current position：Home>Yyds dry goods inventory k8s network strategy
Yyds dry goods inventory k8s network strategy
2022-01-27 02:48:26 【key_ 3_ feng】
The network strategy is to control Pod Specification of how to communicate between resource groups and with other network endpoints , It uses tags to group Pod, And in this group Pod Define rules to control its traffic , Thus for Kubernetes Provide more refined flow control and tenant isolation mechanism .NetworkPolicy Resources are Kubernetes API Top priority , Administrators or users can use NetworkPolicy This standard resource type defines network access control policies on demand .
Kubernetes The default is not for Pod Above the flow as any limit ,Pod Object can communicate with any other on the cluster Pod signal communication , It can also interact with network endpoints outside the cluster .NetworkPolicy Is a resource at the namespace level , Allows the user to use the tag selector in a filtered group Pod Objects are managed separately Ingress and Egress Traffic . Once the Network Policy Introduced into the namespace , Is selected by the tag selector “ Choose ” Of Pod All traffic will be rejected by default , And release only by specific NetworlPolicy Clear resources “ allow ” Of traffic . However , Not by any NetworkPolicy The resource's label selector is selected Pod The traffic of the object is not affected .
Pod Group ： from NetworkPolicy Resources through Pod tag chooser （spec.podSelector） A dynamically selected group Pod Resource collection , They are also the targets of the network policy rules , It can be done by macthLabel or matchExpression Type of label selector selected .
Egress The rules ： Rules related to outbound traffic , Responsible for controlling the selected Pod Group traffic to other network endpoints , The destination network endpoint that can be by traffic （spec.egress.to） And port （spec.egress.ports） To define .
Ingress The rules ： Rules related to inbound traffic , Responsible for the control of selected Pod The traffic received by the group , It can be sent by traffic to the source endpoint （spec.ingress.from） And the target port of traffic （spec.ingress.ports） To define .
Peer endpoint （to, from）： With the selected Pod Peer hosts for group interaction , It can be CIDR Format IP Address block （ipBlock）、 Network namespace selector （namespaceSelector） To match all... In the namespace Pod object , It can even be by Pod Selectors （podSelector） A specific set of objects selected in a specified namespace Pod Object etc. .
Calico The project can independently serve Kubernetes The cluster provides network plug-ins and network policies , Can also be with Flannel Bind together , from Flannel Provide network solutions , and Calico Used only to provide network policy , The solution is independent Canal project .
Namespace separated multi tenant or even multi project Kubernetes On the cluster , Communication isolation between each other should usually be set , To improve the overall safety of the system . However, these namespaces should usually allow internal Pod Communication between , And allow requests from the private namespace of the management class application on the cluster , Include kube-system and kubernetes-dashboard, And a namespace dedicated to the clustered log collection system （ for example logs） And monitoring system specific namespaces （ for example monitoring） etc. . meanwhile , These namespaces usually request DNS service , as well as Kubernetes Of API etc. .
author[key_ 3_ feng],Please bring the original link to reprint, thank you.
The sidebar is recommended
- Spring IOC container loading process
- [thinking] the difference between singleton mode and static method - object-oriented programming
- Hadoop environment setup (MySQL environment configuration)
- 10 minutes, using node JS creates a real-time early warning system for bad weather!
- Git tool
- Force deduction algorithm - 92 Reverse linked list II
- What is the sub problem of dynamic programming?
- C / C + +: static keyword summary
- Idea does not have the artifacts option when configuring Tomcat
- Anaconda can't open it
guess what you like
I don't know how to start this
Matlab simulation of transportation optimization algorithm based on PSO
MySQL slow log optimization
[Vue] as the window is stretched (larger, smaller, wider and higher), the text will not be displayed
Popular Linux distributions for embedded computing
Suzhou computer research
After installing SSL Certificate in Windows + tomcat, the domain name request is not successful. Please answer!!
Implementation time output and greetings of jQuery instance
The 72 year old uncle became popular. Wu Jing and Guo fan made his story into a film, which made countless dreamers blush
How to save computer research
- Springboot implements excel import and export, which is easy to use, and poi can be thrown away
- The final examination subjects of a class are mathematical programming, and the scores are sorted and output from high to low
- Two pronged approach, Tsinghua Professor Pro code JDK and hotspot source code notes, one-time learning to understand
- C + + recursive knapsack problem
- The use of GIT and GitHub and the latest git tutorial are easy to understand -- Video notes of crazy God speaking
- PostgreSQL statement query
- Ignition database test
- Context didn't understand why he got a high salary?, Nginxfair principle
- Bootstrap switch switch control user's guide, springcloud actual combat video
- A list that contains only strings. What other search methods can be used except sequential search
- [matlab path planning] multi ant colony algorithm grid map path planning [including GUI source code 650]
- [matlab path planning] improved genetic algorithm grid map path planning [including source code phase 525]
- Iinternet network path management system
- Appium settings app is not running after 5000ms
- Reactnative foundation - 07 (background image, status bar, statusbar)
- Reactnative foundation - 04 (custom rpx)
- If you want an embedded database (H2, hsql or Derby), please put it on the classpath
- When using stm32g070 Hal library, if you want to write to flash, you must perform an erase. If you don't let it, you can't write continuously.
- Linux checks where the software is installed and what files are installed
- SQL statement fuzzy query and time interval filtering
- 69. Sqrt (x) (c + + problem solving version with vs runnable source program)
- Fresh students are about to graduate. Do you choose Java development or big data?
- Java project: OA management system (java + SSM + bootstrap + MySQL + JSP)
- Titanic passenger survival prediction
- Vectorization of deep learning formula
- Configuration and use of private image warehouse of microservice architect docker
- For someone, delete return 1 and return 0
- How does Java dynamically obtain what type of data is passed? It is used to judge whether the data is the same, dynamic data type
- How does the database cow optimize SQL?
- [data structure] chain structure of binary tree (pre order traversal) (middle order traversal) (post order traversal) (sequence traversal)
- Webpack packaging optimization solution
- 5. Operation element
- Detailed explanation of red and black trees
- redhat7. 9 install database 19C
- Blue Bridge Cup notes: (the given elements are not repeated) complete arrangement (arrangement cannot be repeated, arrangement can be repeated)
- Detailed explanation of springboot default package scanning mechanism and @ componentscan specified scanning path
- How to solve the run-time exception of test times
- Detailed explanation of k8s management tool kubectl
- Android system view memory command