You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -62,33 +62,50 @@ Network policies are implemented by the [network plugin](/docs/concepts/extend-k
62
62
创建一个 NetworkPolicy 资源对象而没有控制器来使它生效的话，是没有任何作用的。
63
63
64
64
<!--
65
-
## Isolated and Non-isolated Pods
65
+
## The Two Sorts of Pod Isolation
66
66
67
-
By default, pods are non-isolated; they accept traffic from any source.
67
+
There are two sorts of isolation for a pod: isolation for egress, and isolation for ingress. They concern what connections may be established. "Isolation" here is not absolute, rather it means "some restrictions apply". The alternative, "non-isolated for $direction", means that no restrictions apply in the stated direction. The two sorts of isolation (or not) are declared independently, and are both relevant for a connection from one pod to another.
68
+
-->
68
69
69
-
Pods become isolated by having a NetworkPolicy that selects them. Once there is any NetworkPolicy in a namespace selecting a particular pod, that pod will reject any connections that are not allowed by any NetworkPolicy. (Other pods in the namespace that are not selected by any NetworkPolicy will continue to accept all traffic.)
70
+
## Pod 隔离的两种类型
70
71
71
-
Network policies do not conflict; they are additive. If any policy or policies select a pod, the pod is restricted to what is allowed by the union of those policies' ingress/egress rules. Thus, order of evaluation does not affect the policy result.
72
+
Pod 有两种隔离: 出口的隔离和入口的隔离。它们涉及到可以建立哪些连接。
73
+
这里的“隔离”不是绝对的，而是意味着“有一些限制”。
74
+
另外的，“非隔离方向”意味着在所述方向上没有限制。这两种隔离（或不隔离）是独立声明的，
75
+
并且都与从一个 Pod 到另一个 Pod 的连接有关。
72
76
73
-
For a network flow between two pods to be allowed, both the egress policy on the source pod and the ingress policy on the destination pod need to allow the traffic. If either the egress policy on the source, or the ingress policy on the destination denies the traffic, the traffic will be denied.
77
+
<!--
78
+
By default, a pod is non-isolated for egress; all outbound connections are allowed. A pod is isolated for egress if there is any NetworkPolicy that both selects the pod and has "Egress" in its `policyTypes`; we say that such a policy applies to the pod for egress. When a pod is isolated for egress, the only allowed connections from the pod are those allowed by the `egress` list of some NetworkPolicy that applies to the pod for egress. The effects of those `egress` lists combine additively.
79
+
-->
80
+
81
+
默认情况下，一个 Pod 的出口是非隔离的，即所有外向连接都是被允许的。如果有任何的 NetworkPolicy
82
+
选择该 Pod 并在其 `policyTypes` 中包含 “Egress”，则该 Pod 是出口隔离的，
83
+
我们称这样的策略适用于该 Pod 的出口。当一个 Pod 的出口被隔离时，
84
+
唯一允许的来自 Pod 的连接是适用于出口的 Pod 的某个 NetworkPolicy 的 `egress` 列表所允许的连接。
85
+
这些 `egress` 列表的效果是相加的。
86
+
87
+
<!--
88
+
By default, a pod is non-isolated for ingress; all inbound connections are allowed. A pod is isolated for ingress if there is any NetworkPolicy that both selects the pod and has "Ingress" in its `policyTypes`; we say that such a policy applies to the pod for ingress. When a pod is isolated for ingress, the only allowed connections into the pod are those from the pod's node and those allowed by the `ingress` list of some NetworkPolicy that applies to the pod for ingress. The effects of those `ingress` lists combine additively.
