Kubernetes出口规则阻止所有传出流量

Question

问题

我已经定义了一个kubernetes egress规则，从pod test-1到一个特定的pod test-2，但是这个规则也阻塞了从test-1到test-2的通信量。

我已经创建了两个豆荚：test-2

• I've和test-1创建了一个网络策略，该策略只允许从test-1到test-2

• I've的egress流量，试图通过curl test-2从test-1调用test-2。但是这个调用是blocked!

• I've检查了选择器

这两个选择器返回预期的结荚：

kubectl describe networkpolicies test-1-policy
kubectl get pod --selector app.kubernetes.io/name=test-1
kubectl get pod --selector app.kubernetes.io/name=test-2

当我移除networkpolicy时，curl test-2的连接可以工作。

我的问题:我错过了什么？

这里是如何重现问题

将yaml粘贴到文件deployment.yaml (请参阅below)

• Deploy演示kubectl apply -f deployment.yaml

• Exec到pod: pod中的kubectl exec --stdin --tty $(kubectl get pod -l app.kubernetes.io/name=test-1 -o jsonpath="{.items[0].metadata.name}") -- /bin/bash

• Call请求：curl test-2 => 请求是blocked

• Remove网络策略:pod中的kubectl delete networkpolicy test-1-policy

• Exec和调用请求=> 请求是executed

)

以下是完整的yaml：

apiVersion: apps/v1
kind: Deployment
metadata:
  name: test-1
  labels:
    app.kubernetes.io/name: test-1
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: test-1
  template:
    metadata:
      labels:
        app.kubernetes.io/name: test-1
    spec:
      containers:
        - name: nginx
          image: nginx
          ports:
            - name: http
              containerPort: 80
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: test-2
  labels:
    app.kubernetes.io/name: test-2
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: test-2
  template:
    metadata:
      labels:
        app.kubernetes.io/name: test-2
    spec:
      containers:
        - name: nginx
          image: nginx
          ports:
            - name: http
              containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: test-1
  labels:
    app.kubernetes.io/name: test-1
spec:
  type: ClusterIP
  ports:
    - port: 80
      targetPort: http
      name: http
  selector:
    app.kubernetes.io/name: test-1
---
apiVersion: v1
kind: Service
metadata:
  name: test-2
  labels:
    app.kubernetes.io/name: test-2
spec:
  type: ClusterIP
  ports:
    - port: 80
      targetPort: http
      name: http
  selector:
    app.kubernetes.io/name: test-2
---
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: test-1-policy
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: test-1
  policyTypes:
    - Ingress
    - Egress
  ingress: []
  egress:
    - to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: test-2
      ports:
        - port: 80
          protocol: TCP

Answer 1

缺少dns egress规则：

当您为egress添加port 53规则时，一切都如预期的那样工作：

  egress:
    - ports:
      - port: 53
        protocol: UDP
      - port: 53
        protocol: TCP

https://github.com/ahmetb/kubernetes-network-policy-recipes/blob/master/11-deny-egress-traffic-from-an-application.md