CNI：
解决方案：
查看集群的flannel 配置文件
cat /etc/cni/net.d/10-flannel.conflist
不支持网络策略 不同namespace 的pod 可以相互通信
支持的后端
flannel 的配置参数：
network
使用CIRD格式的网络地址：
10.244.0.0/16 ->
master: 10.244.0.0/24
? node1: 10.244.1.0/24
? ...
node255: 10.244.255.0/24
SubnetLen
在node上使用多长的掩码 默认 24位
SubnetMin 与SubnetMax
网段中最小的子网网段与最大的子网网段。
Backend： 选择flannel的类型
修改flannel 类型
修改配置文件 kube-flannel.yaml
net-conf.json: |
{
"Network": "172.20.0.0/16",
"Backend": {
"Type": "vxlan"
"Direcrouting": true
}
}可以提供网络策略
https://docs.projectcalico.org/v3.5/getting-started/kubernetes/installation/other
networkpolicy.spec
egress <[]Object>
List of egress rules to be applied to the selected pods. Outgoing traffic
is allowed if there are no NetworkPolicies selecting the pod (and cluster
policy otherwise allows the traffic), OR if the traffic matches at least
one egress rule across all of the NetworkPolicy objects whose podSelector
matches the pod. If this field is empty then this NetworkPolicy limits all
outgoing traffic (and serves solely to ensure that the pods it selects are
isolated by default). This field is beta-level in 1.8
ingress <[]Object>
List of ingress rules to be applied to the selected pods. Traffic is
allowed to a pod if there are no NetworkPolicies selecting the pod OR if
the traffic source is the pod's local node, OR if the traffic matches at
least one ingress rule across all of the NetworkPolicy objects whose
podSelector matches the pod. If this field is empty then this NetworkPolicy
does not allow any traffic (and serves solely to ensure that the pods it
selects are isolated by default).
podSelector <Object> -required-
Selects the pods to which this NetworkPolicy object applies. The array of
ingress rules is applied to any pods selected by this field. Multiple
network policies can select the same set of pods. In this case, the ingress
rules for each are combined additively. This field is NOT optional and
follows standard label selector semantics. An empty podSelector matches all
pods in this namespace.
policyTypes <[]string>
List of rule types that the NetworkPolicy relates to. Valid options are
Ingress, Egress, or Ingress,Egress. If this field is not specified, it will
default based on the existence of Ingress or Egress rules; policies that
contain an Egress section are assumed to affect Egress, and all policies
(whether or not they contain an Ingress section) are assumed to affect
Ingress. If you want to write an egress-only policy, you must explicitly
specify policyTypes [ "Egress" ]. Likewise, if you want to write a policy
that specifies that no egress is allowed, you must specify a policyTypes
value that include "Egress" (since such a policy would not include an
Egress section and would otherwise default to just [ "Ingress" ]). This
field is beta-level in 1.8注意：如果是定义egress-only 策略，则需要显式的声明Egress。如果需要一个拒绝所有出流量的策略，需要在value中包含Egress，因为如果不包含egress，默认只包含ingress。
阻止所有ingress, 允许所有Egress
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: deny-all-ingress
spec:
podSelector: {}
policyTypes:
- Ingress允许所有ingress，允许所有Egress
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: deny-all-ingress
spec:
podSelector: {}
ingress:
- {}
policyTypes:
- Ingress阻止所有Egress
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: deny-all-ingress
spec:
podSelector: {}
policyTypes:
- Egress案例：
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: test-network-policy
namespace: default
spec:
podSelector:
matchLabels:
role: db
policyTypes:
- Ingress
- Egress
ingress:
- from:
- ipBlock:
cidr: 172.17.0.0/16
except:
- 172.17.1.0/24
- namespaceSelector:
matchLabels:
project: myproject
- podSelector:
matchLabels:
role: frontend
ports:
- protocol: TCP
port: 6379
egress:
- to:
- ipBlock:
cidr: 10.0.0.0/24
ports:
- protocol: TCP
port: 5978总结
原文：https://www.cnblogs.com/pythonPath/p/11267397.html