postgresql - 如何阻止来自Kubernetes中其他 namespace 的到DB Pod和服务(DNS)的流量？

Question

我已经在2个命名空间中创建了2个租户(tenant1，tenant2)tenant1-namespace，tenant2-namespace

每个租户都有db pod及其服务

如何隔离数据库Pod /服务，即如何限制其 namespace 中的Pod /服务访问其他租户数据库Pod？

我已经为每个租户使用了服务帐户并应用了网络策略，以便隔离 namespace 。

kubectl get svc --all-namespaces

tenant1-namespace   grafana-app            LoadBalancer   10.64.7.233    104.x.x.x   3000:31271/TCP   92m
tenant1-namespace   postgres-app           NodePort       10.64.2.80     <none>      5432:31679/TCP   92m
tenant2-namespace   grafana-app            LoadBalancer   10.64.14.38    35.x.x.x    3000:32226/TCP   92m
tenant2-namespace   postgres-app           NodePort       10.64.2.143    <none>      5432:31912/TCP   92m

所以

我想限制grafana-app仅在他的 namespace 中使用他的postgres db，而不在其他 namespace 中使用。

但是问题是使用DNS限定服务名称( app-name.namespace-name.svc.cluster.local)
它允许彼此访问数据库pod(命名空间tenant1-namespace中的grafana-app可以通过 postgres-app.tenant2-namespace.svc.cluster.local访问其他tenant2-namespace中的postgres db

更新:网络策略

1)

kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: deny-from-other-namespaces
spec:
  podSelector:
    matchLabels:
  ingress:
  - from:
    - podSelector: {}

2)

kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: web-allow-external
spec:
  podSelector:
    matchLabels:
      app: grafana-app
  ingress:
  - from: []

Answer 1

您的NetworkPolicy对象是正确的，我为它们创建了一个示例，并将演示波纹管。

如果您仍然可以使用FQDN访问另一个 namespace 上的服务的，则可能未在集群上完全启用。

运行 NetworkPolicy并查找以下两个片段:

在描述的开头，它显示是否在Master级别上启用了NetworkPolicy插件，它应该像这样:

addonsConfig:
networkPolicyConfig: {}

在说明的中间，您可以找到是否在节点上启用了NetworkPolicy的。它应该看起来像这样:

name: cluster-1
network: default
networkConfig:
 network: projects/myproject/global/networks/default
 subnetwork: projects/myproject/regions/us-central1/subnetworks/default
networkPolicy:
 enabled: true
 provider: CALICO

如果以上任何一项不同，请在此处检查:How to Enable Network Policy in GKE

复制:

我将创建一个简单的示例，将对tenant1使用gcloud container clusters describe "CLUSTER_NAME" --zone "ZONE"图像，对tenant2使用gcr.io/google-samples/hello-app:1.0，因此查看连接位置更简单，但我将使用您的环境名称:

$ kubectl create namespace tenant1
namespace/tenant1 created
$ kubectl create namespace tenant2
namespace/tenant2 created

$ kubectl run -n tenant1 grafana-app --generator=run-pod/v1 --image=gcr.io/google-samples/hello-app:1.0 
pod/grafana-app created
$ kubectl run -n tenant1 postgres-app --generator=run-pod/v1 --image=gcr.io/google-samples/hello-app:1.0 
pod/postgres-app created

$ kubectl run -n tenant2 grafana-app --generator=run-pod/v1 --image=gcr.io/google-samples/hello-app:2.0 
pod/grafana-app created
$ kubectl run -n tenant2 postgres-app --generator=run-pod/v1 --image=gcr.io/google-samples/hello-app:2.0 
pod/postgres-app created

$ kubectl expose pod -n tenant1 grafana-app --port=8080 --type=LoadBalancer
service/grafana-app exposed
$ kubectl expose pod -n tenant1 postgres-app --port=8080 --type=NodePort
service/postgres-app exposed

$ kubectl expose pod -n tenant2 grafana-app --port=8080 --type=LoadBalancer
service/grafana-app exposed
$ kubectl expose pod -n tenant2 postgres-app --port=8080 --type=NodePort
service/postgres-app exposed

$ kubectl get all -o wide -n tenant1
NAME               READY   STATUS    RESTARTS   AGE    IP          NODE                                         
pod/grafana-app    1/1     Running   0          100m   10.48.2.4   gke-cluster-114-default-pool-e5df7e35-ez7s
pod/postgres-app   1/1     Running   0          100m   10.48.0.6   gke-cluster-114-default-pool-e5df7e35-c68o

