kubernetes Network Communication

Problems to be solved

• Communication between different containers within the same pod, local
• Communication between Pod s
• Communication between pod and Service: PodIP<--->ClusterIP
• Service communicates with external clusters

CNI:

• flannel
• calico
• canel
• kube-router

Solution:

• Virtual Bridge
• Multiplex: MacVLAN
• Hardware switching: SR-IOV

flannel

View the flannel configuration file for the cluster

cat /etc/cni/net.d/10-flannel.conflist

Pods with different namespace s that do not support network policies can communicate with each other

Backend Supported

• Vxlan
  • vxlan
  • Directrouting
• host-gw: Host Gateway
• UDP: Low efficiency

Configuration parameters for flannel:

• network

  Network addresses in CIRD format:

  10.244.0.0/16 ->

  master: 10.244.0.0/24

  ​ node1: 10.244.1.0/24

  ​ ...

  node255: 10.244.255.0/24

• SubnetLen

  How long mask to use on the node Default 24 bits

• SubnetMin and SubnetMax

  The smallest subnet segment in a segment and the largest subnet segment.

• Backend: Select the type of flannel

Modify flannel type

Modify configuration file kube-flannel.yaml

  net-conf.json: |
    {
      "Network": "172.20.0.0/16",
      "Backend": {
        "Type": "vxlan"
        "Direcrouting": true
      }
    }

Calico/Cannel

Can provide network policy

https://docs.projectcalico.org/v3.5/getting-started/kubernetes/installation/other

networkpolicy.spec

   egress   <[]Object>
     List of egress rules to be applied to the selected pods. Outgoing traffic
     is allowed if there are no NetworkPolicies selecting the pod (and cluster
     policy otherwise allows the traffic), OR if the traffic matches at least
     one egress rule across all of the NetworkPolicy objects whose podSelector
     matches the pod. If this field is empty then this NetworkPolicy limits all
     outgoing traffic (and serves solely to ensure that the pods it selects are
     isolated by default). This field is beta-level in 1.8

   ingress  <[]Object>
     List of ingress rules to be applied to the selected pods. Traffic is
     allowed to a pod if there are no NetworkPolicies selecting the pod OR if
     the traffic source is the pod's local node, OR if the traffic matches at
     least one ingress rule across all of the NetworkPolicy objects whose
     podSelector matches the pod. If this field is empty then this NetworkPolicy
     does not allow any traffic (and serves solely to ensure that the pods it
     selects are isolated by default).

   podSelector  <Object> -required-
     Selects the pods to which this NetworkPolicy object applies. The array of
     ingress rules is applied to any pods selected by this field. Multiple
     network policies can select the same set of pods. In this case, the ingress
     rules for each are combined additively. This field is NOT optional and
     follows standard label selector semantics. An empty podSelector matches all
     pods in this namespace.

   policyTypes  <[]string>
     List of rule types that the NetworkPolicy relates to. Valid options are
     Ingress, Egress, or Ingress,Egress. If this field is not specified, it will
     default based on the existence of Ingress or Egress rules; policies that
     contain an Egress section are assumed to affect Egress, and all policies
     (whether or not they contain an Ingress section) are assumed to affect
     Ingress. If you want to write an egress-only policy, you must explicitly
     specify policyTypes [ "Egress" ]. Likewise, if you want to write a policy
     that specifies that no egress is allowed, you must specify a policyTypes
     value that include "Egress" (since such a policy would not include an
     Egress section and would otherwise default to just [ "Ingress" ]). This
     field is beta-level in 1.8

Note: If you are defining an egress-only policy, you need to explicitly declare Egress.If you need a policy that rejects all outgoing traffic, you need to include Egress in the value, because if you do not include egress, only ingress is included by default.

Block all ingress, allow all Egress

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all-ingress
spec:
  podSelector: {}
  policyTypes:
  - Ingress

Allow all ingress, allow all Egress

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all-ingress
spec:
  podSelector: {}
  ingress:
  - {}
  policyTypes:
  - Ingress

Block all Egress

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all-ingress
spec:
  podSelector: {}
  policyTypes:
  - Egress

Case:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: test-network-policy
  namespace: default
spec:
  podSelector:
    matchLabels:
      role: db
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - ipBlock:
        cidr: 172.17.0.0/16
        except:
        - 172.17.1.0/24
    - namespaceSelector:
        matchLabels:
          project: myproject
    - podSelector:
        matchLabels:
          role: frontend
    ports:
    - protocol: TCP
      port: 6379
  egress:
  - to:
    - ipBlock:
        cidr: 10.0.0.0/24
    ports:
    - protocol: TCP
      port: 5978

summary

1. NetworkPolicy is valid for pod s in namespace.
2. Default ingress prohibited, egreess released.To disable egress by default, you need to include egress in the value of policyTypes.
3. NetworkPolicy is similar to a firewall in defining traffic matches.
4. In general, a pod that provides a service should be defined by a rule
   • Close all inbound and outbound stacks by default
   • Release all in this namespace
   • Define external traffic