kubernetes 中的多播隔离

Question

How can I isolate multicast traffic in one namespace in kubernetes. Ingress policy didn't solve this, I can capture multicast traffic from different namespace.

Answer 1

Usually, you can use Network Policy to manage it.

Looks like now the only one Network Provider with a support of Network Policy has the support of multicast - Weave.

But, based on its documentation , it is not possible to manage multicast rules:

As of version 1.9 of Weave Net, the Network Policy Controller allows all multicast traffic. Since a single multicast address may be used by multiple pods, we cannot implement rules to isolate them individually. You can turn this behaviour off (block all multicast traffic) by adding --allow-mcast=false as an argument to weave-npc in the YAML configuration.