Network & K8s.04-3 Who May Knock

mux.HandleFunc("GET /{$}", func(w http.ResponseWriter, r *http.Request) { fmt.Fprintln(w, "Hello") })
mux.HandleFunc("GET /healthz", func(w http.ResponseWriter, r *http.Request) { fmt.Fprintln(w, "Healthy") })
mux.HandleFunc("GET /readyz", func(w http.ResponseWriter, r *http.Request) { fmt.Fprintln(w, "Ready") })
mux.HandleFunc("GET /data", func(w http.ResponseWriter, r *http.Request) {
    ctx, cancel := context.WithTimeout(r.Context(), 3*time.Second)
    defer cancel()
    conn, err := pgx.Connect(ctx, dsn)            // 요청마다 새 연결
    if err != nil { http.Error(w, "Database unavailable", 503); return }
    defer conn.Close(ctx)
    var result int
    if err = conn.QueryRow(ctx, "SELECT 1").Scan(&result); err != nil || result != 1 {
        http.Error(w, "Database query failed", 503); return
    }
    fmt.Fprintln(w, "Database Connected: SELECT 1 = 1")
})

docker build -t go-web:cn4 .
kind load docker-image go-web:cn4 --name cn4     # 노드 셋에 이미지를 넣는다

apiVersion: v1
kind: Service
metadata: {name: db}
spec:
  selector: {app: postgres}
  ports:
  - {name: postgres, port: 5432, targetPort: 5432}
---
apiVersion: apps/v1
kind: Deployment
metadata: {name: web}
spec:
  replicas: 1
  selector:
    matchLabels: {app: web}
  template:
    metadata:
      labels: {app: web}
    spec:
      containers:
      - name: web
        image: go-web:cn4
        imagePullPolicy: Never
        env:
        - name: DATABASE_URL
          valueFrom:
            secretKeyRef: {name: db-login, key: url}
        ports:
        - {name: http, containerPort: 8080}
        startupProbe:  {httpGet: {path: /healthz, port: http}, periodSeconds: 2, failureThreshold: 30}
        livenessProbe: {httpGet: {path: /healthz, port: http}, periodSeconds: 5}
        readinessProbe: {httpGet: {path: /readyz, port: http}, periodSeconds: 3}
---
apiVersion: v1
kind: Pod
metadata:
  name: diagnostic
  labels: {client: diagnostic}
spec:
  containers:
  - {name: tools, image: busybox:1.37.0, command: [sleep, "86400"]}
  - {name: pg-client, image: postgres:18.6-alpine, command: [sleep, "86400"]}

k() { kubectl --context kind-cn4 "$@"; }   # 새 터미널이면 다시 정의
k -n cn4 apply -f workloads.yaml
k -n cn4 rollout status statefulset/postgres --timeout=180s
k -n cn4 rollout status deployment/web --timeout=180s
k -n cn4 wait --for=condition=Ready pod/diagnostic --timeout=180s
k -n cn4 get pods,services -o wide

k -n cn4 exec diagnostic -c tools -- wget -qO- -T 5 http://web:8080/          # Hello
k -n cn4 exec diagnostic -c tools -- wget -qO- -T 5 http://web:8080/healthz   # Healthy
k -n cn4 exec diagnostic -c tools -- wget -qO- -T 5 http://web:8080/data      # Database Connected: SELECT 1 = 1
k -n cn4 exec diagnostic -c pg-client -- pg_isready -h db -p 5432 -U cn4 -d cn4 -t 3   # accepting connections

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny
  namespace: store
spec:
  podSelector: {}          # 이 네임스페이스의 모든 Pod 가 대상
  policyTypes:
    - Ingress
    - Egress
  ingress: []              # 받아도 되는 상대 없음
  egress: []               # 보내도 되는 상대 없음

matchLabels:              # colour=purple 이면서 shape=square. 조건끼리 AND
  colour: purple
  shape: square

matchExpressions:         # 같은 뜻을 표현식으로
  - key: colour
    operator: In
    values: [purple]
  - key: shape
    operator: In
    values: [square]

k get pods -A -l 'colour=purple,shape=square'
k get pods -A -l 'colour notin (red,orange,yellow),shape'

from:
  - ipBlock:
      cidr: 10.0.0.0/24
      except:
        - 10.0.0.10/32      # 이 한 주소만 뺀다. IPv6 단일 주소는 /128

