openshift 4.3 network policy demo

        # 为zxcdn namespace，和demo namespace配置network policy，只放行CDN内部应用和ingress的流量，外部应用流量一律拒绝。
        
        cat << EOF > demo.yaml
        ---
        apiVersion: networking.k8s.io/v1
        kind: NetworkPolicy
        metadata:
          name: deny-other-namespaces
        spec:
          podSelector: null
          ingress:
            - from:
                - podSelector: {}
        ---
        apiVersion: networking.k8s.io/v1
        kind: NetworkPolicy
        metadata:
          name: allow-from-openshift-ingress
        spec:
          ingress:
          - from:
            - namespaceSelector:
                matchLabels:
                  network.openshift.io/policy-group: ingress
          podSelector: {}
          policyTypes:
          - Ingress
        EOF
        oc apply -n zxcdn -f demo.yaml
        oc apply -n demo -f demo.yaml
        
        # 在 demo 和 zxcdn 空间中，各创建一个测试用的pod
        
        cat << EOF > demo.yaml
        ---
        kind: Deployment
        apiVersion: apps/v1
        metadata:
          annotations:
          name: demo
        spec:
          replicas: 1
          selector:
            matchLabels:
              app: demo
          template:
            metadata:
              labels:
                app: demo  
            spec:
              nodeSelector:
                kubernetes.io/hostname: 'infra1.hsc.redhat.ren'
              restartPolicy: Always
              containers:
                - name: demo1
                  image: >- 
                    registry.redhat.ren:5443/docker.io/wangzheng422/centos:centos7-test
                  env:
                    - name: key
                      value: value
                  command: ["/bin/bash", "-c", "--" ]
                  args: [ "trap : TERM INT; sleep infinity & wait" ]
                  imagePullPolicy: Always
        
        EOF
        oc apply -n demo -f demo.yaml
        oc apply -n zxcdn -f demo.yaml
        
        # 查找cdn的ip地址
        
        oc get pod -o wide -n zxcdn
        
        # 进入demo pod，ping cdn pod，应该ping不通
        
        # 配置zxcdn namespace的network policy，放行demo namespace
        
        oc label namespace demo name=demo
        
        cat << EOF > demo.yaml
        ---
        apiVersion: networking.k8s.io/v1
        kind: NetworkPolicy
        metadata:
          name: deny-other-namespaces
        spec:
          podSelector: null
          ingress:
            - from:
                - podSelector: {}
        ---
        apiVersion: networking.k8s.io/v1
        kind: NetworkPolicy
        metadata:
          name: allow-from-openshift-ingress
        spec:
          ingress:
          - from:
            - namespaceSelector:
                matchLabels:
                  network.openshift.io/policy-group: ingress
          podSelector: {}
          policyTypes:
          - Ingress
        ---
        apiVersion: networking.k8s.io/v1
        kind: NetworkPolicy
        metadata:
          name: allow-from-other
        spec:
          ingress:
          - from:
            - namespaceSelector:
                matchLabels:
                  name: demo
          podSelector: {}
          policyTypes:
          - Ingress
        EOF
        oc apply -n zxcdn -f demo.yaml
        
        # 进入demo pod，ping cdn pod，应该可以ping通
        
        
        # 进入zxcdn project里面的一个pod, ping demo pod，应该ping不通
        
        oc get pod -n demo -o wide
        
        # 配置 demo namespace的network policy， 放行 zxcdn namespace
        
        oc label namespace zxcdn name=zxcdn
        
        cat << EOF > demo.yaml
        ---
        apiVersion: networking.k8s.io/v1
        kind: NetworkPolicy
        metadata:
          name: deny-other-namespaces
        spec:
          podSelector: null
          ingress:
            - from:
                - podSelector: {}
        ---
        apiVersion: networking.k8s.io/v1
        kind: NetworkPolicy
        metadata:
          name: allow-from-openshift-ingress
        spec:
          ingress:
          - from:
            - namespaceSelector:
                matchLabels:
                  network.openshift.io/policy-group: ingress
          podSelector: {}
          policyTypes:
          - Ingress
        ---
        apiVersion: networking.k8s.io/v1
        kind: NetworkPolicy
        metadata:
          name: allow-from-other
        spec:
          ingress:
          - from:
            - namespaceSelector:
                matchLabels:
                  name: zxcdn
          podSelector: {}
          policyTypes:
          - Ingress
        EOF
        oc apply -n demo -f demo.yaml
        
        # 进入zxcdn project里面的一个pod, ping demo pod，应该能够ping通
        
        
        
        oc delete -n zxcdn -f demo.yaml
        oc delete -n demo -f demo.yaml