Kubernetes网络策略完全指南

Kubernetes网络策略完全指南引言在 Kubernetes 中网络策略Network Policy是实现微服务间网络隔离的关键机制。通过网络策略可以控制 Pod 之间以及 Pod 与外部的网络通信。本文将深入探讨 Kubernetes 网络策略的配置和最佳实践。一、网络策略概述1.1 网络策略作用┌─────────────────────────────────────────────────────────────┐ │ 网络策略作用示意 │ ├─────────────────────────────────────────────────────────────┤ │ │ │ ┌──────────┐ 允许 ┌──────────┐ 禁止 ┌──────────┐│ │ │ Pod A │──────────│ Pod B │───────────×│ Pod C ││ │ └──────────┘ └──────────┘ └──────────┘│ │ │ │ │ │ × × │ │ │ │ │ │ ┌──────────┐ ┌──────────┐ │ │ │ Pod D │ │ Pod E │ │ │ └──────────┘ └──────────┘ │ │ │ └─────────────────────────────────────────────────────────────┘1.2 网络策略类型类型描述作用范围Ingress入站流量控制控制进入 Pod 的流量Egress出站流量控制控制 Pod 发出的流量Ingress Egress双向流量控制同时控制入站和出站二、网络策略基础配置2.1 基础 Ingress 策略apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: deny-all-ingress spec: podSelector: matchLabels: app: my-app policyTypes: - Ingress ingress: - from: - podSelector: matchLabels: role: frontend ports: - protocol: TCP port: 802.2 基础 Egress 策略apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: allow-dns-egress spec: podSelector: matchLabels: app: my-app policyTypes: - Egress egress: - to: - namespaceSelector: matchLabels: name: kube-system podSelector: matchLabels: k8s-app: kube-dns ports: - protocol: UDP port: 532.3 双向策略apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: full-network-policy spec: podSelector: matchLabels: app: api policyTypes: - Ingress - Egress ingress: - from: - podSelector: matchLabels: app: frontend ports: - protocol: TCP port: 8080 egress: - to: - podSelector: matchLabels: app: database ports: - protocol: TCP port: 5432三、网络策略选择器3.1 Pod SelectorapiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: pod-selector-policy spec: podSelector: matchLabels: app: backend ingress: - from: - podSelector: matchLabels: app: frontend3.2 Namespace SelectorapiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: namespace-selector-policy spec: podSelector: matchLabels: app: sensitive ingress: - from: - namespaceSelector: matchLabels: environment: production3.3 IP Block 选择器apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: ip-block-policy spec: podSelector: matchLabels: app: api ingress: - from: - ipBlock: cidr: 192.168.0.0/24 except: - 192.168.0.100/323.4 组合选择器apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: combined-selector-policy spec: podSelector: matchLabels: app: database ingress: - from: - podSelector: matchLabels: role: api namespaceSelector: matchLabels: environment: production四、网络策略高级配置4.1 多端口配置apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: multi-port-policy spec: podSelector: matchLabels: app: web ingress: - from: - ipBlock: cidr: 0.0.0.0/0 ports: - protocol: TCP port: 80 - protocol: TCP port: 4434.2 多规则配置apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: multi-rule-policy spec: podSelector: matchLabels: app: api ingress: - from: - podSelector: matchLabels: app: frontend ports: - protocol: TCP port: 8080 - from: - ipBlock: cidr: 10.0.0.0/8 ports: - protocol: TCP port: 84434.3 默认拒绝策略apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: default-deny-all spec: podSelector: {} policyTypes: - Ingress - Egress五、网络策略场景实践5.1 数据库隔离策略apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: database-isolation spec: podSelector: matchLabels: app: postgres policyTypes: - Ingress ingress: - from: - podSelector: matchLabels: app: api - podSelector: matchLabels: app: worker ports: - protocol: TCP port: 54325.2 前端服务策略apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: frontend-policy spec: podSelector: matchLabels: app: frontend policyTypes: - Ingress - Egress ingress: - from: - ipBlock: cidr: 0.0.0.0/0 ports: - protocol: TCP port: 80 - protocol: TCP port: 443 egress: - to: - podSelector: matchLabels: app: api ports: - protocol: TCP port: 8080 - to: - namespaceSelector: matchLabels: name: kube-system podSelector: matchLabels: k8s-app: kube-dns ports: - protocol: UDP port: 535.3 敏感服务隔离apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: sensitive-service-policy spec: podSelector: matchLabels: app: sensitive policyTypes: - Ingress - Egress ingress: - from: - podSelector: matchLabels: role: admin namespaceSelector: matchLabels: name: admin egress: []六、网络策略最佳实践6.1 策略层次结构┌─────────────────────────────────────────────────────────────┐ │ 网络策略层次结构 │ ├─────────────────────────────────────────────────────────────┤ │ │ │ 1. 命名空间级别策略默认拒绝 │ │ │ │ │ ▼ │ │ 2. 应用级别策略允许特定服务通信 │ │ │ │ │ ▼ │ │ 3. Pod 级别策略细粒度控制 │ │ │ └─────────────────────────────────────────────────────────────┘6.2 策略配置清单为每个命名空间配置默认拒绝策略明确允许 DNS 流量限制数据库访问仅允许特定服务分离前端和后端网络策略限制敏感服务的网络范围6.3 性能考虑因素影响优化建议策略数量过多策略影响性能合并相似策略规则复杂度复杂规则增加延迟保持规则简洁网络插件不同插件性能差异选择高性能插件七、网络策略调试与验证7.1 检查网络策略# 查看所有网络策略 kubectl get networkpolicies # 查看特定策略详情 kubectl describe networkpolicy my-policy # 查看策略适用的 Pod kubectl get pods -l appmy-app7.2 测试网络连通性# 在 Pod 内测试连通性 kubectl exec -it my-pod -- ping target-pod-ip # 使用 nc 测试端口 kubectl exec -it my-pod -- nc -zv target-pod-ip 8080 # 使用 curl 测试 HTTP kubectl exec -it my-pod -- curl http://target-service7.3 常见问题排查问题原因解决方案Pod 无法访问外部Egress 策略限制添加 Egress 规则Pod 无法通信缺少 Ingress 规则添加 Ingress 规则DNS 解析失败未允许 DNS 流量添加 DNS Egress 规则策略不生效网络插件不支持确认使用支持的 CNI八、网络策略与服务网格对比特性Network PolicyService Mesh粒度Pod/命名空间级别服务/方法级别加密不支持mTLS流量控制简单允许/拒绝复杂路由规则可观测性有限丰富性能开销低中等九、总结网络策略是 Kubernetes 安全的重要组成部分Ingress 控制限制进入 Pod 的流量Egress 控制限制 Pod 发出的流量选择器支持 Pod、Namespace、IP 块选择默认策略建议配置默认拒绝分层策略从命名空间到 Pod 的多层次控制通过合理配置网络策略可以显著提高集群的安全性防止横向移动攻击。下一步行动审查现有网络策略配置配置默认拒绝策略为关键服务配置隔离策略测试策略有效性定期审计网络策略