k8s网络策略在Amazon中的应用

Question

我正在学习Kubernetes的网络策略。我试图创建这样一种情况，即同一个名称空间中的两个荚具有不同的网络策略关联：

• 豆荚A从任何地方进入
• 豆荚B从任何地方进入(但最终，只有荚A)

我发现Kubernetes似乎接受了网络策略，但没有强制执行。已部署的pod使用ealen/echo-server:latest映像回显其运行环境的信息，并测试我从一个荚向另一个荚发出的HTTP请求的策略：

kubectl exec \
      -n private-networking \
      POD_A_NAME \
      -- wget -O - service-b.private-networking

如果策略有效，我期望从A到B的调用在超时的情况下失败，从B到A的调用将成功。目前，他们两方面都取得了成功。

该集群是用Amazon部署的，我不使用Calico或任何东西(尽管您将使用在github回购中我试过了)。

这些吊舱是通过部署对象部署的。，并且仅在名称上有所不同。(n.b.船舱不是在法尔盖特部署的)

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: deployment-a
  namespace: private-networking
spec:
  selector:
    matchLabels:
      service: service-a
  template:
    metadata:
      labels:
        service: service-a
    spec:
      containers:
      - name: echo-a
        image: ealen/echo-server:latest
        resources:
          limits:
            memory: "128Mi"
            cpu: "100m"
        ports:
        - containerPort: 8080
        env:
        - name: PORT
          value: "8080"

应用网络策略如下，也可以在GitHub上访问

我遗漏了什么？

---
# Deny all ingress and egress traffic across the board
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
  namespace: private-networking
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress
---
# Allow all pods in the namespace to egress traffic to kube-dns
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-dns
  namespace: private-networking
spec:
  podSelector: {}
  policyTypes:
    - Egress
  egress:
    - to:
        - namespaceSelector: {}
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - port: 53
          protocol: UDP
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: service-a-ingress-from-anywhere
  namespace: private-networking
spec:
  podSelector:
    matchLabels:
      service: service-a
  policyTypes:
    - Ingress
  ingress:
    - from:
        - ipBlock:
            cidr: 0.0.0.0/0
      ports:
        - port: 8080

---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: service-a-egress-to-anywhere
  namespace: private-networking
spec:
  podSelector:
    matchLabels:
      service: service-a
  egress:
    - {}
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: service-b-ingress-from-nowhere
  namespace: private-networking
spec:
  podSelector:
    matchLabels:
      service: service-b
  policyTypes:
    - Ingress
  ingress: [ ]

Answer 1

这个问题的答案原来是在Amazon集群上安装Calico。我误解了文档，认为Calico是一个可选的额外功能，Amazon集群默认安装了一个插件。

看来他们不知道。