You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
本文可以帮助您开始使用 Kubernetes 的 [NetworkPolicy API](/docs/concepts/services-networking/network-policies/)声明网络策略去管理 Pod 之间的通信
13
-
14
-
16
+
<!--
17
+
This document helps you get started using the Kubernetes [NetworkPolicy API](/docs/concepts/services-networking/network-policies/) to declare network policies that govern how pods communicate with each other.
18
+
-->
19
+
本文可以帮助您开始使用 Kubernetes 的 [NetworkPolicy API](/zh/docs/concepts/services-networking/network-policies/) 声明网络策略去管理 Pod 之间的通信
15
20
16
21
## {{% heading "prerequisites" %}}
17
22
23
+
{{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}
18
24
25
+
<!--
26
+
Make sure you've configured a network provider with network policy support. There are a number of network providers that support NetworkPolicy, including:
The above list is sorted alphabetically by product name, not by recommendation or preference. This example is valid for a Kubernetes cluster using any of these providers.
44
+
-->
45
+
{{< note >}}
46
+
以上列表是根据产品名称按字母顺序排序，而不是按推荐或偏好排序。
47
+
下面示例对于使用了上面任何提供商的 Kubernetes 集群都是有效的
48
+
{{< /note >}}
30
49
31
50
<!-- steps -->
32
51
52
+
<!--
53
+
## Create an `nginx` deployment and expose it via a service
33
54
34
-
## 创建一个`nginx` deployment 并且通过服务将其暴露
35
-
55
+
To see how Kubernetes network policy works, start off by creating an `nginx` Deployment.
The above commands create a Deployment with an nginx Pod and expose the Deployment through a Service named `nginx`. The `nginx` Pod and Deployment are found in the `default` namespace.
Service 暴露出来。名为 `nginx` 的 Pod 和 Deployment 都位于 `default`
85
+
名字空间内。
48
86
49
87
```console
50
-
$ kubectl get svc,pod
88
+
kubectl get svc,pod
89
+
```
90
+
```none
51
91
NAME CLUSTER-IP EXTERNAL-IP PORT(S) AGE
52
92
svc/kubernetes 10.100.0.1 <none> 443/TCP 46m
53
93
svc/nginx 10.100.0.16 <none> 80/TCP 33s
@@ -56,93 +96,128 @@ NAME READY STATUS RESTARTS AGE
56
96
po/nginx-701339712-e0qfq 1/1 Running 0 35s
57
97
```
58
98
99
+
<!--
100
+
## Test the service by accessing it from another Pod
59
101
60
-
## 测试服务能够被其它的 pod 访问
61
-
62
-
63
-
您应该可以从其它的 pod 访问这个新的 `nginx` 服务。为了验证它，从 default 命名空间下的其它 pod 来访问该服务。请您确保在该命名空间下没有执行孤立动作。
102
+
You should be able to access the new `nginx` service from other Pods. To access the `nginx` Service from another Pod in the `default` namespace, start a busybox container:
103
+
-->
104
+
## 通过从 Pod 访问服务对其进行测试
64
105
65
-
66
-
启动一个 busybox 容器，然后在容器中使用 `wget` 命令去访问 `nginx` 服务：
106
+
您应该可以从其它的 Pod 访问这个新的 `nginx` 服务。
107
+
要从 default 命名空间中的其它s Pod 来访问该服务。可以启动一个 busybox 容器：
67
108
68
109
```console
69
-
$ kubectl run busybox --rm -ti --image=busybox /bin/sh
70
-
Waiting for pod default/busybox-472357175-y0m47 to be running, status is Pending, pod ready: false
110
+
kubectl run busybox --rm -ti --image=busybox /bin/sh
111
+
```
71
112
72
-
Hit enter for command prompt
113
+
<!--
114
+
In your shell, run the following command:
115
+
-->
116
+
在你的 Shell 中，运行下面的命令：
73
117
74
-
/ # wget --spider --timeout=1 nginx
118
+
```shell
119
+
wget --spider --timeout=1 nginx
120
+
```
121
+
```none
75
122
Connecting to nginx (10.100.0.16:80)
76
-
/ #
123
+
remote file exists
77
124
```
78
125
126
+
<!--
127
+
## Limit access to the `nginx` service
79
128
80
-
## 限制访问 `nginx` 服务
129
+
To limit the access to the `nginx` service so that only Pods with the label `access: true` can query it, create a NetworkPolicy object as follows:
130
+
-->
131
+
## 限制 `nginx` 服务的访问
81
132
133
+
如果想限制对 `nginx` 服务的访问，只让那些拥有标签 `access: true` 的 Pod 访问它，
134
+
那么可以创建一个如下所示的 NetworkPolicy 对象：
82
135
83
-
如果说您想限制 `nginx` 服务，只让那些拥有标签 `access: true` 的 pod 访问它，那么您可以创建一个只允许从那些 pod 连接的 `NetworkPolicy`：
NetworkPolicy includes a `podSelector` which selects the grouping of Pods to which the policy applies. You can see this policy selects Pods with the label `app=nginx`. The label was automatically added to the Pod in the `nginx` Deployment. An empty `podSelector` selects all pods in the namespace.
147
+
-->
148
+
{{< note >}}
149
+
NetworkPolicy 中包含选择策略所适用的 Pods 集合的 `podSelector`。
150
+
你可以看到上面的策略选择的是带有标签 `app=nginx` 的 Pods。
151
+
此标签是被自动添加到 `nginx` Deployment 中的 Pod 上的。
152
+
如果 `podSelector` 为空，则意味着选择的是名字空间中的所有 Pods。
153
+
{{< /note >}}
101
154
102
-
## 为服务指定策略
155
+
<!--
156
+
## Assign the policy to the service
103
157
158
+
Use kubectl to create a NetworkPolicy from the above `nginx-policy.yaml` file:
0 commit comments