Network Policy-5 minutes a day to play Docker container technology (171)

Network Policy is a resource for Kubernetes. Network Policy selects the pod by Label and specifies how other pods or outsiders communicate with these pods.

By default, all pods are non-isolated, meaning that network traffic from any source can access the pod without any restrictions. When Network policy is defined for a pod, only traffic allowed by Policy can access the pod.

However, not all Kubernetes networking scenarios Support network Policy. For example, flannel is not supported, Calico is supported. We will then use Canal to demonstrate Network Policy. Canal This open source project is very interesting, it uses flannel realization Kubernetes cluster network, at the same time uses Calico realizes network Policy.

Deploy Canal

Deploying the Canal is very similar to deploying other Kubernetes network scenarios, kubeadm init After initializing the Kubernetes cluster kubectl apply Install the appropriate network scenario. In other words, there is no good way to switch directly to a different network scenario, and you can basically recreate the cluster.

The simplest way to destroy the current cluster is to execute kubeadm reset it on each node . You can then initialize the cluster as we did in the "Initializing Master" section of the "Deploying Kubernetes Cluster" chapter earlier.

Kubeadm Init--apiserver-advertise-address 192.168.56.105--pod-network-cidr=10.244.0.0/16

then follow the documentation https://kubernetes.io/docs/setup/independent/create-cluster-kubeadm/ install Canal. The documentation lists the installation methods for various network scenarios:

Execute the following command to deploy Canal

Kubectl apply-f Https://raw.githubusercontent.com/projectcalico/canal/master/k8s-install/1.7/rbac.yaml

Kubectl apply-f Https://raw.githubusercontent.com/projectcalico/canal/master/k8s-install/1.7/canal.yaml

After successful deployment, you can view the Canal related components:

canal deployed to each node as Daemonset, which belongs to   kube-system   This Namespace

Canal is ready and we will practice Network Policy in the next section.

Books:

1. "5 minutes a day kubernetes"
Https://item.jd.com/26225745440.html

2.5 minutes of Docker container technology per day
Https://item.jd.com/16936307278.html

3.5 minutes of play with OpenStack per day
Https://item.jd.com/12086376.html

Network Policy-5 minutes a day to play Docker container technology (171)