Translate into chinese about NetworkPolicy
This commit is contained in:
chentao1596
parent
1696664888
commit
4d6e4604dd
|
|
@ -0,0 +1,74 @@
|
|||
---
|
||||
approvers:
|
||||
- caseydavenport
|
||||
title: 使用 Calico 来提供 NetworkPolicy
|
||||
---
|
||||
|
||||
|
||||
{% capture overview %}
|
||||
本页展示怎么样使用 Calico 来提供 NetworkPolicy
|
||||
{% endcapture %}
|
||||
|
||||
|
||||
{% capture prerequisites %}
|
||||
* 为 Kubernetes 安装 Calico
|
||||
{% endcapture %}
|
||||
|
||||
{% capture steps %}
|
||||
|
||||
## 使用 Calico 部署一个集群
|
||||
|
||||
|
||||
使用如下命令，您可以在默认的 [GCE 部署环境中](/docs/getting-started-guides/gce) 部署一个使用 Calico 来提供网络策略的集群：
|
||||
|
||||
```shell
|
||||
export NETWORK_POLICY_PROVIDER=calico
|
||||
export KUBE_NODE_OS_DISTRIBUTION=debian
|
||||
curl -sS https://get.k8s.io | bash
|
||||
```
|
||||
|
||||
|
||||
如果希望了解其它的部署选项，请您参考 [Calico 项目文档](http://docs.projectcalico.org/)
|
||||
{% endcapture %}
|
||||
|
||||
{% capture discussion %}
|
||||
|
||||
## 理解 Calico 组件
|
||||
|
||||
|
||||
部署使用 Calico 的集群其实是增加了支持 Kubernetes NetworkPolicy 的 Pods， 这些 Pods 运行在 `kube-system` 命名空间下。
|
||||
|
||||
|
||||
使用如下方式去查看这些运行的 Pods：
|
||||
|
||||
```shell
|
||||
kubectl get pods --namespace=kube-system
|
||||
```
|
||||
|
||||
|
||||
您可以看到类似下面这样的一个 Pods 列表：
|
||||
|
||||
```console
|
||||
NAME READY STATUS RESTARTS AGE
|
||||
calico-node-kubernetes-minion-group-jck6 1/1 Running 0 46m
|
||||
calico-node-kubernetes-minion-group-k9jy 1/1 Running 0 46m
|
||||
calico-node-kubernetes-minion-group-szgr 1/1 Running 0 46m
|
||||
calico-policy-controller-65rw1 1/1 Running 0 46m
|
||||
...
|
||||
```
|
||||
|
||||
|
||||
主要有两种组件
|
||||
|
||||
|
||||
- 在集群的每个节点上都会运行一个以 `calico-node` 开头命名的 Pod，用于配置 iptables 去实现那些机器上 Pods 的出/入网络策略
|
||||
|
||||
- 整个集群环境只有一个以 `calico-policy-controller` 开头命名的 Pod，用于从 Kubernetes API 中读取策略和标签信息，适当的对 Calico 进行配置
|
||||
{% endcapture %}
|
||||
|
||||
|
||||
{% capture whatsnext %}
|
||||
集群部署完成之后，您可以通过 [NetworkPolicy 入门指南](/docs/getting-started-guides/network-policy/walkthrough)去尝试使用 Kubernetes NetworkPolicy
|
||||
{% endcapture %}
|
||||
|
||||
{% include templates/task.md %}
|
||||
|
|
@ -0,0 +1,147 @@
|
|||
---
|
||||
approvers:
|
||||
- caseydavenport
|
||||
- danwinship
|
||||
title: 声明网络策略
|
||||
---
|
||||
|
||||
{% capture overview %}
|
||||
|
||||
|
||||
本文可以帮助您开始使用 Kubernetes 的 [NetworkPolicy API](/docs/concepts/services-networking/network-policies/) 声明网络策略去管理 Pod 之间的通信
|
||||
|
||||
{% endcapture %}
|
||||
|
||||
{% capture prerequisites %}
|
||||
|
||||
|
||||
您首先需要有一个支持网络策略的 Kubernetes 集群。已经有许多支持 NetworkPolicy 的网络提供商，包括：
|
||||
|
||||
* [Calico](/docs/tasks/configure-pod-container/calico-network-policy/)
|
||||
* [Romana](/docs/tasks/configure-pod-container/romana-network-policy/)
|
||||
* [Weave 网络](/docs/tasks/configure-pod-container/weave-network-policy/)
|
||||
|
||||
|
||||
**注意**：以上列表是根据产品名称按字母顺序排序，而不是按推荐或偏好排序。下面示例对于使用了上面任何提供商的 Kubernetes 集群都是有效的
|
||||
|
||||
{% endcapture %}
|
||||
|
||||
{% capture steps %}
|
||||
|
||||
|
||||
## 创建一个`nginx` deployment 并且通过服务将其暴露
|
||||
|
||||
|
||||
为了查看 Kubernetes 网络策略是怎样工作的，可以从创建一个`nginx` deployment 并且通过服务将其暴露开始
|
||||
|
||||
```console
|
||||
$ kubectl run nginx --image=nginx --replicas=2
|
||||
deployment "nginx" created
|
||||
