Practice Network Policy-5 minutes a day to play Docker container technology (172)

to demonstrate Network Policy, we first deploy a HTTPD application with its configuration file httpd.yaml are:

HTTPD has three copies of services available through the Nodeport type of service. To deploy an app:

No Network Policy is currently defined to verify that the app can be accessed:

2. Launch a BusyBox pod that can access the Service or Ping to the replica pod.
   
   

4. The cluster node can access the Service or Ping to the replica Pod.
   
   

6. The Service can be accessed outside the cluster (192.168.56.1).
   
   

Now create the following Network Policy:

① Define this Network Policy The access rule in is applied to label   run:httpd   Pod, three copies of httpd app Pod.

②  ingress   defined only label as   access: "true"   Pod to access the app.

③ can only access   Code style= "Box-sizing:inherit; Font-family:consolas, "liberation Mono", Courier, monospace; font-size:16.32px; Padding:0.2rem; Border:none; Background-color:rgb (244, 244, 244); Font-weight:inherit; border-radius:3px; Overflow:scroll; " >80   Port.

kubectl apply   create Network Policy.

Verify the validity of Network Policy:

2. busybox Pod has no access Service.
   
   if Pod added label  access: "true"   can access the app, but Ping has been banned.
   
   

4. The cluster node has no access to the Service, nor does it Ping the replica Pod.
   
   

6. The Service cannot be accessed outside the cluster (192.168.56.1).
   
   

If you want to have the cluster nodes and the outside of the cluster (192.168.56.1) also have access to the application, you can make the following modifications to Network Policy:

Apply the new Network Policy:

Now, cluster nodes and outside the cluster (192.168.56.1) have access to:

In addition to passing ingress limit incoming traffic, or you can use the egress limit out-of-office traffic. You can refer to the official website of the relevant documents and examples, here will not repeat.

Summary

Kubernetes uses a flat network model, each Pod has its own IP and can communicate directly.

The MLM specification allows Kubernetes to flexibly select a variety of Plugin to implement the cluster network.

Network Policy gives Kubernetes a powerful mechanism for accessing control over the Internet.

Books:

1. 5 minutes a day kubernetes "
https://item.jd.com/26225745440.html

2.5 minutes a day to play Docker container technology
https:// item.jd.com/16936307278.html

3.5 minutes of play with OpenStack per day
Https://item.jd.com/12086376.html

Practice Network Policy-5 minutes a day to play Docker container technology (172)