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: store-api
  namespace: store
spec:
  podSelector: {}                      # store 의 모든 Pod
  policyTypes: [Ingress, Egress]
  ingress:
    - from:
        - namespaceSelector:
            matchLabels: {app: frontend}
          podSelector:                 # 같은 - 안 → frontend ns 의 frontend Pod (AND)
            matchLabels: {app: frontend}
      ports:
        - {protocol: TCP, port: 8080}
  egress:
    - to:
        - namespaceSelector:
            matchLabels: {app: downstream-1}
          podSelector:
            matchLabels: {app: downstream-1}
        - namespaceSelector:           # - 가 둘 → downstream-1 또는 downstream-2 (OR)
            matchLabels: {app: downstream-2}
          podSelector:
            matchLabels: {app: downstream-2}
      ports:
        - {protocol: TCP, port: 8080}
    - to:                              # 이름으로 downstream 을 찾으려면 DNS 도 열어야 한다
        - namespaceSelector:
            matchLabels: {kubernetes.io/metadata.name: kube-system}
          podSelector:
            matchLabels: {k8s-app: kube-dns}
      ports:
        - {protocol: UDP, port: 53}
        - {protocol: TCP, port: 53}

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: receive-from-store
  namespace: downstream-1
spec:
  podSelector:
    matchLabels: {app: downstream-1}
  policyTypes: [Ingress]
  ingress:
    - from:
        - namespaceSelector:
            matchLabels: {app: store}
      ports:
        - {protocol: TCP, port: 8080}

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: db-from-web
spec:
  podSelector:
    matchLabels: {app: postgres}       # 대상: postgres Pod
  policyTypes: [Ingress, Egress]       # 두 방향 다 격리
  ingress:
  - from:
    - podSelector:
        matchLabels: {app: web}        # web 에서
    ports:
    - {protocol: TCP, port: 5432}      # 5432 로 시작한 연결만
  egress: []                           # postgres 가 새로 시작하는 연결은 없음

k -n cn4 apply -f db-policy.yaml
k -n cn4 exec diagnostic -c pg-client -- pg_isready -h db -p 5432 -U cn4 -d cn4 -t 3   # no response, 종료 코드 ≠ 0
k -n cn4 exec diagnostic -c tools -- wget -qO- -T 5 http://web:8080/data            # 여전히 SELECT 1 = 1

k -n cn4 port-forward deployment/web 18080:8080    # 브라우저에서 127.0.0.1:18080 — 끝나면 Ctrl+C

apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: web-http-paths
spec:
  endpointSelector:
    matchLabels: {app: web}            # 대상: web Pod (ingress 정책)
  ingress:
  - fromEndpoints:
    - matchLabels: {client: diagnostic}
    toPorts:
    - ports:
      - {port: "8080", protocol: TCP}
      rules:
        http:
        - {method: GET, path: "^/$"}      # 시작과 끝을 고정 — /data 와 /data/extra 를 구별
        - {method: GET, path: "^/data$"}

k -n cn4 get networkpolicy,ciliumnetworkpolicy
k -n cn4 apply -f web-l7-policy.yaml
k -n cn4 exec diagnostic -c tools -- wget -qO- -T 5 http://web:8080/            # Hello
k -n cn4 exec diagnostic -c tools -- wget -qO- -T 5 http://web:8080/data        # SELECT 1 = 1
k -n cn4 exec diagnostic -c tools -- wget -S -O- -T 5 http://web:8080/healthz   # HTTP 403 Forbidden

# 실습 정리 — 정책 둘만 지우고 워크로드는 그대로 둔다
kubectl --context kind-cn4 -n cn4 delete -f web-l7-policy.yaml
kubectl --context kind-cn4 -n cn4 delete -f db-policy.yaml