74
89
-->
75
-
## 隔离和非隔离的 Pod {#isolated-and-non-isolated-pods}
76
90
77
-
默认情况下，Pod 是非隔离的，它们接受任何来源的流量。
91
+
默认情况下，一个 Pod 对入口是非隔离的，即所有入站连接都是被允许的。如果有任何的 NetworkPolicy
92
+
选择该 Pod 并在其 `policyTypes` 中包含 “Ingress”，则该 Pod 被隔离入口，
93
+
我们称这种策略适用于该 Pod 的入口。 当一个 Pod 的入口被隔离时，唯一允许进入该 Pod
94
+
的连接是来自该 Pod 节点的连接和适用于入口的 Pod 的某个 NetworkPolicy 的 `ingress`
95
+
列表所允许的连接。这些 `ingress` 列表的效果是相加的。
78
96
79
-
Pod 在被某 NetworkPolicy 选中时进入被隔离状态。
80
-
一旦名字空间中有 NetworkPolicy 选择了特定的 Pod，该 Pod 会拒绝该 NetworkPolicy
81
-
所不允许的连接。
82
-
（名字空间下其他未被 NetworkPolicy 所选择的 Pod 会继续接受所有的流量）
97
+
<!--
98
+
Network policies do not conflict; they are additive. If any policy or policies apply to a given pod for a given direction, the connections allowed in that direction from that pod is the union of what the applicable policies allow. Thus, order of evaluation does not affect the policy result.
99
+
100
+
For a connection from a source pod to a destination pod to be allowed, both the egress policy on the source pod and the ingress policy on the destination pod need to allow the connection. If either side does not allow the connection, it will not happen.
101
+
-->
83
102
84
-
网络策略不会冲突，它们是累积的。
85
-
如果任何一个或多个策略选择了一个 Pod, 则该 Pod 受限于这些策略的
86
-
入站（Ingress）/出站（Egress）规则的并集。因此评估的顺序并不会影响策略的结果。
103
+
网络策略是相加的，所以不会产生冲突。如果策略适用于 Pod 某一特定方向的流量，
104
+
Pod 在对应方向所允许的连接是适用的网络策略所允许的集合。
105
+
因此，评估的顺序不影响策略的结果。
87
106
88
-
为了允许两个 Pods 之间的网络数据流，源端 Pod 上的出站（Egress）规则和
89
-
目标端 Pod 上的入站（Ingress）规则都需要允许该流量。
90
-
如果源端的出站（Egress）规则或目标端的入站（Ingress）规则拒绝该流量，
91
-
则流量将被拒绝。
107
+
要允许从源 Pod 到目的 Pod 的连接，源 Pod 的出口策略和目的 Pod 的入口策略都需要允许连接。
108
+
如果任何一方不允许连接，建立连接将会失败。
92
109
93
110
<!--
94
111
## The NetworkPolicy resource {#networkpolicy-resource}
@@ -141,7 +158,7 @@ spec:
141
158
port: 5978
142
159
```
143
160
144
-
<!--
161
+
<!--
145
162
POSTing this to the API server for your cluster will have no effect unless your chosen networking solution supports network policy.
contains a single `from` element allowing connections from Pods with the label `role=client` in namespaces with the label `user=alice`. But *this* policy:
267
284
-->
268
285
在 `from` 数组中仅包含一个元素，只允许来自标有 `role=client` 的 Pod 且
@@ -339,8 +356,8 @@ You can create a "default" isolation policy for a namespace by creating a Networ
The above rule allows any Pod with label `db` on the namespace `default` to communicate
478
-
with any IP within the range `10.0.0.0/24` over TCP, provided that the target
494
+
The above rule allows any Pod with label `role=db` on the namespace `default` to communicate
495
+
with any IP within the range `10.0.0.0/24` over TCP, provided that the target
479
496
port is between the range 32000 and 32768.
480
497
-->
481
-
上面的规则允许名字空间 `default` 中所有带有标签 `db` 的 Pod 使用 TCP 协议
498
+
上面的规则允许名字空间 `default` 中所有带有标签 `role=db` 的 Pod 使用 TCP 协议
482
499
与 `10.0.0.0/24` 范围内的 IP 通信，只要目标端口介于 32000 和 32768 之间就可以。
483
500
484
501
<!--
485
502
The following restrictions apply when using this field:
486
503
* As a beta feature, this is enabled by default. To disable the `endPort` field at a cluster level, you (or your cluster administrator) need to disable the `NetworkPolicyEndPort` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/) for the API server with `-feature-gates=NetworkPolicyEndPort=false,…`.
487
-
* The `endPort` field must be equal than or greater to the `port` field.
504
+
* The `endPort` field must be equal to or greater than the `port` field.
488
505
* `endPort` can only be defined if `port` is also defined.
489
506
* Both ports must be numeric.
490
507
-->
@@ -493,7 +510,7 @@ The following restrictions apply when using this field:
0 commit comments