이 콘텐츠는 선택한 언어로 제공되지 않습니다.
Chapter 8. Network Security
8.1. Network Namespaces
OpenShift Container Platform uses software-defined networking (SDN) to provide a unified cluster network that enables communication between containers across the cluster.
Using network namespaces, you can isolate pod networks. Each pod gets its own IP and port range to bind to, thereby isolating pod networks from each other on the node. Pods from different projects cannot send packets to or receive packets from pods and services of a different project. You can use this to isolate developer, test and production environments within a cluster.
OpenShift Container Platform also provides the ability to control egress traffic using either a router or firewall method. For example, you can use IP whitelisting to control database access.
Further Reading
- OpenShift Container Platform Architecture: Networking
- OpenShift Container Platform Cluster Administration: Managing Networking
- Red Hat Enterprise Linux Atomic Host Managing Containers: Running Super-Privileged Containers
8.2. Isolating Applications
OpenShift Container Platform enables you to segment network traffic on a single cluster to make multi-tenant clusters that isolate users, teams, applications, and environments.
For example, to isolate a project network in the cluster and vice versa, run:
$ oc adm pod-network isolate-projects <project1> <project2>
In the above example, all of the pods and services in <project1> and <project2> can not access any pods and services from other non-global projects in the cluster and vice versa.
