Home / linux / kubenetes / network

Unit 3

Managing Applicaton Access

Understanding Kubernetes Networking

In Kubernetes, networking happens at different levels:

Managing Incoming Traffic

Warning: Do not configure Ingress and Gateway API on the same machine!

Understanding Network Plugins

kubectl get crd                                  # List Custom Resource Definitions added by the network plugin
kubectl get ippools -A -o yaml                   # Show Calico IP pools (Pod IP ranges) in YAML
kubectl get pods -o wide                         # List Pods with their assigned IP and node
ps aux | grep service-cluster-ip-range           # Find the Service ClusterIP range from the API server process

Understanding Services

Configuring Services

kubectl create deploy webshop --image=nginx --replicas=3
kubectl get pods --selector app=webshop -o wide
kubectl expose deploy webshop --type=NodePort --port=80
kubectl describe svc webshop
kubectl get svc
curl nodeip:nodeport

Understanding Ingress

helm upgrade --install ingress-nginx ingress-nginx --repo https://kubernetes.github.io/ingress-nginx --namespace ingress-nginx --create-namespace
kubectl get pods -n ingress-nginx
kubectl create deploy nginxsvc --image=nginx --port=80
kubectl expose deploy nginxsvc

# Demo: Installing the Nginx Ingress Controller
kubectl create ingress nginxsvc --class=nginx --rule=nginxsvc.info/*=nginxsvc:80
kubectl port-forward -n ingress-nginx svc/ingress-nginx-controller 8080:80
echo "127.0.0.1 nginxsvc.info" >> /etc/hosts
curl nginxsvc.info:8080

Configuring Ingress, managing rules

# Different paths on the same host
kubectl create ingress mygress --rule="/mygress=mygress:80" --rule="/yourgress=yourgress:80"
# Different virtual hosts in the same Ingress
kubectl create ingress nginxsvc --class=nginx --rule=nginxsvc.info/*=nginxsvc:80 --rule=otherserver.org/*=otherserver:80

Understanding IngressClass

# Demo: Configuring Ingress Rules
kubectl get deployment
kubectl get svc webshop
kubectl create ingress webshop-ingress --rule="/=webshop:80" --rule="/hello=newdep:8080"
sudo vim /etc/hosts
# 127.0.0.1    webshop.info
kubectl get ingress
kubectl describe ingress webshop-ingress

# Create the back-end deployment used by the /hello rule
kubectl create deployment newdep --image=gcr.io/google-samples/hello-app:2.0
kubectl expose deployment newdep --port=8080
kubectl describe ingress webshop-ingress

Using Port Forwarding

Gateway API

Do not run Gateway API on a node that already is running an Ingress controller!

Using Gateway API to provide access to Applications.

# Install CRD's (see latest version: https://docs.nginx.com/nginx-gateway-fabric/installation/installing-ngf/helm/)
kubectl kustomize https://github.com/nginxinc/nginx-gateway-fabric/config/crd/gateway-api/standard?ref=v1.5.1 | kubectl apply -f -
# Install nginx-gateway-fabric controller
helm install ngf oci://ghcr.io/nginxinc/charts/nginx-gateway-fabric --create-namespace -n nginx-gateway
# Verify
kubectl get pods,svc -n nginx-gateway
# At this point you have a GatewayController; use kubectl get gc and notice the name (nginx)
kubectl get gc

Demo: Using Gateway API

# Create Kubernetes resources
kubectl create deploy nginxgw --image=nginx --replicas=3
kubectl expose deploy nginxgw --port=80
# Apply the HTTPRoute config
kubectl apply -f http-routing.yaml
# First test using port-forwarding
sudo sh -c "echo 127.0.0.1 whatever.com >> /etc/hosts"
kubectl -n nginx-gateway port-forward pods/ngf-nginx-gateway-[Tab] 8080:80 8443:443
curl whatever.com:8080

Configuring Gateway API for TLS Access

Terminating TLS at the Gateway

To set up TLS termination at the Gateway, the following steps need to be completed:

# This demo assumes you have completed the demo in Lesson 9.9
# Create a self-signed certificate
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/CN=whatever.com"
# Create a Kubernetes TLS Secret
kubectl create secret tls gateway-tls --cert=tls.crt --key=tls.key
# Update the Gateway resource (see tls-gateway.yaml in Git repository)
# Add an https route (see https-routing.yaml in Git repository)
# Configure port forwarding to the Gateway Fabric NodePort Service
sudo apt install socat
sudo socat TCP4-LISTEN:80,fork TCP4:127.0.0.1:32080 &
sudo socat TCP4-LISTEN:443,fork TCP4:127.0.0.1:32443 &
curl -k https://whatever.com

Networking

Understanding the CNI

Understanding Service Auto Registration

Accessing Service in other Namespaces

# access pod by name in same namespace
kubectl run webserver --image=nginx
kubectl expose pod webserver --port=80
kubectl run testpod --image=busybox -- sleep 3600
kubectl get svc
kubectl exec -it testpod -- wget webserver
# access pod in other namespaces
kubectl create ns remote
kubectl run interginx --image=nginx
kubectl run remotebox --image=busybox -n remote -- sleep 3600
kubectl expose pod interginx --port=80
kubectl exec -it remotebox -n remote -- cat /etc/resolv.conf
kubectl exec -it remotebox -n remote -- nslookup interginx
kubectl exec -it remotebox -n remote -- nslookup interginx.default.svc.cluster.local

Using NetworkPolicies to Manage Traffic Between Pods

# exploring NetworkPolicy
kubectl apply -f nwpolicy-complete-example.yaml
kubectl expose pod nginx --port=80
kubectl exec -it busybox -- wget --spider --timeout=1 nginx
kubectl label pod busybox access=true
kubectl exec -it busybox -- wget --spider --timeout=1 nginx

Using NetworkPolicies to Manage Traffic Between Namespaces

...
spec:
  podSelector:
    matchLabels:
  ingress:
  - from:
    - podSelector: {}
...

...
spec:
  podSelector:
    matchLabels:
  ingress:
  - from:
    - namespaceSelector: {}
      podSelector:
        matchLabels:
          access="true"
...

# demo allow network traffic between namespaces
kubectl create ns nwp-namespace
kubectl create -f nwp-lab10-1.yaml
kubectl expose pod nwp-nginx --port=80
# gives a bad address error
kubectl exec -it nwp-busybox -n nwp-namespace -- wget --spider --timeout=1 nwp-nginx
# explains that it's looking in the wrong ns
kubectl exec -it nwp-busybox -n nwp-namespace -- nslookup nwp-nginx
# is allowed (using FQDN)
kubectl exec -it nwp-busybox -n nwp-namespace -- wget --spider --timeout=1 nwp-nginx.default.svc.cluster.local

# apply a more restrictive policy
kubectl create -f nwp-lab10-2.yaml
# now the FQDN access is not allowed
kubectl exec -it nwp-busybox -n nwp-namespace -- wget --spider --timeout=1 nwp-nginx.default.svc.cluster.local
# create a busybox in the default namespace
kubectl create deployment busybox --image=busybox -- sleep 3600
# from default namespace access is allowed
kubectl exec -it busybox[Tab] -- wget --spider --timeout=1 nwp-nginx

CoreDNS

data:
  Corefile: |
    .:53 {
        forward . 8.8.8.8 8.8.4.4
        log
        errors
    }
Page Source