Upload
outlyer
View
1.006
Download
0
Embed Size (px)
Citation preview
k8s-master
Availability Zone A Availability Zone B Availability Zone C
admin
user
data
k8s-worker
🌍
dmz
apiVersion: extensions/v1beta1 kind: NetworkPolicy metadata: name: com.monzo.mastercard.proxy spec: podSelector: matchLabels: stage: prod routing-name: com.monzo.mastercard.proxy ingress: - from: - podSelector: matchLabels: stage: prod routing-name: com.monzo.mastercard.processor ports: - protocol: tcp port: 80
👍 “Cluster-aware”
👍 netfilter/iptables under the hood
👍 Filtering at “both ends”
👎 No control over egress
👎 Only understands TCP/UDP
👎 Proxies
🔒 IPSec
🎖 StrongSwan (IPSec)
Hardware VPN device
ServicesServicesServices
AWS Co-location Third parties