6.7. 使用网络策略配置多租户模式

流程

1. 创建以下 NetworkPolicy 对象：

   1. 名为 allow-from-openshift-ingress 的策略：

      $ cat << EOF| oc create -f -
      apiVersion: networking.k8s.io/v1
      kind: NetworkPolicy
      metadata:
        name: allow-from-openshift-ingress
      spec:
        ingress:
        - from:
          - namespaceSelector:
              matchLabels:
                network.openshift.io/policy-group: ingress
        podSelector: {}
        policyTypes:
        - Ingress
      EOF

   2. 名为 allow-from-openshift-monitoring 的策略：

      $ cat << EOF| oc create -f -
      apiVersion: networking.k8s.io/v1
      kind: NetworkPolicy
      metadata:
        name: allow-from-openshift-monitoring
      spec:
        ingress:
        - from:
          - namespaceSelector:
              matchLabels:
                network.openshift.io/policy-group: monitoring
        podSelector: {}
        policyTypes:
        - Ingress
      EOF

   3. 名为 allow-same-namespace 的策略：

      $ cat << EOF| oc create -f -
      kind: NetworkPolicy
      apiVersion: networking.k8s.io/v1
      metadata:
        name: allow-same-namespace
      spec:
        podSelector:
        ingress:
        - from:
          - podSelector: {}
      EOF

2. 如果 default Ingress Controller 配置设置了 spec.endpointPublishingStrategy: HostNetwork 值，您需要为 default OpenShift Container Platform 命名空间添加一个标记来允许 Ingress Controller 和项目间的网络流量：

   1. 确定您的 default Ingress Controller 是否使用了 HostNetwork 端点发布策略：

      $ oc get --namespace openshift-ingress-operator ingresscontrollers/default \
        --output jsonpath='{.status.endpointPublishingStrategy.type}'

   2. 如果上个命令报告了端点发布策略为 HostNetwork，在 default 命名空间中设置一个标记：

      $ oc label namespace default 'network.openshift.io/policy-group=ingress'

3. 运行以下命令确认当前项目中存在 NetworkPolicy 对象：

   $ oc get networkpolicy <policy-name> -o yaml

   在以下示例中会显示 allow-from-openshift-ingress NetworkPolicy 对象：

   $ oc get -n project1 networkpolicy allow-from-openshift-ingress -o yaml

   输出示例

   apiVersion: networking.k8s.io/v1
   kind: NetworkPolicy
   metadata:
     name: allow-from-openshift-ingress
     namespace: project1
   spec:
     ingress:
     - from:
       - namespaceSelector:
           matchLabels:
             network.openshift.io/policy-group: ingress
     podSelector: {}
     policyTypes:
     - Ingress