Network Policy is a resource for Kubernetes. Network Policy selects the pod by Label and specifies how other pods or outsiders communicate with these pods.
By default, all pods are non-isolated, meaning that network traffic from any source can access the pod without any restrictions. When Network policy is defined for a pod, only traffic allowed by Policy can access the pod.
However, not all Kubernetes networking scenarios Support network Policy. For example, flannel is not supported, Calico is supported. We will then use Canal to demonstrate Network Policy. Canal This open source project is very interesting, it uses flannel realization Kubernetes cluster network, at the same time uses Calico realizes network Policy.
Deploy Canal
Deploying the Canal is very similar to deploying other Kubernetes network scenarios, kubeadm init
After initializing the Kubernetes cluster kubectl apply
Install the appropriate network scenario. In other words, there is no good way to switch directly to a different network scenario, and you can basically recreate the cluster.
The simplest way to destroy the current cluster is to execute kubeadm reset
it on each node . You can then initialize the cluster as we did in the "Initializing Master" section of the "Deploying Kubernetes Cluster" chapter earlier.
Kubeadm Init--apiserver-advertise-address 192.168.56.105--pod-network-cidr=10.244.0.0/16
then follow the documentation https://kubernetes.io/docs/setup/independent/create-cluster-kubeadm/ install Canal. The documentation lists the installation methods for various network scenarios:
Execute the following command to deploy Canal
Kubectl apply-f Https://raw.githubusercontent.com/projectcalico/canal/master/k8s-install/1.7/rbac.yaml
Kubectl apply-f Https://raw.githubusercontent.com/projectcalico/canal/master/k8s-install/1.7/canal.yaml
After successful deployment, you can view the Canal related components:
canal deployed to each node as Daemonset, which belongs to kube-system
This Namespace
Canal is ready and we will practice Network Policy in the next section.
Books:
1. "5 minutes a day kubernetes"
Https://item.jd.com/26225745440.html
2.5 minutes of Docker container technology per day
Https://item.jd.com/16936307278.html
3.5 minutes of play with OpenStack per day
Https://item.jd.com/12086376.html
Network Policy-5 minutes a day to play Docker container technology (171)