Kubernetes NetworkPolicy配置后未生效问题排查求助

环境与配置信息 #

测试环境为WSL上的Kind Kubernetes集群，所有操作在networkpolicy命名空间下执行：

→ kubectl -n networkpolicy get ns networkpolicy
NAME            STATUS   AGE
networkpolicy   Active   174m

该命名空间下运行两个Pod：

→ kubectl -n networkpolicy get pods --show-labels -o wide
NAME         READY   STATUS    RESTARTS   AGE     IP            NODE                   NOMINATED NODE   READINESS GATES   LABELS
np-busybox   1/1     Running   0          151m    10.244.0.11   selfie-control-plane   <none>           <none>            app=client
np-nginx     1/1     Running   0          9m52s   10.244.0.12   selfie-control-plane   <none>           <none>            app=nginx

针对带app=nginx标签的np-nginx Pod，创建了如下NetworkPolicy：

→ kubectl -n networkpolicy describe networkpolicy
Name:         my-networkpolicy
Namespace:    networkpolicy
Created on:   2022-10-08 21:49:16 +0530 IST
Labels:       <none>
Annotations:  <none>
Spec:
  PodSelector:     app=nginx
  Allowing ingress traffic:
    <none> (Selected pods are isolated for ingress connectivity)
  Allowing egress traffic:
    <none> (Selected pods are isolated for egress connectivity)
  Policy Types: Ingress, Egress

问题 #

我理解：当NetworkPolicy指定Ingress和Egress类型但未配置允许规则时，会拒绝所有方向的连接，这个理解是否正确？

实际测试中，从np-busybox Pod中curl np-nginx的IP（10.244.0.12）仍能成功连接：

→ kubectl -n networkpolicy exec np-busybox -- curl -s 10.244.0.12 | html2text
****** Welcome to nginx! ******
If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.
For online documentation and support please refer to nginx.org.
Commercial support is available at nginx.com.
Thank you for using nginx.

请问操作哪里存在问题？

解答 #

你的理解是正确的：当NetworkPolicy声明了Ingress/Egress类型但未配置任何允许规则时，会拒绝对应方向的所有流量。策略未生效的核心原因是当前Kind集群使用的CNI插件不支持NetworkPolicy。

Kind默认使用的kindnet CNI插件不具备NetworkPolicy的管控能力，因此你创建的策略不会被执行，流量仍能正常通行。

解决方法 #

要在Kind集群中测试NetworkPolicy，需重新创建集群并使用支持NetworkPolicy的CNI插件（如Calico、Cilium），以Calico为例：

1. 创建禁用默认CNI的Kind集群：

kind create cluster --name selfie --config=- <<EOF
kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
networking:
  disableDefaultCNI: true
  podSubnet: 192.168.0.0/16
EOF

2. 获取Calico官方发布的manifest文件，部署插件：

kubectl apply -f calico.yaml

3. 重新部署你的Pod和NetworkPolicy，再次测试curl操作，此时策略会生效，流量会被拒绝。

内容的提问来源于stack exchange，提问作者vjwilson