Network Policy-5 minutes a day to play Docker container technology (171)

Source: Internet
Author: User
Tags k8s

Network Policy is a resource for Kubernetes. Network Policy selects the pod by Label and specifies how other pods or outsiders communicate with these pods.

By default, all pods are non-isolated, meaning that network traffic from any source can access the pod without any restrictions. When Network policy is defined for a pod, only traffic allowed by Policy can access the pod.

However, not all Kubernetes networking scenarios Support network Policy. For example, flannel is not supported, Calico is supported. We will then use Canal to demonstrate Network Policy. Canal This open source project is very interesting, it uses flannel realization Kubernetes cluster network, at the same time uses Calico realizes network Policy.

Deploy Canal

Deploying the Canal is very similar to deploying other Kubernetes network scenarios, kubeadm init After initializing the Kubernetes cluster kubectl apply Install the appropriate network scenario. In other words, there is no good way to switch directly to a different network scenario, and you can basically recreate the cluster.

The simplest way to destroy the current cluster is to execute kubeadm reset it on each node . You can then initialize the cluster as we did in the "Initializing Master" section of the "Deploying Kubernetes Cluster" chapter earlier.

Kubeadm Init--apiserver-advertise-address 192.168.56.105--pod-network-cidr=10.244.0.0/16

then follow the documentation https://kubernetes.io/docs/setup/independent/create-cluster-kubeadm/ install Canal. The documentation lists the installation methods for various network scenarios:

Execute the following command to deploy Canal

Kubectl apply-f Https://raw.githubusercontent.com/projectcalico/canal/master/k8s-install/1.7/rbac.yaml
Kubectl apply-f Https://raw.githubusercontent.com/projectcalico/canal/master/k8s-install/1.7/canal.yaml

After successful deployment, you can view the Canal related components:

canal deployed to each node as Daemonset, which belongs to   kube-system   This Namespace

Canal is ready and we will practice Network Policy in the next section.

Books:

1. "5 minutes a day kubernetes"
Https://item.jd.com/26225745440.html

2.5 minutes of Docker container technology per day
Https://item.jd.com/16936307278.html

3.5 minutes of play with OpenStack per day
Https://item.jd.com/12086376.html

Network Policy-5 minutes a day to play Docker container technology (171)

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.