标签: CNI - 遇寻笔记

2024-12-09发表2024-12-09更新Kubernetes4 分钟读完 (大约545个字)

准备工作

安装测试集群

curl https://raw.githubusercontent.com/tigera/ccol1/main/control-init.yaml | multipass launch -n control -m 2048M 20.04 --cloud-init -
curl https://raw.githubusercontent.com/tigera/ccol1/main/node1-init.yaml | multipass launch -n node1 20.04 --cloud-init -
curl https://raw.githubusercontent.com/tigera/ccol1/main/node2-init.yaml | multipass launch -n node2 20.04 --cloud-init -
curl https://raw.githubusercontent.com/tigera/ccol1/main/host1-init.yaml | multipass launch -n host1 20.04 --cloud-init -

calico 的四种安装方式

Manifest
Operator
Managed Kubernetes Service(EKS、GKE、AKS)
Kubernetes Distro(MicroK8s)

以Operator的方式来安装calico

multipass shell host1
kubectl create -f https://docs.projectcalico.org/archive/v3.21/manifests/tigera-operator.yaml
cat <<EOF | kubectl apply -f -
apiVersion: operator.tigera.io/v1
kind: Installation
metadata:
  name: default
spec:
  calicoNetwork:
    containerIPForwarding: Enabled
    ipPools:
    - cidr: 198.19.16.0/21
      natOutgoing: Enabled
      encapsulation: None
EOF

安装测试所需的模拟业务

1 2	multipass shell host1 kubectl apply -f https://raw.githubusercontent.com/tigera/ccol1/main/yaobank.yaml

网络策略

原生网络策略

要想 NetworkPolicy 生效，必须使用实现了此的 CNI 插件，如 calico。
ingress 进 pod 流量默认全部打开，当被应用规则后，pod 所在 node 上、ingress 规则列表中允许的流量可以进入 pod；
egress 出 pod 流量，默认全部可以出，当被应用规则后，只有规则中允许的流量可以出 pod；
白名单机制，即在 rules 中配置了，才能通行（包括进和出），规则可以叠加，但能做到只要配置了就能通行；

默认配置

命名空间中没有 policy 时，全部开放；

拒绝/允许所有流量

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-all-ingress
spec:
  podSelector: {}
  ingress:
  - {}
  policyTypes:
  - Ingress
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-egress
spec:
  podSelector: {}
  policyTypes:
  - Egress
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-all-egress
spec:
  podSelector: {}
  egress:
  - {}
  policyTypes:
  - Egress