NAME                   TYPE           CLUSTER-IP   EXTERNAL-IP     PORT(S)          AGE   SELECTOR
service/grafana-app    LoadBalancer   10.1.23.39   34.72.118.149   8080:31604/TCP   77m   run=grafana-app
service/postgres-app   NodePort       10.1.20.92   <none>          8080:31033/TCP   77m   run=postgres-app

$ kubectl get all -o wide -n tenant2
NAME               READY   STATUS    RESTARTS   AGE    IP          NODE                                         
pod/grafana-app    1/1     Running   0          76m    10.48.4.8   gke-cluster-114-default-pool-e5df7e35-ol8n
pod/postgres-app   1/1     Running   0          100m   10.48.4.5   gke-cluster-114-default-pool-e5df7e35-ol8n

NAME                   TYPE           CLUSTER-IP    EXTERNAL-IP      PORT(S)          AGE   SELECTOR
service/grafana-app    LoadBalancer   10.1.17.50    104.154.135.69   8080:30534/TCP   76m   run=grafana-app
service/postgres-app   NodePort       10.1.29.215   <none>           8080:31667/TCP   77m   run=postgres-app

现在，我们部署两个规则:第一个规则阻止来自命名空间外部的所有流量，第二个允许从命名空间外部进入gcr.io/google-samples/hello-app:2.0:

$ cat default-deny-other-ns.yaml 
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: deny-from-other-namespaces
spec:
  podSelector:
    matchLabels:
  ingress:
  - from:
    - podSelector: {}

$ cat allow-grafana-ingress.yaml 
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: web-allow-external
spec:
  podSelector:
    matchLabels:
      run: grafana-app
  ingress:
  - from: []

让我们回顾Network Policy Isolation的规则:

By default, pods are non-isolated; they accept traffic from any source.

Pods become isolated by having a NetworkPolicy that selects them. Once there is any NetworkPolicy in a namespace selecting a particular pod, that pod will reject any connections that are not allowed by any NetworkPolicy. (Other pods in the namespace that are not selected by any NetworkPolicy will continue to accept all traffic.)

Network policies do not conflict; they are additive. If any policy or policies select a pod, the pod is restricted to what is allowed by the union of those policies' ingress/egress rules. Thus, order of evaluation does not affect the policy result.

然后，我们将规则应用于两个 namespace ，因为规则的范围是它分配给的 namespace :

$ kubectl apply -n tenant1 -f default-deny-other-ns.yaml 
networkpolicy.networking.k8s.io/deny-from-other-namespaces created
$ kubectl apply -n tenant2 -f default-deny-other-ns.yaml 
networkpolicy.networking.k8s.io/deny-from-other-namespaces created

$ kubectl apply -n tenant1 -f allow-grafana-ingress.yaml 
networkpolicy.networking.k8s.io/web-allow-external created
$ kubectl apply -n tenant2 -f allow-grafana-ingress.yaml 
networkpolicy.networking.k8s.io/web-allow-external created

现在进行最终测试，我将在grafana-app中的grafana-app内登录，并尝试在两个命名空间中均到达tenant1并检查输出:

$ kubectl exec -n tenant1 -it grafana-app -- /bin/sh
/ ### POSTGRES SAME NAMESPACE ###
/ # wget -O- postgres-app:8080
Connecting to postgres-app:8080 (10.1.20.92:8080)
Hello, world!
Version: 1.0.0
Hostname: postgres-app

/ ### GRAFANA OTHER NAMESPACE ###
/ # wget -O- --timeout=1 http://grafana-app.tenant2.svc.cluster.local:8080
Connecting to grafana-app.tenant2.svc.cluster.local:8080 (10.1.17.50:8080)
Hello, world!
Version: 2.0.0
Hostname: grafana-app

/ ### POSTGRES OTHER NAMESPACE ###
/ # wget -O- --timeout=1 http://postgres-app.tenant2.svc.cluster.local:8080
Connecting to postgres-app.tenant2.svc.cluster.local:8080 (10.1.29.215:8080)
wget: download timed out

您可以看到DNS已解析，但是networkpolicy阻止了对后端Pod的访问。

如果仔细检查后在主节点和节点上启用了NetworkPolicy，您仍然会遇到相同的问题，请在评论中告知我，我们可以进一步进行深入研究。