作为空白数组的入口值和值 - {} 有什么区别?
What is the difference between ingress value as blank array and value - {}?
在 kubernetes 网络策略中,我们可以将 Ingress 值设置为空白数组,即 [] 或者我们也可以将值设置为 - {}
使用这两个值有什么区别?
我尝试的第一个 YAML - 它没有用
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: internal-policy
spec:
podSelector:
matchLabels:
name: internal
policyTypes: ["Ingress","Egress"]
ingress: []
egress:
- to:
- podSelector:
matchLabels:
name: mysql
ports:
- protocol: TCP
port: 3306
在 katacoda 场景中回答的第二个 YAML
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: internal-policy
namespace: default
spec:
podSelector:
matchLabels:
name: internal
policyTypes:
- Egress
- Ingress
ingress:
- {}
egress:
- to:
- podSelector:
matchLabels:
name: mysql
ports:
- protocol: TCP
port: 3306
在这两种情况下,您都指定了策略类型:入口和出口
- 在第一个例子中:
ingress: []
此规则(为空)和拒绝所有入口流量,(如果入口规则不在规范中,结果相同)。
您可以通过运行验证这一点:
kubectl describe networkpolicy internal-policy
Allowing ingress traffic:
<none> (Selected pods are isolated for ingress connectivity)
- 在第二个例子中:
ingress:
- {}
这条规则允许所有入口流量:
kubectl describe networkpolicy internal-policy
Allowing ingress traffic:
To Port: <any> (traffic allowed to all ports)
From: <any> (traffic not restricted by source)
根据文档:Network Policies
Ingress rules:
Each NetworkPolicy may include a list of whitelist ingress rules. Each rule allows traffic which matches both the from and ports sections.
希望对您有所帮助。
在 kubernetes 网络策略中,我们可以将 Ingress 值设置为空白数组,即 [] 或者我们也可以将值设置为 - {}
使用这两个值有什么区别?
我尝试的第一个 YAML - 它没有用
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: internal-policy
spec:
podSelector:
matchLabels:
name: internal
policyTypes: ["Ingress","Egress"]
ingress: []
egress:
- to:
- podSelector:
matchLabels:
name: mysql
ports:
- protocol: TCP
port: 3306
在 katacoda 场景中回答的第二个 YAML
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: internal-policy
namespace: default
spec:
podSelector:
matchLabels:
name: internal
policyTypes:
- Egress
- Ingress
ingress:
- {}
egress:
- to:
- podSelector:
matchLabels:
name: mysql
ports:
- protocol: TCP
port: 3306
在这两种情况下,您都指定了策略类型:入口和出口
- 在第一个例子中:
ingress: []
此规则(为空)和拒绝所有入口流量,(如果入口规则不在规范中,结果相同)。
您可以通过运行验证这一点:
kubectl describe networkpolicy internal-policy
Allowing ingress traffic:
<none> (Selected pods are isolated for ingress connectivity)
- 在第二个例子中:
ingress:
- {}
这条规则允许所有入口流量:
kubectl describe networkpolicy internal-policy
Allowing ingress traffic:
To Port: <any> (traffic allowed to all ports)
From: <any> (traffic not restricted by source)
根据文档:Network Policies
Ingress rules: Each NetworkPolicy may include a list of whitelist ingress rules. Each rule allows traffic which matches both the from and ports sections.
希望对您有所帮助。