Kubernetes Network Policy와 Service Mesh 완벽 가이드 (Istio, Cilium, Calico 비교)

# default-deny-all.yaml
# 네임스페이스 내 모든 Pod의 Ingress/Egress 트래픽을 차단
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: production
spec:
  podSelector: {} # 빈 셀렉터 = 네임스페이스 내 모든 Pod
  policyTypes:
    - Ingress
    - Egress

# allow-dns.yaml
# kube-dns(CoreDNS) 접근을 허용하는 정책
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-dns
  namespace: production
spec:
  podSelector: {}
  policyTypes:
    - Egress
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53

# allow-frontend-to-backend.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend-to-backend
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: backend-api
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: frontend
      ports:
        - protocol: TCP
          port: 8080

# egress-external-api-and-db.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: backend-egress-policy
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: backend-api
  policyTypes:
    - Egress
  egress:
    # 1. 같은 네임스페이스의 Redis 접근 허용
    - to:
        - podSelector:
            matchLabels:
              app: redis
      ports:
        - protocol: TCP
          port: 6379
    # 2. 외부 PostgreSQL RDS 접근 (CIDR 기반)
    - to:
        - ipBlock:
            cidr: 10.100.0.0/16
      ports:
        - protocol: TCP
          port: 5432
    # 3. 외부 HTTPS API 접근 허용
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            except:
              - 10.0.0.0/8
              - 172.16.0.0/12
              - 192.168.0.0/16
      ports:
        - protocol: TCP
          port: 443
    # 4. DNS 허용
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
      ports:
        - protocol: UDP
          port: 53

# cross-namespace-policy.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-monitoring-access
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: backend-api
  policyTypes:
    - Ingress
  ingress:
    # monitoring 네임스페이스의 Prometheus만 메트릭 스크래핑 허용
    - from:
        - namespaceSelector:
            matchLabels:
              team: monitoring
          podSelector:
            matchLabels:
              app: prometheus
      ports:
        - protocol: TCP
          port: 9090

# istioctl 설치
curl -L https://istio.io/downloadIstio | ISTIO_VERSION=1.24.2 sh -
export PATH="$HOME/istio-1.24.2/bin:$PATH"

# Ambient 프로파일로 설치
istioctl install --set profile=ambient --skip-confirmation

# 설치 확인
kubectl get pods -n istio-system
# NAME                                   READY   STATUS    RESTARTS   AGE
# istiod-7b69f4b6c-xxxxx                 1/1     Running   0          60s
# ztunnel-xxxxx                          1/1     Running   0          60s
# istio-cni-node-xxxxx                   1/1     Running   0          60s

# 네임스페이스에 Ambient 모드 활성화
kubectl label namespace production istio.io/dataplane-mode=ambient

# Waypoint Proxy 생성
istioctl waypoint apply --namespace production --name backend-waypoint

# 특정 서비스에 Waypoint 연결
kubectl label service backend-api \
  istio.io/use-waypoint=backend-waypoint \
  -n production

# istio-auth-policy.yaml
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: backend-api-policy
  namespace: production
spec:
  targetRefs:
    - kind: Service
      group: ''
      name: backend-api
  action: ALLOW
  rules:
    - from:
        - source:
            principals:
              - 'cluster.local/ns/production/sa/frontend'
      to:
        - operation:
            methods: ['GET', 'POST']
            paths: ['/api/v1/*']
    - from:
        - source:
            principals:
              - 'cluster.local/ns/monitoring/sa/prometheus'
      to:
        - operation:
            methods: ['GET']
            paths: ['/metrics']

# Cilium CLI 설치
CILIUM_CLI_VERSION=$(curl -s https://raw.githubusercontent.com/cilium/cilium-cli/main/stable.txt)
GOOS=$(go env GOOS)
GOARCH=$(go env GOARCH)
curl -L --fail --remote-name-all \
  "https://github.com/cilium/cilium-cli/releases/download/${CILIUM_CLI_VERSION}/cilium-${GOOS}-${GOARCH}.tar.gz"
sudo tar xzvfC "cilium-${GOOS}-${GOARCH}.tar.gz" /usr/local/bin

# Helm으로 Cilium 설치 (Service Mesh + Hubble 활성화)
helm repo add cilium https://helm.cilium.io/
helm repo update

helm install cilium cilium/cilium --version 1.17.0 \
  --namespace kube-system \
  --set kubeProxyReplacement=true \
  --set hubble.enabled=true \
  --set hubble.relay.enabled=true \
  --set hubble.ui.enabled=true \
  --set envoy.enabled=true \
  --set encryption.enabled=true \
  --set encryption.type=wireguard

# 설치 확인
cilium status --wait
cilium connectivity test

# cilium-l7-policy.yaml
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: backend-l7-policy
  namespace: production
spec:
  endpointSelector:
    matchLabels:
      app: backend-api
  ingress:
    - fromEndpoints:
        - matchLabels:
            app: frontend
      toPorts:
        - ports:
            - port: '8080'
              protocol: TCP
          rules:
            http:
              - method: 'GET'
                path: '/api/v1/products'
              - method: 'POST'
                path: '/api/v1/orders'
              - method: 'GET'
                path: '/healthz'
    - fromEndpoints:
        - matchLabels:
            app: prometheus
      toPorts:
        - ports:
            - port: '9090'
              protocol: TCP
          rules:
            http:
              - method: 'GET'
                path: '/metrics'

