table of Contents
network communication kubernetes
issues that need resolving
- Between different containers inside a pod of the same communication, local
- Communication between Pod
- Service communication with the pod: PodIP <---> ClusterIP
- Service and external communication cluster
CNI:
- flannel
- calico
- canel
- kube-router
solution:
- Virtual bridge
- Multiplexer: MacVLAN
- Hardware exchange: SR-IOV
flannel
View cluster flannel profile
cat /etc/cni/net.d/10-flannel.conflist
Network policy does not support different namespace of pod can communicate with each other
Back-end support
- Vxlan
- vxlan
- Directrouting
- host-gw: Host Gateway
- UDP: inefficient
flannel configuration parameters:
network
CIRD use network address formats:
10.244.0.0/16 ->
master: 10.244.0.0/24
node1: 10.244.1.0/24
...
node255: 10.244.255.0/24
SubnetLen
How long in use on the node mask default 24
SubnetMin 与SubnetMax
The smallest segment with the biggest subnet subnet segment.
Backend: Select the type of flannel
Modify flannel type
Modify the configuration file kube-flannel.yaml
net-conf.json: |
{
"Network": "172.20.0.0/16",
"Backend": {
"Type": "vxlan"
"Direcrouting": true
}
}
Calico/Cannel
We can provide network policy
https://docs.projectcalico.org/v3.5/getting-started/kubernetes/installation/other
networkpolicy.spec
egress <[]Object>
List of egress rules to be applied to the selected pods. Outgoing traffic
is allowed if there are no NetworkPolicies selecting the pod (and cluster
policy otherwise allows the traffic), OR if the traffic matches at least
one egress rule across all of the NetworkPolicy objects whose podSelector
matches the pod. If this field is empty then this NetworkPolicy limits all
outgoing traffic (and serves solely to ensure that the pods it selects are
isolated by default). This field is beta-level in 1.8
ingress <[]Object>
List of ingress rules to be applied to the selected pods. Traffic is
allowed to a pod if there are no NetworkPolicies selecting the pod OR if
the traffic source is the pod's local node, OR if the traffic matches at
least one ingress rule across all of the NetworkPolicy objects whose
podSelector matches the pod. If this field is empty then this NetworkPolicy
does not allow any traffic (and serves solely to ensure that the pods it
selects are isolated by default).
podSelector <Object> -required-
Selects the pods to which this NetworkPolicy object applies. The array of
ingress rules is applied to any pods selected by this field. Multiple
network policies can select the same set of pods. In this case, the ingress
rules for each are combined additively. This field is NOT optional and
follows standard label selector semantics. An empty podSelector matches all
pods in this namespace.
policyTypes <[]string>
List of rule types that the NetworkPolicy relates to. Valid options are
Ingress, Egress, or Ingress,Egress. If this field is not specified, it will
default based on the existence of Ingress or Egress rules; policies that
contain an Egress section are assumed to affect Egress, and all policies
(whether or not they contain an Ingress section) are assumed to affect
Ingress. If you want to write an egress-only policy, you must explicitly
specify policyTypes [ "Egress" ]. Likewise, if you want to write a policy
that specifies that no egress is allowed, you must specify a policyTypes
value that include "Egress" (since such a policy would not include an
Egress section and would otherwise default to just [ "Ingress" ]). This
field is beta-level in 1.8
Note: If you define the egress-only policy, you need to explicitly declare Egress. If you need a policy to refuse all the traffic, you need to be included in the value of the Egress, because if you do not include egress, by default contains only ingress.
Block all ingress, allowing all Egress
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: deny-all-ingress
spec:
podSelector: {}
policyTypes:
- Ingress
Allow all ingress, allowing all Egress
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: deny-all-ingress
spec:
podSelector: {}
ingress:
- {}
policyTypes:
- Ingress
Block all Egress
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: deny-all-ingress
spec:
podSelector: {}
policyTypes:
- Egress
Case:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: test-network-policy
namespace: default
spec:
podSelector:
matchLabels:
role: db
policyTypes:
- Ingress
- Egress
ingress:
- from:
- ipBlock:
cidr: 172.17.0.0/16
except:
- 172.17.1.0/24
- namespaceSelector:
matchLabels:
project: myproject
- podSelector:
matchLabels:
role: frontend
ports:
- protocol: TCP
port: 6379
egress:
- to:
- ipBlock:
cidr: 10.0.0.0/24
ports:
- protocol: TCP
port: 5978
to sum up
- NetworkPolicy take effect for the namespace in the pod.
- The default ingress ban, egreess release. To disabled by default egress need to add the value of egress in policyTypes.
- NetworkPolicy in the flow matches the definition is similar to the firewall.
- In general for the pod to provide services should be defined by the rules a little
- Turn off all access to the stack by default
- Release all of this namespace
- The definition of external traffic