在Kubernetes节点上实现iptables规则 [英] Implementing iptables rules on Kubernetes nodes
问题描述
我想在Kubernetes(kube-proxy)开始魔术之前，先实现自己的iptables规则，然后根据节点上运行的服务/容器动态创建规则. kube-proxy在--proxy-mode=iptables中运行.
I would like to implement my own iptables rules before Kubernetes (kube-proxy) start doing it's magic and dynamically create rules based on services/pods running on the node. The kube-proxy is running in --proxy-mode=iptables.
每当我尝试在引导节点时尝试加载规则时(例如在INPUT链中)，即使我的规则也与-I标志.
Whenever I tried to load rules when booting up the node, for example in the INPUT chain, the Kubernetes rules (KUBE-EXTERNAL-SERVICES and KUBE-FIREWALL) are inserted on top of the chain even though my rules were also with -I flag.
我想念什么或做错什么了?
What am I missing or doing wrong?
如果某种程度上相关，那么我正在为Pod网络使用weave-net插件.
If it is somehow related, I am using weave-net plugin for the pod network.
推荐答案
最常见的做法是将所有自定义防火墙规则放在网关上(安全组.其余的群集安全性由其他功能实现，例如网络策略(取决于网络提供者)，入口，
The most common practice is to put all custom firewall rules on the gateway(ADC) or into cloud security groups. The rest of the cluster security is implemented by other features, like Network Policy (It depends on the network providers), Ingress, RBAC and others.
查看有关保护群集的文章和 Kubernetes安全-最佳做法指南.
这些文章也可以帮助保护您的群集:
These articles can also be helpful to secure your cluster:
这篇关于在Kubernetes节点上实现iptables规则的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
