dengyi1996
627ff5d40a
* Update weave-network-policy.md add weavenet networkpolicy example * Edits from zacharysarah * Merge branch 'master' into patch-10 * Merge branch 'patch-10' of github.com:dengyi1996/kubernetes.github.io into patch-10 * Merge branch 'master' into patch-10
116 lines
2.5 KiB
Markdown
116 lines
2.5 KiB
Markdown
---
|
|
approvers:
|
|
- bboreham
|
|
title: Weave Net for NetworkPolicy
|
|
---
|
|
|
|
{% capture overview %}
|
|
|
|
This page shows how to use Weave Net for NetworkPolicy.
|
|
|
|
{% endcapture %}
|
|
|
|
{% capture prerequisites %}
|
|
|
|
Complete steps 1, 2, and 3 of the [kubeadm getting started guide](/docs/getting-started-guides/kubeadm/).
|
|
|
|
{% endcapture %}
|
|
|
|
{% capture steps %}
|
|
|
|
## Installing Weave Net addon
|
|
|
|
Follow the [Integrating Kubernetes via the Addon](https://www.weave.works/docs/net/latest/kube-addon/) guide.
|
|
|
|
The Weave Net Addon for Kubernetes comes with a [Network Policy Controller](https://www.weave.works/docs/net/latest/kube-addon/#npc) that automatically monitors Kubernetes for any NetworkPolicy annotations on all namespaces and configures `iptables` rules to allow or block traffic as directed by the policies.
|
|
|
|
{% endcapture %}
|
|
|
|
{% capture example %}
|
|
|
|
## Namespace isolation example
|
|
|
|
1. Create a namespace with `DefaultDeny`.
|
|
|
|
```yaml
|
|
kind: Namespace
|
|
apiVersion: v1
|
|
metadata:
|
|
name: myns
|
|
annotations:
|
|
net.beta.kubernetes.io/network-policy: |
|
|
{
|
|
"ingress": {
|
|
"isolation": "DefaultDeny"
|
|
}
|
|
}
|
|
```
|
|
|
|
2. Create 2 pods inside this namespace.
|
|
|
|
```yaml
|
|
kind: Pod
|
|
apiVersion: v1
|
|
metadata:
|
|
name: pod1
|
|
namespace: myns
|
|
labels:
|
|
inns: "yes"
|
|
spec:
|
|
containers:
|
|
- name: pod1
|
|
image: nginx
|
|
---
|
|
kind: Pod
|
|
apiVersion: v1
|
|
metadata:
|
|
name: pod2
|
|
namespace: myns
|
|
labels:
|
|
inns: "yes"
|
|
spec:
|
|
containers:
|
|
- name: pod2
|
|
image: nginx
|
|
```
|
|
|
|
3. Get the IP addresses of the pods.
|
|
|
|
```shell
|
|
kubectl get po -n myns -o wide
|
|
```
|
|
**Note:** If your cURL requests to pods are forbidden, try making cURL requests to other pods from within a pod.
|
|
{: .note}
|
|
|
|
4. Create a Kubernetes NetworkPolicy that allows pods within the same namespace to connect with each other.
|
|
|
|
```yaml
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: aaa
|
|
namespace: myns
|
|
spec:
|
|
podSelector:
|
|
matchExpressions:
|
|
- {key: inns, operator: In, values: ["yes"]}
|
|
ingress:
|
|
- from:
|
|
- podSelector:
|
|
matchExpressions:
|
|
- {key: inns, operator: In, values: ["yes"]}
|
|
```
|
|
**Caution:** After applying the network policy, pods outside the namespace you specify may be unable to connect with pods inside the namespace.
|
|
{. :caution}
|
|
|
|
{% endcapture %}
|
|
|
|
|
|
{% capture whatsnext %}
|
|
|
|
Once you have installed the Weave Net addon, you can follow the [NetworkPolicy getting started guide](/docs/getting-started-guides/network-policy/walkthrough) to try out Kubernetes NetworkPolicy.
|
|
|
|
{% endcapture %}
|
|
|
|
{% include templates/task.md %}
|