Kubernetes 1.9 未应用出口策略

Question

我想拒绝所有出口流量。所以我创建了这个网络策略

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny
spec:
  podSelector: {}
  policyTypes:
  - Egress

然后我将它应用到命名空间

kubectl -n pps-api-gateway-ci apply -f ~/Documents/networkpolicy.yaml

为了测试这一点，我确实描述了网络策略

    kubectl -n pps-api-gateway-ci describe networkpolicy
    Name:         default-deny
    Namespace:    pps-api-gateway-ci
    Created on:   2018-05-29 13:50:52 -0700 PDT
    Labels:       <none>
    Annotations:  kubectl.kubernetes.io/last-applied-configuration= 
   {"apiVersion":"networking.k8s.io/v1","kind":"NetworkPolicy","metadata": 
   {"annotations":{},"name":"default-deny","namespace":"pps-api-gateway- 
   ci"},"spec"...
   Spec:
      PodSelector:     <none> (Allowing the specific traffic to all pods in this 
    namespace)
      Allowing ingress traffic:
        <none> (Selected pods are isolated for ingress connectivity)
       Allowing egress traffic:
        <none> (Selected pods are isolated for egress connectivity)
       Policy Types: Egress

然后我登录到那个容器

ping www.google.com

PING www.google.com (216.58.217.100): 56 data bytes
64 bytes from 216.58.217.100: icmp_seq=0 ttl=46 time=2.552 ms
64 bytes from 216.58.217.100: icmp_seq=1 ttl=46 time=1.835 ms
64 bytes from 216.58.217.100: icmp_seq=2 ttl=46 time=1.487 ms
64 bytes from 216.58.217.100: icmp_seq=3 ttl=46 time=2.523 ms
64 bytes from 216.58.217.100: icmp_seq=4 ttl=46 time=1.607 ms
64 bytes from 216.58.217.100: icmp_seq=5 ttl=46 time=1.480 ms

如果应用了我的出口政策，我应该无法 ping。

我正在使用 Kubernetes 1.9.6 版本

Answer 1

来自official documentation：

网络策略由网络插件实施，因此您必须使用支持 NetworkPolicy 的网络解决方案 - 只需创建无需控制器即可实施的资源没有效果。

许多网络插件，包括Calico 和Weave Net，支持使用Network Policies，但不支持Flannel。