ืืืฉืืืกื ืืืจื ืืืืขืจ ืืืืืฉืึทื ืืงืฉืึทื. ืืื ืืขื ืคืึทื, ืืืจ ืืืขื ืืึทืจืคึฟื ืฆื ืืคืืจืืฉ ืืึธืื ืงืฉืจ ืฆื ืื ืคึผืึธื -ืึทืืจืขืกื. ืืืื ืึท ืคึผืึธื ืืื ื ืืฉื ืืืืกืืขืงืืืื ืืืจื ืงืืื ืคึผืึธืืืืืง, ืืืื ืึทืืืืึธืืื ื (ืืืจืขืก) ืคืึทืจืงืขืจ ืืื ืขืจืืืืื ืืืจื ืคืขืืืงืืึทื.
ืกืืืืืึทืจืื, ืืขืจ ืืืจื ืคืื ืื ืคึผืึธื ืืืืึทืืจืขืกืืจื, ืืืืกืืขืงืืืื ืืืจื ืืืื ืขืจ ืึธืืขืจ ืืขืจ ืื ืืจืืืฉืึทืโ ืคืืืืืืงืขืจ , ืฐืขื ื ืืืฉืืืก ื ืฐืขืจ ื ืืืจ ื ืืฒืข ืจ ืืืกืืืฉืื ืงืฆืืข . ืืื ืืขื ืคืึทื, ืืืจ ืืืื ืืคืืจืืฉ ืืึธืื ืขืก ืืึทืงืืืขื ืคืึทืจืงืขืจ ืคืื ืื ืืงืืจ ืคึผืึธื. ืืืื ืึท ืคึผืึธื ืืื ื ืืฉื ืืืืกืืขืงืืืื ืืืจื ืงืืื ืคึผืึธืืืืืง, ืึทืืข ืื ืืจืขืกืก ืคืึทืจืงืขืจ ืคึฟืึทืจ ืขืก ืืื ืขืจืืืืื ืืืจื ืคืขืืืงืืึทื.
ืืขื ืกืืืืืคืื ืึธืืขืจ ืกืืืืืืขืกืก ืืื ืื.
ืืึธืืก
Kubernetes ื ืขืฅ ืคึผืึทืืึทืกืื ืงืขื ืขื ื ืืฉื ืงืืึธืฅ ืคืึทืจืงืขืจ. ืืึธืก ืืืื ืขืก ืฉืืืขืจ ืฆื ืืึทืฉืืืกื ืฆื ืึท ืคึผืึธืืืืืง ืึทืจืืขื ืืื ืืืขื ืืื ืืืืขืจ ืงืึทืืคึผืืืงืืืฅ ืืืืขืจืืืื ืึทื ืึทืืืกืืก.
ืงืึธื ืืจืึธื ืคืื ืคืึทืจืงืขืจ ืฆื ืคืื ืืจืืืกื ืืืง ืืึทืืื ืื ืืก
Kubernetes ื ืขืฅ ืคึผืึทืืึทืกืื ืืึธื ื ืื ืืึธืื ืืืจ ืฆื ืกืคึผืขืฆืืคืืฆืืจื ืึท ืืึธืจ ืงืืืึทืืึทืคืืื ืคืขืื ื ืึธืืขื (ืื ืก) ืืื ืขืืจืขืกืก ืกืขืงืฉืึทื ื. ืืขืจ ืคืึทืงื ืคืืจื ืฆื ืืึทืืืืืืง ืื ืงืึทื ืืืื ืืึทื ืก ืืืขื ืืืจ ืคึผืจืืืืจื ืฆื ืืึทืืจืขื ืขืฆื ืคืึทืจืงืขืจ ืฆื ืคืื ืืจืืืกื ืืืง ืืขืกืืึทื ืืืฉืึทื ื ืืืึธืก ืืึธื ื ืื ืืึธืื ืึท ืคืึทืจืคืขืกืืืงื IP ืึทืืจืขืก (ืึทืืึท ืืื aws.com).
