Question

我想拒绝所有出口流量。所以我创建了这个网络政策

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny
spec:
  podSelector: {}
  policyTypes:
  - Egress

然后我将它应用于命名空间

kubectl -n pps-api-gateway-ci apply -f~ / Documents / networkpolicy.yaml

为了测试这个，我确实描述了networkpolicy

    kubectl -n pps-api-gateway-ci describe networkpolicy
    Name:         default-deny
    Namespace:    pps-api-gateway-ci
    Created on:   2018-05-29 13:50:52 -0700 PDT
    Labels:       <none>
    Annotations:  kubectl.kubernetes.io/last-applied-configuration= 
   {"apiVersion":"networking.k8s.io/v1","kind":"NetworkPolicy","metadata": 
   {"annotations":{},"name":"default-deny","namespace":"pps-api-gateway- 
   ci"},"spec"...
   Spec:
      PodSelector:     <none> (Allowing the specific traffic to all pods in this 
    namespace)
      Allowing ingress traffic:
        <none> (Selected pods are isolated for ingress connectivity)
       Allowing egress traffic:
        <none> (Selected pods are isolated for egress connectivity)
       Policy Types: Egress

然后我登录到那个容器

ping www.google.com

PING www.google.com (216.58.217.100): 56 data bytes
64 bytes from 216.58.217.100: icmp_seq=0 ttl=46 time=2.552 ms
64 bytes from 216.58.217.100: icmp_seq=1 ttl=46 time=1.835 ms
64 bytes from 216.58.217.100: icmp_seq=2 ttl=46 time=1.487 ms
64 bytes from 216.58.217.100: icmp_seq=3 ttl=46 time=2.523 ms
64 bytes from 216.58.217.100: icmp_seq=4 ttl=46 time=1.607 ms
64 bytes from 216.58.217.100: icmp_seq=5 ttl=46 time=1.480 ms

如果我的出口政策被应用，我不应该ping。

我正在使用kubernetes 1.9.6版本

Answer 1

来自official documentation：

网络政策是由网络插件实施的，因此您使用支持NetworkPolicy的网络解决方案 - 只需创建资源而无需控制器来实现它无效。

许多网络插件（包括Calico和Weave Net）支持使用Network Policies，但Flannel例如不支持。

出口政策没有适用于kubernetes 1.9

1 个答案: