Author: Jimmy Zhang (张浩)
Network Policy是k8s提供的一种资源,用于定义基于pod的网络隔离策略。它描述了一组pod是否可以与其它组pod,以及其它network endpoints进行通信。
kube-router项目的三大功能:
在腾讯云TKE上,Pod Networking功能由基于IAAS层VPC的高性能容器网络实现,service proxy功能由kube-proxy所支持的ipvs/iptables两种模式实现。建议在TKE上,只使用kube-router的Network Policy功能。
腾讯云PAAS团队提供的镜像"ccr.ccs.tencentyun.com/library/kube-router:v1"基于官方的最新版本:v0.2.1
在该项目的开发过程中,腾讯云PAAS团队积极参与社区,持续贡献了一些feature support和bug fix, 列表如下(均已被社区合并):
我们会继续贡献社区,并提供腾讯云镜像的版本升级。
Daemonset yaml文件:
在能访问公网,也能访问TKE集群apiserver的机器上,执行以下命令即可完成kube-router部署。
如果集群节点开通了公网IP,则可以直接在集群节点上执行以下命令。
如果集群节点没有开通公网IP, 则可以手动下载和粘贴yaml文件内容到节点, 保存为kube-router-firewall-daemonset.yaml,再执行最后的kubectl create命令。
wget https://ask.qcloudimg.com/draft/982360/wfr3pehddn.zip
unzip wfr3pehddn.zip
kuebectl create -f kube-router-firewall-daemonset.yaml
kube-router-firewall-daemonset.yaml文件内容:
apiVersion: v1
kind: ConfigMap
metadata:
name: kube-router-cfg
namespace: kube-system
labels:
tier: node
k8s-app: kube-router
data:
cni-conf.json: |
{
"name":"kubernetes",
"type":"bridge",
"bridge":"kube-bridge",
"isDefaultGateway":true,
"ipam": {
"type":"host-local"
}
}
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: kube-router
namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: kube-router
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:
- kind: ServiceAccount
name: kube-router
namespace: kube-system
---
apiVersion: extensions/v1beta1
kind: DaemonSet
metadata:
name: kube-router
namespace: kube-system
labels:
k8s-app: kube-router
spec:
template:
metadata:
labels:
k8s-app: kube-router
annotations:
scheduler.alpha.kubernetes.io/critical-pod: ''
spec:
serviceAccountName: kube-router
containers:
- name: kube-router
image: ccr.ccs.tencentyun.com/library/kube-router:v1
args: ["--run-router=false", "--run-firewall=true", "--run-service-proxy=false", "--iptables-sync-period=5m", "--cache-sync-timeout=3m"]
securityContext:
privileged: true
imagePullPolicy: Always
env:
- name: NODE_NAME
valueFrom:
fieldRef:
fieldPath: spec.nodeName
livenessProbe:
httpGet:
path: /healthz
port: 20244
initialDelaySeconds: 10
periodSeconds: 3
volumeMounts:
- name: lib-modules
mountPath: /lib/modules
readOnly: true
- name: cni-conf-dir
mountPath: /etc/cni/net.d
initContainers:
- name: install-cni
image: busybox
imagePullPolicy: Always
command:
- /bin/sh
- -c
- set -e -x;
if [ ! -f /etc/cni/net.d/10-kuberouter.conf ]; then
TMP=/etc/cni/net.d/.tmp-kuberouter-cfg;
cp /etc/kube-router/cni-conf.json ${TMP};
mv ${TMP} /etc/cni/net.d/10-kuberouter.conf;
fi
volumeMounts:
- name: cni-conf-dir
mountPath: /etc/cni/net.d
- name: kube-router-cfg
mountPath: /etc/kube-router
hostNetwork: true
tolerations:
- key: CriticalAddonsOnly
operator: Exists
- effect: NoSchedule
key: node-role.kubernetes.io/master
operator: Exists
volumes:
- name: lib-modules
hostPath:
path: /lib/modules
- name: cni-conf-dir
hostPath:
path: /etc/cni/net.d
- name: kube-router-cfg
configMap:
name: kube-router-cfg
args说明:
apiVersion: extensions/v1beta1
kind: NetworkPolicy
metadata:
name: npa
namespace: nsa
spec:
ingress:
- from:
- podSelector: {}
podSelector: {}
policyTypes:
- Ingress
apiVersion: extensions/v1beta1
kind: NetworkPolicy
metadata:
name: npa
namespace: nsa
spec:
podSelector: {}
policyTypes:
- Ingress
apiVersion: extensions/v1beta1
kind: NetworkPolicy
metadata:
name: npa
namespace: nsa
spec:
ingress:
- from:
- namespaceSelector:
matchLabels:
app: nsb
ports:
- protocol: TCP
port: 6379
podSelector: {}
policyTypes:
- Ingress
apiVersion: extensions/v1beta1
kind: NetworkPolicy
metadata:
name: npa
namespace: nsa
spec:
egress:
- to:
- ipBlock:
cidr: 14.215.0.0/16
ports:
- protocol: TCP
port: 5978
podSelector: {}
policyTypes:
- Egress
apiVersion: extensions/v1beta1
kind: NetworkPolicy
metadata:
name: npd
namespace: default
spec:
ingress:
- from:
- ipBlock:
cidr: 14.215.0.0/16
ports:
- protocol: TCP
port: 80
podSelector: {}
policyTypes:
- Ingress
用例名称 | 测试结果 |
---|---|
不同namespace的pod互相隔离,同一namespace的pod互通 | 通过 |
不同namespace的pod互相隔离,同一namespace的pod隔离 | 通过 |
不同namespace的pod互相隔离,白名单指定B可以访问A | 通过 |
允许某个namespace访问集群外某个CIDR,其他外部IP全部隔离 | 通过 |
不同namespace的pod互相隔离,白名单指定B可以访问A中对应的pod以及端口 | 通过 |
以上用例,当source pod 和 destination pod在一个node上时,隔离是否生效 | 通过 |
功能测试用例
性能测试报告
原创声明:本文系作者授权腾讯云开发者社区发表,未经许可,不得转载。
如有侵权,请联系 cloudcommunity@tencent.com 删除。
原创声明:本文系作者授权腾讯云开发者社区发表,未经许可,不得转载。
如有侵权,请联系 cloudcommunity@tencent.com 删除。