8.6. 使用 Egress Firewall 来限制对外部资源的访问

使用以下内容创建 pod 配置：

apiVersion: v1
kind: Pod
metadata:
  name: egress-1
  labels:
    name: egress-1
  annotations:
    pod.network.openshift.io/assign-macvlan: "true" 1
spec:
  initContainers:
  - name: egress-router
    image: registry.redhat.io/openshift3/ose-egress-router
    securityContext:
      privileged: true
    env:
    - name: EGRESS_SOURCE 2
      value: 192.168.12.99/24
    - name: EGRESS_GATEWAY 3
      value: 192.168.12.1
    - name: EGRESS_DESTINATION 4
      value: 203.0.113.25
    - name: EGRESS_ROUTER_MODE 5
      value: init
  containers:
  - name: egress-router-wait
    image: registry.redhat.io/openshift3/ose-pod
  nodeSelector:
    site: springfield-1 6

使用上述定义创建 pod：

$ oc create -f <pod_name>.json

检查 pod 是否已创建：

$ oc get pod <pod_name>

通过创建服务指向出口路由器，确保其他 pod 可以找到 pod 的 IP 地址：

apiVersion: v1
kind: Service
metadata:
  name: egress-1
spec:
  ports:
  - name: http
    port: 80
  - name: https
    port: 443
  type: ClusterIP
  selector:
    name: egress-1

您的 pod 现在可以连接到此服务。使用保留的出口 IP 地址将其连接重新指向外部服务器的对应端口。

创建一个包含 EGRESS_DESTINATION 数据的文件：

$ cat my-egress-destination.txt
# Egress routes for Project "Test", version 3

80   tcp 203.0.113.25

8080 tcp 203.0.113.26 80
8443 tcp 203.0.113.26 443

# Fallback
203.0.113.27

请注意，您可以将空行和注释放在此文件中

从文件创建 ConfigMap 对象：

$ oc delete configmap egress-routes --ignore-not-found
$ oc create configmap egress-routes \
  --from-file=destination=my-egress-destination.txt

此处 egress-routes 是所创建的 ConfigMap 对象的名称，my-egress-destination.txt 是正在从中读取数据的文件名。

如上所示，创建一个出口路由器 pod 定义，但在 environment 部分为 EGRESS_DESTINATION 指定 ConfigMap：

    ...
    env:
    - name: EGRESS_SOURCE 1
      value: 192.168.12.99/24
    - name: EGRESS_GATEWAY
      value: 192.168.12.1
    - name: EGRESS_DESTINATION
      valueFrom:
        configMapKeyRef:
          name: egress-routes
          key: destination
    - name: EGRESS_ROUTER_MODE
      value: init
    ...

使用以下示例创建 pod：

apiVersion: v1
kind: Pod
metadata:
  name: egress-http-proxy
  labels:
    name: egress-http-proxy
  annotations:
    pod.network.openshift.io/assign-macvlan: "true" 1
spec:
  initContainers:
  - name: egress-router-setup
    image: registry.redhat.io/openshift3/ose-egress-router
    securityContext:
      privileged: true
    env:
    - name: EGRESS_SOURCE 2
      value: 192.168.12.99/24
    - name: EGRESS_GATEWAY 3
      value: 192.168.12.1
    - name: EGRESS_ROUTER_MODE 4
      value: http-proxy
  containers:
  - name: egress-router-proxy
    image: registry.redhat.io/openshift3/ose-egress-http-proxy
    env:
    - name: EGRESS_HTTP_PROXY_DESTINATION 5
      value: |
        !*.example.com
        !192.168.1.0/24
        *

您可以为 EGRESS_HTTP_PROXY_DESTINATION 值指定以下任意一项：您还可以使用 *，这表示"允许连接到所有远程目的地"。配置中的每行都指定允许或者拒绝的连接组：

通过创建服务指向出口路由器，确保其他 pod 可以找到 pod 的 IP 地址：

apiVersion: v1
kind: Service
metadata:
  name: egress-1
spec:
  ports:
  - name: http-proxy
    port: 8080 1
  type: ClusterIP
  selector:
    name: egress-1

通过设置 http_proxy 或 https_proxy 变量，将客户端 pod（而不是出口代理 pod）配置为使用 HTTP 代理：

    ...
    env:
    - name: http_proxy
      value: http://egress-1:8080/ 1
    - name: https_proxy
      value: http://egress-1:8080/
    ...

使用以下示例创建 pod：

apiVersion: v1
kind: Pod
metadata:
  name: egress-dns-proxy
  labels:
    name: egress-dns-proxy
  annotations:
    pod.network.openshift.io/assign-macvlan: "true" 1
spec:
  initContainers:
  - name: egress-router-setup
    image: registry.redhat.io/openshift3/ose-egress-router
    securityContext:
      privileged: true
    env:
    - name: EGRESS_SOURCE 2
      value: 192.168.12.99/24
    - name: EGRESS_GATEWAY 3
      value: 192.168.12.1
    - name: EGRESS_ROUTER_MODE 4
      value: dns-proxy
  containers:
  - name: egress-dns-proxy
    image: registry.redhat.io/openshift3/ose-egress-dns-proxy
    env:
    - name: EGRESS_DNS_PROXY_DEBUG 5
      value: "1"
    - name: EGRESS_DNS_PROXY_DESTINATION 6
      value: |
        # Egress routes for Project "Foo", version 5

        80  203.0.113.25

        100 example.com

        8080 203.0.113.26 80

        8443 foobar.com 443

通过创建服务指向出口路由器，确保其他 pod 可以找到 pod 的 IP 地址：

apiVersion: v1
kind: Service
metadata:
  name: egress-dns-svc
spec:
  ports:
  - name: con1
    protocol: TCP
    port: 80
    targetPort: 80
  - name: con2
    protocol: TCP
    port: 100
    targetPort: 100
  - name: con3
    protocol: TCP
    port: 8080
    targetPort: 8080
  - name: con4
    protocol: TCP
    port: 8443
    targetPort: 8443
  type: ClusterIP
  selector:
    name: egress-dns-proxy

Pod 现在可以连接至此服务。使用保留的出口 IP 地址将其连接代理到外部服务器的对应端口。

使用以下方法创建复制控制器配置文件：

apiVersion: v1
kind: ReplicationController
metadata:
  name: egress-demo-controller
spec:
  replicas: 1 1
  selector:
    name: egress-demo
  template:
    metadata:
      name: egress-demo
      labels:
        name: egress-demo
      annotations:
        pod.network.openshift.io/assign-macvlan: "true"
    spec:
      initContainers:
      - name: egress-demo-init
        image: registry.redhat.io/openshift3/ose-egress-router
        env:
        - name: EGRESS_SOURCE 2
          value: 192.168.12.99/24
        - name: EGRESS_GATEWAY
          value: 192.168.12.1
        - name: EGRESS_DESTINATION
          value: 203.0.113.25
        - name: EGRESS_ROUTER_MODE
          value: init
        securityContext:
          privileged: true
      containers:
      - name: egress-demo-wait
        image: registry.redhat.io/openshift3/ose-pod
      nodeSelector:
        site: springfield-1

使用定义创建 pod：

$ oc create -f <replication_controller>.json

要验证，请检查是否创建了复制控制器 pod：

$ oc describe rc <replication_controller>