如何为与GKE上的Kubernetes API服务器通信的工作负载编写最小的出口网络策略？

Question

I want to write a minimal egress NetworkPolicy for a workload running on GKE that needs to talk to the apiserver.

Is there any other way of doing this other than creating the cluster, getting the address of the LB fronting the apiserver(s) and then templating this into a NetworkPolicy? Is there any way of picking an external apiserver IP beforehand that can remain static over cluster recreates? Or, as a last resort, getting some list of CIDRs that GKE will always choose the apiserver LB IP from?

Answer 1

最好的选择是通过在GKE上启用网络策略来使用calico，请查阅此文档 ，这是一些允许或拒绝进入或进入的提示