使用网络策略配置多租户隔离

编辑

使用网络策略配置多租户隔离

作为集群管理员，您可以配置网络策略以提供多租户网络隔离。

如本节所述配置网络策略可提供类似于早期版本的Red Hat OpenShift Service on AWS中OpenShift SDN多租户模式的网络隔离。

编辑

您可以配置您的项目，使其与其他项目命名空间中的Pod和服务隔离。

先决条件

您的集群使用支持NetworkPolicy对象的网络插件，例如OVN-Kubernetes网络插件，并设置mode: NetworkPolicy。
您已安装OpenShift CLI (oc)。
您已使用具有admin权限的用户登录到集群。

步骤

创建以下NetworkPolicy对象

名为allow-from-openshift-ingress的策略。

$ cat << EOF| oc create -f -
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-from-openshift-ingress
spec:
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          policy-group.network.openshift.io/ingress: ""
  podSelector: {}
  policyTypes:
  - Ingress
EOF

policy-group.network.openshift.io/ingress: ""是OVN-Kubernetes的首选命名空间选择器标签。

名为allow-from-openshift-monitoring的策略

$ cat << EOF| oc create -f -
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-from-openshift-monitoring
spec:
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          network.openshift.io/policy-group: monitoring
  podSelector: {}
  policyTypes:
  - Ingress
EOF

名为allow-same-namespace的策略

$ cat << EOF| oc create -f -
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: allow-same-namespace
spec:
  podSelector:
  ingress:
  - from:
    - podSelector: {}
EOF

名为allow-from-kube-apiserver-operator的策略

$ cat << EOF| oc create -f -
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-from-kube-apiserver-operator
spec:
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: openshift-kube-apiserver-operator
      podSelector:
        matchLabels:
          app: kube-apiserver-operator
  policyTypes:
  - Ingress
EOF

更多详细信息，请参阅新的kube-apiserver-operator webhook控制器验证webhook的健康状况。

可选：要确认网络策略是否存在于您当前的项目中，请输入以下命令

$ oc describe networkpolicy

示例输出

Name:         allow-from-openshift-ingress
Namespace:    example1
Created on:   2020-06-09 00:28:17 -0400 EDT
Labels:       <none>
Annotations:  <none>
Spec:
  PodSelector:     <none> (Allowing the specific traffic to all pods in this namespace)
  Allowing ingress traffic:
    To Port: <any> (traffic allowed to all ports)
    From:
      NamespaceSelector: network.openshift.io/policy-group: ingress
  Not affecting egress traffic
  Policy Types: Ingress


Name:         allow-from-openshift-monitoring
Namespace:    example1
Created on:   2020-06-09 00:29:57 -0400 EDT
Labels:       <none>
Annotations:  <none>
Spec:
  PodSelector:     <none> (Allowing the specific traffic to all pods in this namespace)
  Allowing ingress traffic:
    To Port: <any> (traffic allowed to all ports)
    From:
      NamespaceSelector: network.openshift.io/policy-group: monitoring
  Not affecting egress traffic
  Policy Types: Ingress