# Hubble CLI 설치 후 관측
hubble observe --namespace production --follow

# 특정 Pod의 트래픽만 필터링
hubble observe --namespace production \
  --to-label app=backend-api \
  --verdict DROPPED

# HTTP 요청 관측 (L7)
hubble observe --namespace production \
  --protocol http \
  --http-status 5xx

# 네트워크 플로우 시각화 (Hubble UI)
cilium hubble port-forward &
# 브라우저에서 http://localhost:12000 접속

TIMESTAMP             SOURCE                  DESTINATION             TYPE      VERDICT   SUMMARY
Mar 14 10:23:01.123   production/frontend     production/backend-api  L7/HTTP   FORWARDED GET /api/v1/products => 200
Mar 14 10:23:01.456   production/attacker     production/backend-api  L7/HTTP   DROPPED   POST /api/v1/admin => Policy denied
Mar 14 10:23:02.789   production/backend-api  production/redis        L4/TCP    FORWARDED TCP 6379

# istio-peer-auth.yaml
# STRICT 모드: mTLS가 아닌 평문 트래픽 거부
apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata:
  name: strict-mtls
  namespace: production
spec:
  mtls:
    mode: STRICT

# WireGuard 암호화 상태 확인
cilium encrypt status

# 출력 예시:
# Encryption:  Wireguard
# Keys in use: 2
# Errors:      0
# Interfaces:  cilium_wg0

# 암호화 키 목록 확인
cilium encrypt get

# 특정 Pod에 적용된 모든 Network Policy 확인
kubectl get networkpolicy -n production -o wide

# Pod 레이블 확인 (정책 셀렉터 매칭 검증)
kubectl get pods -n production --show-labels

# Calico를 사용하는 경우 정책 매칭 확인
calicoctl get networkpolicy -n production -o yaml

# CNI 플러그인 확인
kubectl get pods -n kube-system | grep -E 'calico|cilium|antrea'

# Network Policy가 실제로 적용되는지 검증하는 테스트
# 1. Default Deny 적용
kubectl apply -f default-deny-all.yaml

# 2. 통신 테스트 (차단되어야 정상)
kubectl exec -n production deploy/frontend -- \
  curl -s --connect-timeout 3 http://backend-api:8080/healthz
# 타임아웃이 발생하면 정책이 제대로 적용된 것

# DNS 문제 진단
kubectl exec -n production deploy/frontend -- nslookup backend-api
# ;; connection timed out; no servers could be reached

# CoreDNS Pod 확인
kubectl get pods -n kube-system -l k8s-app=kube-dns

# DNS 정책 적용 후 재테스트
kubectl apply -f allow-dns.yaml
kubectl exec -n production deploy/frontend -- nslookup backend-api
# Server:    10.96.0.10
# Name:      backend-api.production.svc.cluster.local

# ztunnel 상태 확인
kubectl get pods -n istio-system -l app=ztunnel

# ztunnel 로그 확인 (인증서 문제 진단)
kubectl logs -n istio-system -l app=ztunnel --tail=50

# ztunnel 재시작
kubectl rollout restart daemonset/ztunnel -n istio-system

# Istiod와의 xDS 연결 상태 확인
istioctl proxy-status

# eBPF 맵 사용량 확인
cilium bpf ct list global | wc -l
cilium bpf policy get --all

# 맵 크기 증가 (Helm values 수정)
# bpf.ctGlobalTCPMax: 524288  (기본값보다 증가)
# bpf.ctGlobalAnyMax: 262144
# bpf.policyMapMax: 65536

# 변경 적용
helm upgrade cilium cilium/cilium \
  --namespace kube-system \
  --reuse-values \
  --set bpf.ctGlobalTCPMax=524288

# 1. 즉시 문제 확인
kubectl get networkpolicy -n production

# 2. DNS 허용 정책 긴급 적용
kubectl apply -f - <<'POLICY'
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: emergency-allow-dns
  namespace: production
spec:
  podSelector: {}
  policyTypes:
    - Egress
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53
POLICY

# 3. 서비스 복구 확인
kubectl exec -n production deploy/frontend -- nslookup backend-api

# 1. mTLS 모드를 임시로 PERMISSIVE로 변경 (평문+mTLS 모두 허용)
kubectl apply -f - <<'POLICY'
apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata:
  name: permissive-during-upgrade
  namespace: production
spec:
  mtls:
    mode: PERMISSIVE
POLICY

# 2. 모든 워크로드 재시작하여 최신 프록시 적용
kubectl rollout restart deployment -n production

# 3. 모든 Pod가 새 버전으로 교체된 후 STRICT 복원
kubectl rollout status deployment -n production --timeout=300s
kubectl apply -f - <<'POLICY'
apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata:
  name: strict-mtls
  namespace: production
spec:
  mtls:
    mode: STRICT
POLICY

# Rolling Update 전략으로 한 노드씩 업데이트
helm upgrade cilium cilium/cilium \
  --namespace kube-system \
  --reuse-values \
  --set upgradeCompatibility=1.16 \
  --set rollOutCiliumPods=true

# PodDisruptionBudget 확인
kubectl get pdb -n kube-system

# 업데이트 진행 상황 모니터링
kubectl rollout status daemonset/cilium -n kube-system --timeout=600s