更新NetworkPolicy文档

docs/guide/networkpolicy.md

@@ -1 +1,189 @@
 ## Network Policy
+
+`Network Policy`提供了基于策略的网络控制，用于隔离应用并减少攻击面。它使用标签选择器模拟传统的分段网络，并通过策略控制它们之间的流量以及来自外部的流量；目前基于`linux iptables`实现，使用类似`nf_conntrack`检查记录网络流量`session`从而决定流量是否阻断；因此它是`状态检测防火墙`。
+
+- `k8s v1.7`版本以后，Network Policy已经默认可用；`v1.6`以及之前版本需要在kube-apiserver中开启extensions/v1beta1/networkpolicies
+- 网络插件要支持 Network Policy，如 Calico、Romana、Weave Net
+
+### 简单示例
+
+实验环境：k8s v1.9, calico 2.6.5
+
+首先部署测试用nginx服务
+
+``` bash
+$ kubectl run nginx --image=nginx --replicas=3 --port=80 --expose
+# 验证测试nginx服务
+$ kubectl get pod -o wide 
+NAME                     READY     STATUS    RESTARTS   AGE       IP               NODE
+nginx-7587c6fdb6-p2fpz   1/1       Running   0          55m       172.20.125.2     10.0.96.7
+nginx-7587c6fdb6-pbw7c   1/1       Running   0          55m       172.20.124.2     10.0.96.6
+nginx-7587c6fdb6-v48db   1/1       Running   0          55m       172.20.121.195   10.0.96.4
+$ kubectl get svc nginx
+NAME      TYPE        CLUSTER-IP    EXTERNAL-IP   PORT(S)   AGE
+nginx     ClusterIP   10.68.7.183   <none>        80/TCP    1h
+```
+默认情况下，其他pod可以访问nginx服务
+
+``` bash
+$ kubectl run busy1 --rm -it --image=busybox /bin/sh
+If you don't see a command prompt, try pressing enter.
+/ # wget --spider --timeout=1 nginx
+Connecting to nginx (10.68.7.183:80)
+```
+创建`DefaultDeny Network Policy`后，其他Pod（包括namespace外部）不能访问nginx
+
+``` bash
+$ cat > default-deny.yaml << EOF
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-deny
+spec:
+  podSelector: {}
+  policyTypes:
+  - Ingress
+EOF
+$ kubectl create -f default-deny.yaml
+networkpolicy "default-deny" created
+$ kubectl run busy1 --rm -it --image=busybox /bin/sh
+If you don't see a command prompt, try pressing enter.
+/ # wget --spider --timeout=1 nginx
+Connecting to nginx (10.68.7.183:80)
+wget: download timed out
+```
+创建一个允许带有access=true的Pod访问nginx的网络策略
+
+``` bash
+$ cat > nginx-policy.yaml << EOF
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: access-nginx
+spec:
+  podSelector:
+    matchLabels:
+      run: nginx
+  ingress:
+  - from:
+    - podSelector:
+        matchLabels:
+          access: "true"
+EOF
+$ kubectl create -f nginx-policy.yaml
+networkpolicy "access-nginx" created
+
+# 不带access=true标签的Pod还是无法访问nginx服务
+$ kubectl run busy1 --rm -it --image=busybox /bin/sh
+If you don't see a command prompt, try pressing enter.
+/ # wget --spider --timeout=1 nginx
+Connecting to nginx (10.68.7.183:80)
+wget: download timed out
+
+# 而带有access=true标签的Pod可以访问nginx服务
+$ kubectl run busy2 --rm -it --labels="access=true" --image=busybox /bin/sh
+If you don't see a command prompt, try pressing enter.
+/ # wget --spider --timeout=1 nginx
+Connecting to nginx (10.68.7.183:80)
+```
+
+### 示例策略解读
+
+``` bash
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: test-network-policy
+  namespace: default
+spec:
+  podSelector:
+    matchLabels:
+      role: db
+  policyTypes:
+  - Ingress
+  - Egress
+  ingress:
+  - from:
+    - ipBlock:
+        cidr: 172.17.0.0/16
+        except:
+        - 172.17.1.0/24
+    - namespaceSelector:
+        matchLabels:
+          project: myproject
+    - podSelector:
+        matchLabels:
+          role: frontend
+    ports:
+    - protocol: TCP
+      port: 6379
+  egress:
+  - to:
+    - ipBlock:
+        cidr: 10.0.0.0/24
+    ports:
+    - protocol: TCP
+      port: 5978
+```
+- 策略作用的对象Pods：default命名空间下带有`role=db`标签的Pod
+  - 内向流量策略
+    - 允许属于`172.17.0.0/16`网段但不属于`172.17.1.0/24`的源地址访问该对象Pods的TCP 6379端口
+    - 允许带有project=myprojects标签的namespace中所有Pod访问该对象Pods的TCP 6379端口
+    - 允许default命名空间下带有role=frontend标签的Pod访问该对象Pods的TCP 6379端口
+    - 拒绝其他所有主动访问该对象Pods的网络流量
+  - 外向流量策略
+    - 允许该对象Pods主动访问目的地址属于`10.0.0.0/24`网段且目的端口为TCP 5978的流量
+    - 拒绝该对象Pods其他所有主动外向网络流量
+
+### 使用场景
+
+参考阅读[ahmetb/kubernetes-network-policy-recipes](https://github.com/ahmetb/kubernetes-network-policy-recipes) 该项目举例一些使用NetworkPolicy的场景，并有形象的配图
+
+#### 拒绝其他namespaces访问服务
+
+![deny_from_other_namespaces](../../pics/deny_from_other_namespaces.gif)
+
++ 场景1：你的k8s集群应用按照namespaces区分生产、测试环境，你要确保生产环境不会受到测试环境错误访问影响
++ 场景2：你的k8s集群有多租户应用采用namespaces区分的，你要确保多租户之间的应用隔离
+
+在你需要隔离的命名空间创建如下策略:
+
+``` bash
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  namespace: your-ns
+  name: deny-other-namespaces
+spec:
+  podSelector:
+    matchLabels:
+  ingress:
+  - from:
+    - podSelector: {}
+```
+
+#### 允许外部访问服务
+
++ 场景：暴露特定Pod的特定端口给外部访问
+
+![allow_from_external](../../pics/allow_from_external.gif)
+
+``` bash
+# 创建示例应用待暴露服务
+$ kubectl run web --image=nginx --labels=app=web --port 80 --expose
+
+# 创建网络策略
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: web-allow-external
+spec:
+  podSelector:
+    matchLabels:
+      app: web
+  ingress:
+  - from: []
+    port:
+    - protocol: TCP
+      port: 80
+```