1 簡介
Canal 是calico和flannel的結合,我們因爲Calico不僅能夠提供很好的網絡性能,還能有網絡規則控制,但是我們很多時候使用的Flannel網絡,他的缺點就是沒有網絡控制只能提供網絡服務,所以Canal誕生了,爲Falanel提供了網絡控制。
網絡策略 控制出站: egress 控制進站: ingress 可以以ip地址塊定義規則,也可以基於命名空間規則定義,還可以對pod定義規則
2 部署Canal
curl \
https://docs.projectcalico.org/v3.6/getting-started/kubernetes/installation/hosted/canal/canal.yaml \
-O
kubectl apply -f canal.yaml
1)canal默認控制的是10.244.0.0/16 ,如果你在安裝k8s集羣是設置的pod網絡不是此段網絡,則你需要修改配置文件
2)我們採用的和k8s集羣公用etcd的方式創建
查看創建的pod
# kubectl get pods -n kube-system
NAME READY STATUS RESTARTS AGE
canal-9lmw8 2/2 Running 0 4m50s
canal-ln6kg 2/2 Running 0 4m50s
canal-mx6tn 2/2 Running 0 4m50s
coredns-fb8b8dccf-lfbkh 1/1 Running 2 10d
coredns-fb8b8dccf-t2kdz 1/1 Running 2 10d
etcd-master-1 1/1 Running 2 10d
kube-apiserver-master-1 1/1 Running 2 10d
kube-controller-manager-master-1 1/1 Running 2 10d
kube-flannel-ds-amd64-df7gk 1/1 Running 3 9d
kube-flannel-ds-amd64-dzxfd 1/1 Running 3 9d
kube-flannel-ds-amd64-mgw2m 1/1 Running 2 9d
kube-proxy-47d6q 1/1 Running 2 10d
kube-proxy-jztrs 1/1 Running 3 10d
kube-proxy-rt4xx 1/1 Running 3 10d
kube-scheduler-master-1 1/1 Running 2 10d
kubernetes-dashboard-5f7b999d65-8h79h 1/1 Running 0 21h
3 創建兩個實驗的空間
kubectl create namespace shengchan
kubectl create namespace test
4 創建網絡規則測試
默認ingress 和 engress可以一起使用,當這兩規則同時存在那麼將使用policyTypes做具體的規則指向
例如:創建一個policy默認拒絕所有在空間shengchan的入站規則
# cat ingress-deny.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: deny-all-ingress
namespace: shengchan
spec:
podSelector: {}
policyTypes:
- Ingress
kubectl apply ingress-deny.yaml
創建一組屬於shengchan空間的pod
# cat pod-networkpolicy1.yaml
apiVersion: v1
kind: Pod
metadata:
name: pod-test
spec:
containers:
- name: pod-test-policy
image: nginx:1.10
kubectl apply -f pod-networkpolicy1.yaml -n shengchan
創建一組屬於test空間的pod
kubectl apply -f pod-networkpolicy1.yaml -n test
分別查看兩組pod的IP地址
# kubectl get pods -o wide -n shengchan
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
pod-test 1/1 Running 0 16s 10.244.1.2 node2 <none> <none>
[root@master-1 ~]# kubectl get pods -o wide -n test
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
pod-test 1/1 Running 0 9s 10.244.2.2 node1 <none> <none>
在宿主機上面分別ping這兩個ip
# ping 10.244.1.2 -c 1
PING 10.244.1.2 (10.244.1.2) 56(84) bytes of data.
^C
--- 10.244.1.2 ping statistics ---
1 packets transmitted, 0 received, 100% packet loss, time 0ms
# ping 10.244.2.2 -c 1
PING 10.244.2.2 (10.244.2.2) 56(84) bytes of data.
