Kubernetes 网络

apiVersion: v1
kind: Service
metadata:
  name: web-np
spec:
  type: NodePort
  selector:
    app: web
  ports:
    - port: 80          # Service 端口
      targetPort: 80    # Pod 端口
      nodePort: 30080   # 节点端口,范围 30000-32767

# 查看 kube-proxy 当前模式
kubectl logs -n kube-system -l k8s-app=kube-proxy | grep -i mode

service名称.命名空间.svc.cluster.local

# 在 Pod 内测试 DNS 解析
kubectl run dns-test --rm -it --image=busybox:1.36 -- nslookup web-np

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: web-ingress
spec:
  ingressClassName: nginx
  rules:
    - host: api.example.com        # 按域名匹配
      http:
        paths:
          - path: /users           # 按路径匹配
            pathType: Prefix
            backend:
              service:
                name: user-svc
                port:
                  number: 80
          - path: /orders
            pathType: Prefix
            backend:
              service:
                name: order-svc
                port:
                  number: 80

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: backend-policy
spec:
  podSelector:
    matchLabels:
      app: backend          # 策略作用于 backend Pod
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: frontend # 只允许 frontend 访问
      ports:
        - port: 8080