Kubernetes网络策略完全指南

Kubernetes网络策略完全指南

引言

在 Kubernetes 中，网络策略（Network Policy）是实现微服务间网络隔离的关键机制。通过网络策略，可以控制 Pod 之间以及 Pod 与外部的网络通信。本文将深入探讨 Kubernetes 网络策略的配置和最佳实践。

一、网络策略概述

1.1 网络策略作用

┌─────────────────────────────────────────────────────────────┐ │ 网络策略作用示意 │ ├─────────────────────────────────────────────────────────────┤ │ │ │ ┌──────────┐ 允许 ┌──────────┐ 禁止 ┌──────────┐│ │ │ Pod A │──────────>│ Pod B │───────────×│ Pod C ││ │ └──────────┘ └──────────┘ └──────────┘│ │ │ │ │ │ × × │ │ │ │ │ │ ┌──────────┐ ┌──────────┐ │ │ │ Pod D │ │ Pod E │ │ │ └──────────┘ └──────────┘ │ │ │ └─────────────────────────────────────────────────────────────┘

1.2 网络策略类型

二、网络策略基础配置

2.1 基础 Ingress 策略

apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: deny-all-ingress spec: podSelector: matchLabels: app: my-app policyTypes: - Ingress ingress: - from: - podSelector: matchLabels: role: frontend ports: - protocol: TCP port: 80

2.2 基础 Egress 策略

apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: allow-dns-egress spec: podSelector: matchLabels: app: my-app policyTypes: - Egress egress: - to: - namespaceSelector: matchLabels: name: kube-system podSelector: matchLabels: k8s-app: kube-dns ports: - protocol: UDP port: 53

2.3 双向策略

apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: full-network-policy spec: podSelector: matchLabels: app: api policyTypes: - Ingress - Egress ingress: - from: - podSelector: matchLabels: app: frontend ports: - protocol: TCP port: 8080 egress: - to: - podSelector: matchLabels: app: database ports: - protocol: TCP port: 5432

三、网络策略选择器

3.1 Pod Selector

apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: pod-selector-policy spec: podSelector: matchLabels: app: backend ingress: - from: - podSelector: matchLabels: app: frontend

3.2 Namespace Selector

apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: namespace-selector-policy spec: podSelector: matchLabels: app: sensitive ingress: - from: - namespaceSelector: matchLabels: environment: production

3.3 IP Block 选择器

apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: ip-block-policy spec: podSelector: matchLabels: app: api ingress: - from: - ipBlock: cidr: 192.168.0.0/24 except: - 192.168.0.100/32

3.4 组合选择器

apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: combined-selector-policy spec: podSelector: matchLabels: app: database ingress: - from: - podSelector: matchLabels: role: api namespaceSelector: matchLabels: environment: production

四、网络策略高级配置

4.1 多端口配置

apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: multi-port-policy spec: podSelector: matchLabels: app: web ingress: - from: - ipBlock: cidr: 0.0.0.0/0 ports: - protocol: TCP port: 80 - protocol: TCP port: 443

4.2 多规则配置

apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: multi-rule-policy spec: podSelector: matchLabels: app: api ingress: - from: - podSelector: matchLabels: app: frontend ports: - protocol: TCP port: 8080 - from: - ipBlock: cidr: 10.0.0.0/8 ports: - protocol: TCP port: 8443

4.3 默认拒绝策略

apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: default-deny-all spec: podSelector: {} policyTypes: - Ingress - Egress

五、网络策略场景实践

5.1 数据库隔离策略

apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: database-isolation spec: podSelector: matchLabels: app: postgres policyTypes: - Ingress ingress: - from: - podSelector: matchLabels: app: api - podSelector: matchLabels: app: worker ports: - protocol: TCP port: 5432

5.2 前端服务策略

apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: frontend-policy spec: podSelector: matchLabels: app: frontend policyTypes: - Ingress - Egress ingress: - from: - ipBlock: cidr: 0.0.0.0/0 ports: - protocol: TCP port: 80 - protocol: TCP port: 443 egress: - to: - podSelector: matchLabels: app: api ports: - protocol: TCP port: 8080 - to: - namespaceSelector: matchLabels: name: kube-system podSelector: matchLabels: k8s-app: kube-dns ports: - protocol: UDP port: 53

5.3 敏感服务隔离

apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: sensitive-service-policy spec: podSelector: matchLabels: app: sensitive policyTypes: - Ingress - Egress ingress: - from: - podSelector: matchLabels: role: admin namespaceSelector: matchLabels: name: admin egress: []

六、网络策略最佳实践

6.1 策略层次结构

┌─────────────────────────────────────────────────────────────┐ │ 网络策略层次结构 │ ├─────────────────────────────────────────────────────────────┤ │ │ │ 1. 命名空间级别策略（默认拒绝） │ │ │ │ │ ▼ │ │ 2. 应用级别策略（允许特定服务通信） │ │ │ │ │ ▼ │ │ 3. Pod 级别策略（细粒度控制） │ │ │ └─────────────────────────────────────────────────────────────┘

6.2 策略配置清单

• 为每个命名空间配置默认拒绝策略
• 明确允许 DNS 流量
• 限制数据库访问仅允许特定服务
• 分离前端和后端网络策略
• 限制敏感服务的网络范围

6.3 性能考虑

七、网络策略调试与验证

7.1 检查网络策略

# 查看所有网络策略 kubectl get networkpolicies # 查看特定策略详情 kubectl describe networkpolicy my-policy # 查看策略适用的 Pod kubectl get pods -l app=my-app

7.2 测试网络连通性

# 在 Pod 内测试连通性 kubectl exec -it my-pod -- ping target-pod-ip # 使用 nc 测试端口 kubectl exec -it my-pod -- nc -zv target-pod-ip 8080 # 使用 curl 测试 HTTP kubectl exec -it my-pod -- curl http://target-service

7.3 常见问题排查

八、网络策略与服务网格对比

九、总结

网络策略是 Kubernetes 安全的重要组成部分：

1. Ingress 控制：限制进入 Pod 的流量
2. Egress 控制：限制 Pod 发出的流量
3. 选择器：支持 Pod、Namespace、IP 块选择
4. 默认策略：建议配置默认拒绝
5. 分层策略：从命名空间到 Pod 的多层次控制

通过合理配置网络策略，可以显著提高集群的安全性，防止横向移动攻击。

下一步行动：

1. 审查现有网络策略配置
2. 配置默认拒绝策略
3. 为关键服务配置隔离策略
4. 测试策略有效性
5. 定期审计网络策略