$ kubectl expose deployment nginx --port=80
|
||||
service "nginx" exposed
|
||||
```
|
||||
|
||||
|
||||
在 default 命名空间下运行了两个 `nginx` pod，而且通过一个名字为 `nginx` 的服务进行了暴露
|
||||
|
||||
```console
|
||||
$ kubectl get svc,pod
|
||||
NAME CLUSTER-IP EXTERNAL-IP PORT(S) AGE
|
||||
svc/kubernetes 10.100.0.1 <none> 443/TCP 46m
|
||||
svc/nginx 10.100.0.16 <none> 80/TCP 33s
|
||||
|
||||
NAME READY STATUS RESTARTS AGE
|
||||
po/nginx-701339712-e0qfq 1/1 Running 0 35s
|
||||
po/nginx-701339712-o00ef 1/1 Running 0 35s
|
||||
```
|
||||
|
||||
|
||||
## 测试服务能够被其它的 pod 访问
|
||||
|
||||
|
||||
您应该可以从其它的 pod 访问这个新的 `nginx` 服务。为了验证它，从 default 命名空间下的其它 pod 来访问该服务。请您确保在该命名空间下没有执行孤立动作。
|
||||
|
||||
|
||||
启动一个 busybox 容器，然后在容器中使用 `wget` 命令去访问 `nginx` 服务：
|
||||
|
||||
```console
|
||||
$ kubectl run busybox --rm -ti --image=busybox /bin/sh
|
||||
Waiting for pod default/busybox-472357175-y0m47 to be running, status is Pending, pod ready: false
|
||||
|
||||
Hit enter for command prompt
|
||||
|
||||
/ # wget --spider --timeout=1 nginx
|
||||
Connecting to nginx (10.100.0.16:80)
|
||||
/ #
|
||||
```
|
||||
|
||||
|
||||
## 限制访问 `nginx` 服务
|
||||
|
||||
|
||||
如果说您想限制 `nginx` 服务，只让那些拥有标签 `access: true` 的 pod 访问它，那么您可以创建一个只允许从那些 pod 连接的 `NetworkPolicy`：
|
||||
|
||||
```yaml
|
||||
kind: NetworkPolicy
|
||||
apiVersion: networking.k8s.io/v1
|
||||
metadata:
|
||||
name: access-nginx
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
run: nginx
|
||||
ingress:
|
||||
- from:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
access: "true"
|
||||
```
|
||||
|
||||
|
||||
## 为服务指定策略
|
||||
|
||||
|
||||
使用 kubectl 工具根据上面的 nginx-policy.yaml 文件创建一个 NetworkPolicy：
|
||||
|
||||
```console
|
||||
$ kubectl create -f nginx-policy.yaml
|
||||
networkpolicy "access-nginx" created
|
||||
```
|
||||
|
||||
|
||||
## 当访问标签没有定义时测试访问服务
|
||||
|
||||
|
||||
如果您尝试从没有设定正确标签的 pod 中去访问 `nginx` 服务，请求将会超时：
|
||||
|
||||
```console
|
||||
$ kubectl run busybox --rm -ti --image=busybox /bin/sh
|
||||
Waiting for pod default/busybox-472357175-y0m47 to be running, status is Pending, pod ready: false
|
||||
|
||||
Hit enter for command prompt
|
||||
|
||||
/ # wget --spider --timeout=1 nginx
|
||||
Connecting to nginx (10.100.0.16:80)
|
||||
wget: download timed out
|
||||
/ #
|
||||
```
|
||||
|
||||
|
||||
## 定义访问标签后再次测试
|
||||
|
||||
|
||||
创建一个拥有正确标签的 pod，您将看到请求是被允许的：
|
||||
|
||||
```console
|
||||
$ kubectl run busybox --rm -ti --labels="access=true" --image=busybox /bin/sh
|
||||
Waiting for pod default/busybox-472357175-y0m47 to be running, status is Pending, pod ready: false
|
||||
|
||||
Hit enter for command prompt
|
||||
|
||||
/ # wget --spider --timeout=1 nginx
|
||||
Connecting to nginx (10.100.0.16:80)
|
||||
/ #
|
||||
```
|
||||
{% endcapture %}
|
||||
|
||||
{% include templates/task.md %}
|
||||
|
|
@ -0,0 +1,50 @@
|
|||
---
|
||||
approvers:
|
||||
- chrismarino
|
||||
title: 使用 Romana 来提供 NetworkPolicy
|
||||
---
|
||||
|
||||
{% capture overview %}
|
||||
|
||||
|
||||
本页展示怎么样使用 Romana 来提供 NetworkPolicy
|
||||
|
||||
{% endcapture %}
|
||||
|
||||
{% capture prerequisites %}
|
||||
|
||||
|
||||
完成 [kubeadm 入门指南](/docs/getting-started-guides/kubeadm/)中的步骤1、2和3
|
||||
|
||||
{% endcapture %}
|
||||
|
||||
{% capture steps %}
|
||||
|
||||
