Kubernetes网络策略不会阻止流量

Question

我有一个名为：test的命名空间，包含3个pod：frontend、backend和database。

这是pod的清单：

kind: Pod
apiVersion: v1
metadata:
  name: frontend
  namespace: test
  labels:
    app: todo
    tier: frontend
spec:
  containers:
    - name: frontend
      image: nginx

---

kind: Pod
apiVersion: v1
metadata:
  name: backend
  namespace: test
  labels:
    app: todo
    tier: backend
spec:
  containers:
    - name: backend
      image: nginx

---

kind: Pod
apiVersion: v1
metadata:
  name: database
  namespace: test
  labels:
    app: todo
    tier: database
spec:
  containers:
    - name: database
      image: mysql
      env:
      - name: MYSQL_ROOT_PASSWORD
        value: example

我会实现一个网络策略，只允许从后端到数据库的传入流量，但不允许从前端传入流量。

这是我的网络策略：

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: app-allow
  namespace: test
spec:
  podSelector:
    matchLabels:
      app: todo
      tier: database
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: todo
          tier: backend
    ports:
    - protocol: TCP
      port: 3306
    - protocol: UDP
      port: 3306

这是kubectl get pods -n test -o wide的输出

NAME       READY   STATUS    RESTARTS   AGE   IP           NODE       NOMINATED NODE   READINESS GATES
backend    1/1     Running   0          28m   172.17.0.5   minikube   <none>           <none>
database   1/1     Running   0          28m   172.17.0.4   minikube   <none>           <none>
frontend   1/1     Running   0          28m   172.17.0.3   minikube   <none>           <none>

这是kubectl get networkpolicy -n test -o wide的输出

NAME        POD-SELECTOR             AGE
app-allow   app=todo,tier=database   21m

当我从frontend pod执行telnet @ip-of-mysql-pod 3306时，连接看起来已建立，但网络策略不起作用

kubectl exec -it pod/frontend bash -n test
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
root@frontend:/# telnet 172.17.0.4 3306
Trying 172.17.0.4...
Connected to 172.17.0.4.
Escape character is '^]'.
J
8.0.25 k{%J\�#(t%~qI%7caching_sha2_password

我漏掉了什么吗？

谢谢

Answer 1

您似乎忘记添加“默认拒绝”策略：

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
spec:
  podSelector: {}
  policyTypes:
  - Ingress

NetworkPolicy的默认行为是允许pod之间的所有连接，除非明确拒绝。

更多详细信息请访问：https://kubernetes.io/docs/concepts/services-networking/network-policies/#default-deny-all-ingress-traffic