ืคึผืึธืืืืืง ืืฉืขืง
ืคืืจืขืืืึทืืืก ืืืขื ืืืึธืจืขื ืขื ืืืจ ืึธืืขืจ ืืคืืื ืึธืคึผืืึธืื ืฆื ืึธื ื ืขืืขื ืื ืคืึทืืฉ ืคึผืึธืืืืืง. Kubernetes ืืืื ืืื ืขืืืขืืข ืืืขืจืึทืคืึทืงืืืฉืึทื. ืืืขื ืืึทืฉืืขืืืงื ืึท ื ืขืฅ ืคึผืึธืืืืืง ืืืจื kubectl, Kubernetes ืงืขื ืืขืจืงืืขืจื ืึทื ืขืก ืืื ืคืึทืืฉ ืืื ืึธืคึผืืึธืื ืฆื ืึธื ื ืขืืขื ืขืก. ืืื ืื ืืขืจืข ืงืึทืกืขืก, Kubernetes ืืืขื ื ืขืืขื ืื ืคึผืึธืืืืืง ืืื ืคึผืืึธืืืืจื ืขืก ืืื ืื ืคืขืื ืืืง ืืขืืึทืืืก. ืืื ืงืขื ืขื ืืืื ืืขืืขื ืืื ืืขื ืืึทืคึฟืขื:
kubernetes get networkpolicy <policy-name> -o yamlืืึทืืื ืืื ืืืื ืื ื ืึทื ืื Kubernetes ืืืึทืืึทืืืืฉืึทื ืกืืกืืขื ืืื ื ืืฉื ืื ืคืึทืืึทืืึทื ืืื ืงืขื ืคืึทืจืคืืจื ืขืืืขืืข ืืืืคึผืก ืคืื ืขืจืจืึธืจืก.
ืืืจืืคืืจืื ื
Kubernetes ืืื ื ืืฉื ืื ืกืืจืืืขื ื ื ืขืฅ ืคึผืึทืืึทืกืื ืืื, ืึธืืขืจ ืืื ืืืืื ืึทื ืึทืคึผื ืืืืืืืื ืืืึธืก ืืขืืึทืืืืฅ ืื ืืึทืกืข ืคืื โโืงืึธื ืืจืึธื ืฆื ืึท ืึทื ืืขืจืืืืื ื ืกืืกืืขื ืืขืจืืคื ืื ืงืึทื ืืืื ืขืจ ื ืขืืืืึธืจืงืื ื ืฆืืืื ื (CNI). ืืึทืฉืืขืืืงื ืคึผืึทืืึทืกืื ืืืืฃ ืึท Kubernetes ืงื ืืื ืึธื ืึทืกืืื ืื ื ืื ืฆืื ืขืืขื CNI ืืื ืื ืืขืืืข ืืื ืงืจืืืืืื ื ืคึผืึทืืึทืกืื ืืืืฃ ืึท ืคืืืจืืืึทื ืคืึทืจืืืึทืืืื ื ืกืขืจืืืขืจ ืึธื ืื ืกืืึธืืื ื ืืื ืืืืฃ ืคืืจืขืืืึทืืืก. ืขืก ืืื ืึทืจืืืฃ ืฆื ืืืจ ืฆื ืขื ืฉืืจ ืืืจ ืืึธืื ืึท ืืืึทืืืฉ CNI ืึธืืขืจ, ืืื ืื ืคืึทื ืคืื Kubernetes ืคึผืืึทืืคืึธืจืืก, ืืึธืืกืืื ืืื ืื ืืืึธืืงื (ืืืจ ืงืขื ื ืืขื ืื ืจืฉืืื ืคืื ืคึผืจืึทืืืืืืขืจื โ ืืขืขืจืขื. ืืจืึทื ืก.), ืืขืื ื ืขืฅ ืคึผืึทืืึทืกืื ืืืึธืก ืืืขื ืฉืืขืื CNI ืคึฟืึทืจ ืืืจ.
ืืึทืืขืจืงืื ื ืึทื Kubernetes ืืืขื ื ืืฉื ืืืึธืจืขื ืขื ืืืจ ืืืื ืืืจ ืฉืืขืื ืึท ื ืขืฅ ืคึผืึธืืืืืง ืึธื ืื ืฆืื ืขืืขื ืืขืืคืขืจ CNI.
ืกืืขืืืคืื ืึธืืขืจ ืกืืขืืืืขืกืก?
ืึทืืข ืงืืืขืจื ืขืืขืก CNIs ืืืึธืก ืืื ืืึธืื ืืขืคึผืืึธื ืืขืจื ืืขื ืขื ืกืืึทืืขืคืื (ืืืฉื, Calico ื ืืฆื ืืื ืืงืก ืงืึธื ืืจืึทืงืง). ืืึธืก ืึทืืึทืื ืื ืคึผืึธื ืฆื ืืึทืงืืืขื ืจืขืกืคึผืึธื ืกืขืก ืืืืฃ ืื TCP ืคึฟืึทืจืืื ืืื ื ืืืึธืก ืขืก ืื ืืฉืืืืืื ืึธื ืืืจ ืืึทืจืคึฟื ืฆื ืฉืืึทืขื-ืคืึทืจืืืืื ืขืก. ืึธืืขืจ, ืืื ืืื ื ืืฉื ืึทืืืขืจ ืคืื ืึท Kubernetes ื ืึธืจืืึทื ืืืึธืก ืืืึธืื ืืึทืจืึทื ืืืจื ืกืืืืืคืืื ืขืกืก.