|
||||
## 使用 kubeadm 安装 Romana
|
||||
|
||||
|
||||
按照[容器化安装指南](https://github.com/romana/romana/tree/master/containerize)中使用 kubeadm 的方式安装
|
||||
|
||||
|
||||
## 应用网络策略
|
||||
|
||||
|
||||
要应用网络策略，请使用以下方式之一：
|
||||
|
||||
|
||||
* [Romana 网络策略](https://github.com/romana/romana/wiki/Romana-policies)
|
||||
* [Romana 网络策略示例](https://github.com/romana/core/tree/master/policy)
|
||||
|
||||
* NetworkPolicy API
|
||||
|
||||
{% endcapture %}
|
||||
|
||||
{% capture whatsnext %}
|
||||
|
||||
|
||||
Romana 安装完成之后，您可以通过 [NetworkPolicy 入门指南](/docs/getting-started-guides/network-policy/walkthrough)去尝试使用 Kubernetes NetworkPolicy
|
||||
|
||||
{% endcapture %}
|
||||
|
||||
{% include templates/task.md %}
|
||||
|
|
@ -0,0 +1,118 @@
|
|||
---
|
||||
approvers:
|
||||
- bboreham
|
||||
title: 使用 Weave 网络来提供 NetworkPolicy
|
||||
---
|
||||
|
||||
{% capture overview %}
|
||||
|
||||
|
||||
本页展示怎么样使用 Weave 网络来提供 NetworkPolicy
|
||||
|
||||
{% endcapture %}
|
||||
|
||||
{% capture prerequisites %}
|
||||
|
||||
|
||||
完成 [kubeadm 入门指南](/docs/getting-started-guides/kubeadm/)中的步骤1、2和3
|
||||
|
||||
{% endcapture %}
|
||||
|
||||
{% capture steps %}
|
||||
|
||||
|
||||
## 安装 Weave 网络插件
|
||||
|
||||
|
||||
按照[通过插件方式集成到 Kubernetes ](https://www.weave.works/docs/net/latest/kube-addon/)指南完成安装
|
||||
|
||||
|
||||
Kubernetes 的 Weave 网络插件配有一个[网络策略控制器](https://www.weave.works/docs/net/latest/kube-addon/#npc)，它监控所有命名空间下 NetworkPolicy 相关的注解，然后配置 iptables 规则生成允许或者阻断通信的策略
|
||||
|
||||
{% endcapture %}
|
||||
|
||||
{% capture example %}
|
||||
|
||||
|
||||
## 命名空间隔离示例
|
||||
|
||||
|
||||
1. 创建携带 `DefaultDeny` 标识的命名空间
|
||||
|
||||
```yaml
|
||||
kind: Namespace
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: myns
|
||||
annotations:
|
||||
net.beta.kubernetes.io/network-policy: |
|
||||
{
|
||||
"ingress": {
|
||||
"isolation": "DefaultDeny"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
|
||||
2. 在命名空间下创建2个 pod
|
||||
|
||||
```yaml
|
||||
kind: Pod
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: pod1
|
||||
namespace: myns
|
||||
labels:
|
||||
inns: "yes"
|
||||
spec:
|
||||
containers:
|
||||
- name: pod1
|
||||
image: nginx
|
||||
---
|
||||
kind: Pod
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: pod2
|
||||
namespace: myns
|
||||
labels:
|
||||
inns: "yes"
|
||||
spec:
|
||||
containers:
|
||||
- name: pod2
|
||||
image: nginx
|
||||
```
|
||||
|
||||
|
||||
3. 获取 pod 的 IP 地址
|
||||
|
||||
```shell
|
||||
kubectl get po -n myns -o wide
|
||||
```
|
||||
|
||||
**注意：** 如果您对 pod 的 cURL 请求是被禁止的，请尝试在 pod 中访问其它的 pod
|
||||
|
||||
|
||||
4. 创建一个允许 pod 访问命名空间内其它 pod 的 Kubernetes NetworkPolicy
|
||||
|
||||
```yaml
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: aaa
|
||||
namespace: myns
|
||||
spec:
|
||||
podSelector:
|
||||
matchExpressions:
|
||||
- {key: inns, operator: In, values: ["yes"]}
|
||||
ingress:
|
||||
- from:
|
||||
- podSelector:
|
||||
matchExpressions:
|
||||
- {key: inns, operator: In, values: ["yes"]}
|
||||
```
|
||||
|
||||
Weave 网络插件安装完成之后，您可以通过 [NetworkPolicy 入门指南](/docs/getting-started-guides/network-policy/walkthrough)去尝试使用 Kubernetes NetworkPolicy
|
||||
|
||||
{% endcapture %}
|
||||
|
||||
{% include templates/task.md %}
|
||||
Loading…
Reference in New Issue