64 bytes from 10.244.2.2: icmp_seq=1 ttl=63 time=0.660 ms
--- 10.244.2.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.660/0.660/0.660/0.000 ms
此時發現屬於shengchan空間的pod是被拒絕訪問的,屬於test空間的pod正常訪問
此時我們是基於名稱空間級別的入站網絡訪問策略
5 將上面的默認拒絕策略放行
修改配置文件
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: deny-all-ingress
namespace: shengchan
spec:
podSelector: {}
ingress:
- {}
policyTypes:
- Ingress
kubectl apply -f ingress-deny.yaml
再次測試10.244.1.2
[root@master-1 ~]# curl -I 10.244.1.2
HTTP/1.1 200 OK
Server: nginx/1.10.3
Date: Sat, 27 Apr 2019 16:58:04 GMT
Content-Type: text/html
Content-Length: 612
Last-Modified: Tue, 31 Jan 2017 15:01:11 GMT
Connection: keep-alive
ETag: "5890a6b7-264"
Accept-Ranges: bytes
[root@master-1 ~]# curl -I 10.244.2.2
HTTP/1.1 200 OK
Server: nginx/1.10.3
Date: Sat, 27 Apr 2019 16:58:07 GMT
Content-Type: text/html
Content-Length: 612
Last-Modified: Tue, 31 Jan 2017 15:01:11 GMT
Connection: keep-alive
ETag: "5890a6b7-264"
Accept-Ranges: bytes
說明我們的網絡策略放行成功
6 放行特定的入站
以標籤的形式進行劃分pod入站規則是否被放行
1)回覆默認拒絕所有
[root@master-1 ~]# cat ingress-deny.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: deny-all-ingress
namespace: shengchan
spec:
podSelector: {}
policyTypes:
- Ingress
kubectl apply -f ingress-deny.yaml
2)給shengchan pod打一個標籤
kubectl label pods pod-test app=hello -n shengchan
3)創建一個新的規則
# vim ingress-allow.yml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-hello-ingress
namespace: shengchan
spec:
podSelector:
matchLabels:
app: hello
ingress:
- from:
- ipBlock:
cidr: 10.244.0.0/16
except:
- 10.244.2.2/32
ports:
- protocol: TCP
port: 80
解釋: 我們重新定義了一個policy,通過標籤匹配到我們已有的pod(我們一已有的pod是拒絕所有訪問的),定義ingres規則,如果不通過from方式定義默認是所有網段都可以訪問到擁有這個標籤的pod爲了測試我們使用from方式去拒絕10.244.0.0但是會放行10.244.2.2因爲我們有這個ip的pod創建萬郴更可以進行測試ports就是指定特定開放的端口
4)創建之前進行訪問測試
# kubectl get pods -n shengchan -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
pod-test 1/1 Running 0 62m 10.244.1.2 node2 <none> <none>
# curl 10.244.1.2
說明無法訪問
5)創建之後測試
kubectl apply -f ingress-allow.yml
[root@master-1 ~]# curl -I 10.244.1.2
HTTP/1.1 200 OK
Server: nginx/1.10.3
Date: Sat, 27 Apr 2019 17:32:15 GMT
Content-Type: text/html
Content-Length: 612
Last-Modified: Tue, 31 Jan 2017 15:01:11 GMT
Connection: keep-alive
ETag: "5890a6b7-264"
Accept-Ranges: bytes
說明已經放行
至於對於10.244.0.0網段的限制有興趣可以測試一下
6 egress出站規則
1)設置一個拒絕所有出站policy
cat egress.yml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: deny-all-egress
namespace: test
spec:
podSelector: {}
policyTypes:
- Egress
kubectl apply -f egress.yml
2)創建一個test命名空間下的pods
kubectl apply -f pod-networkpolicy1.yaml -n test
3)查看podIP並進去容器去測試ping一個正常的podip
[root@master-1 ~]# kubectl get pods -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
net-test-5764c456cb-2c9df 1/1 Running 24 24h 10.244.2.22 node1 <none> <none>
net-test-5764c456cb-ng6vh 1/1 Running 46 6d5h 10.244.1.21 node2 <none> <none>
[root@master-1 ~]# kubectl get pods -o wide -n test
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
pod-test 1/1 Running 0 86m 10.244.2.2 node1 <none> <none>
kubectl exec -it pod-test -n test -- /bin/bash
root@pod-test:/# ping 10.244.1.21
PING 10.244.1.21 (10.244.1.21): 56 data bytes
^C--- 10.244.1.21 ping statistics ---
3 packets transmitted, 0 packets received, 100% packet loss
說明此時已經應用策略
4)修改配置文件放行所有出站
# cat egress.yml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: deny-all-egress
namespace: test
spec:
podSelector: {}
egress:
- {}
policyTypes:
- Egress
kubectl apply -f egress.yml
測試:
root@pod-test:/# ping 10.244.1.21 -c 1
PING 10.244.1.21 (10.244.1.21): 56 data bytes
64 bytes from 10.244.1.21: icmp_seq=0 ttl=62 time=0.939 ms
--- 10.244.1.21 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max/stddev = 0.939/0.939/0.939/0.000 ms
此時說明已經放行成功
7 更加複雜的policy規則需要根據不同的環境規劃進行深入探究,其所有都規則都體現在配置文件中