ืึทืืืึทื ืกืืจืืข ืืืืขืจืืืึทื ืคึผืึธืืืืืง ืืึทื ืึทืืขืืขื ื
ืืึธ ืืขื ืขื ืขืืืขืืข ืืืขืื ืฆื ืคึฟืึทืจืืขืกืขืจื ืืืืขืจืืืื ืคึผืึธืืืืืง ืขื ืคืึธืจืกืืึทื ื ืืื Kubernetes:
- ืื ืกืขืจืืืืก ืืขืฉ ืึทืจืงืึทืืขืงืืฉืขืจืึทื ืืืกืืขืจ ื ืืฆื ืกืืืืงืึทืจ ืงืึทื ืืืื ืขืจื ืฆื ืฆืืฉืืขืื ืืืืืืื ืืขืืขืืขืืจื ืืื ืคืึทืจืงืขืจ ืงืึธื ืืจืึธื ืืืืฃ ืื ืกืขืจืืืืก ืืืจืื. ืืื ืึท ืืืึทืฉืคึผืื ืืืจ ืงืขื ืขื ื ืขืืขื .
- ืขืืืขืืข ืคืื โโืื CNI ืืืขื ืืึธืจืก ืืึธืื ืขืงืกืืขื ืืขื ืืืืขืจ ืืืฉืืจืื ืฆื ืืืื ืืืืึทืืขืจ ืคืื Kubernetes ื ืขืฅ ืคึผืึทืืึทืกืื.
- ืคึผืจืึธืืืืืขืก ืืืืืึทืืืืืื ืืื ืึธืืึทืืืืฉืึทื ืคืื Kubernetes ื ืขืฅ ืคึผืึทืืึทืกืื.
ืื Tufin Orca ืคึผืขืงื ืืึทื ืืืืฉืื Kubernetes ื ืขืฅ ืคึผืึทืืึทืกืื (ืืื ืืื ืืขืจ ืืงืืจ ืคืื ืื ืกืงืจืขืขื ืฉืึธืฅ ืืืืื).
ื ืึธื ืืื ืคึฟืึธืจืืึทืฆืืข
- ;
- ;
- ;
- .
ืกืึธืฃ
Kubernetes ื ืขืฅ ืคึผืึทืืึทืกืื ืคืึธืจืฉืืึธืื ืึท ืืื ืืึทื ื ืคืื ืืืฉืืจืื ืคึฟืึทืจ ืกืขืืืขื ืืื ื ืงืืึทืกืืขืจื, ืึธืืขืจ ืืื ืืขื ืขื ื ืืฉื ืื ืืืึทืืืื ืืื ืืึธืื ืคืืืข ืกืึทืืึทืืืื. ืืืืึทื ืคืื ืืขื ืงืึทืืคึผืืขืงืกืืื, ืืื ืืืืืื ืคืืืข ืืืืืกืืื ื ืงื ืืื ืคึผืึทืืึทืกืื ืืขื ืขื ืืืึธืื. ืืขืืืขื ืกืึทืืืฉืึทื ื ืฆื ืืขื ืคึผืจืึธืืืขื ืึทืจืืึทื ื ืขืืขื ืึธืืึทืืืืืื ื ืคึผืึธืืืืืง ืืขืคึฟืื ืืฆืืข ืึธืืขืจ ื ืืฆื ืื ืืขืจืข ืกืขืืืึทื ืืืืฉืึทื ืืืฉืืจืื.
ืืื ืืึธืคึฟื ืึทื ืืขืจ ืคืืจืขืจ ืืขืืคึผืก ืืืกืืขืงื ืขืืืขืืข ืคืจืืืขืก ืืื ืกืึธืืืืข ืืฉืื ืืืึธืก ืืืจ ืงืขื ืืจืขืคื.
ืคึผืก ืคืื ืืืืขืจืืขืฆืขืจ
ืืืืขื ืขื ืืืื ืืืืฃ ืืื ืืืขืจ ืืืึธื:
- "ืฆืืจืืง ืฆื ืืืงืจืึธืกืขืจืืืืกืขืก ืืื Istio": , , ;
- "ืึทื ืืืืืกืืจืึทืืขื ืืืื ืฆื ื ืขืืืืึธืจืงืื ื ืืื ืงืืืขืจื ืขืืขืก": , ;
- ยซ";
- ยซ";
- ยซ'.
ืืงืืจ: www.habr.com