Kubernetes NetworkPolicy 双向隔离与命名空间选择器实战

为命名空间打标签（便于选择）： ``` kubectl label namespace frontend name=frontend --overwrite kubectl label namespace backend name=backend --overwrite ``` 后端命名空间的 NetworkPolicy： ``` apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: backend-iso namespace: backend spec: podSelector: matchLabels: app: api policyTypes: - Ingress - Egress ingress: - from: - namespaceSelector: matchLabels: name: frontend egress: - to: - namespaceSelector: matchLabels: kubernetes.io/metadata.name: kube-system podSelector: matchLabels: k8s-app: kube-dns ports: - protocol: UDP port: 53 - protocol: TCP port: 53 ```