kubernetes（3）

nodeport在集群节点上绑定端口，一个端口对应一个服务

[root@k8s2 service]# vim myapp.yml
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: myapp
  name: myapp
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 80
  selector:
    app: myapp
  type: LoadBalancer
//使用 LoadBalancer 类型的 Service 可以在集群外部暴露一个负载均衡器，让外部用户能够轻松访问到集群内部的服务。
使用 LoadBalancer 类型的 Service 必须在 Kubernetes 集群部署在某些支持云服务商的基础设施上，否则该类型的 Service 无法正常工作。

业务域拆分

[root@k8s2 ingress]# vim ingress6.yml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /$1
  name: rewrite-ingress
spec:
  ingressClassName: nginx
  rules:
  - host: myapp.westos.org
    http:
      paths:
      - path: /user/(.*)
        pathType: Prefix
        backend:
          service:
            name: myapp-v1
            port:
              number: 80
      - path: /order/(.*)
        pathType: Prefix
        backend:
          service:
            name: myapp-v2
            port:
              number: 80

测试

 flannel网络插件

使用host-gw模式

[root@k8s2 ~]# kubectl -n kube-flannel edit  cm kube-flannel-cfg

重启pod生效

[root@k8s2 ~]# kubectl -n kube-flannel delete  pod --all

calico网络插件

部署

删除flannel插件、删除所有节点上flannel配置文件,避免冲突

[root@k8s2 ~]# kubectl delete  -f kube-flannel.yml
[root@k8s2 ~]# rm -f /etc/cni/net.d/10-flannel.conflist
[root@k8s3 ~]# rm -f /etc/cni/net.d/10-flannel.conflist
[root@k8s4 ~]# rm -f /etc/cni/net.d/10-flannel.conflist

下载部署文件、修改镜像路径、上传镜像

[root@k8s2 calico]# kubectl apply -f calico.yaml

重启所有集群节点，让pod重新分配IP

等待集群重启正常后测试网络

网络策略

限制pod流量

[root@k8s2 calico]# vim networkpolicy.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: test-network-policy
  namespace: default
spec:
  podSelector:
    matchLabels:
      app: myapp-v1
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              role: test
      ports:
        - protocol: TCP
          port: 80

控制的对象是具有app=myapp-v1标签的pod

此时访问svc是不通的

给测试pod添加指定标签后，可以访问

限制namespace流量

[root@k8s2 calico]# vim networkpolicy.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: test-network-policy
  namespace: default
spec:
  podSelector:
    matchLabels:
      app: myapp
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              project: test
        - podSelector:
            matchLabels:
              role: test
      ports:
        - protocol: TCP
          port: 80

[root@k8s2 ~]# kubectl create namespace test

给namespace添加指定标签

[root@k8s2 calico]# kubectl label ns test project=test

同时限制namespace和pod

[root@k8s2 calico]# vim networkpolicy.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: test-network-policy
  namespace: default
spec:
  podSelector:
    matchLabels:
      app: myapp
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              project: test
          podSelector:
            matchLabels:
              role: test
      ports:
        - protocol: TCP
          port: 80

给test命令空间中的pod添加指定标签后才能访问

[root@k8s2 calico]# kubectl -n test label pod demo role=test

限制集群外部流量

[root@k8s2 calico]# vim networkpolicy.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: test-network-policy
  namespace: default
spec:
  podSelector:
    matchLabels:
      app: myapp
  policyTypes:
    - Ingress
  ingress:
    - from:
        - ipBlock:
            cidr: 192.168.56.0/24
        - namespaceSelector:
            matchLabels:
              project: myproject
          podSelector:
            matchLabels:
              role: frontend
      ports:
        - protocol: TCP
          port: 80