8.6.네트워크 정책 (NetworkPolicy)에서 NetworkPolicy-ipBlock-except.yaml에 대한 질문

안녕하세요.

NetworkPolicy-ipBlock-except.yaml 파일을

[root@m-k8s 8.6]# cat 3-3-NetworkPolicy-ipBlock-except.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: networkpolicy-ipblock-except
  namespace: default
spec:
  podSelector: {}
  policyTypes:

  - Ingress

  - Egress
  ingress:

  - from:

    - ipBlock:
        cidr: 172.16.0.0/16

        # change your CIDR to shut it down

        except:

         - 172.16.132.0/24

  egress:

  - to:

    - ipBlock:
        cidr: 172.16.0.0/16

        # change your CIDR to shut it down

        except:
         - 172.16.132.0/24

위와 같이 설정 후,

[root@m-k8s 8.6]# k apply -f 3-3-NetworkPolicy-ipBlock-except.yaml
networkpolicy.networking.k8s.io/networkpolicy-ipblock-except created

[root@m-k8s 8.6]# k get po -o wide | grep deploy-ipblock-ddb5f6ff9
deploy-ipblock-ddb5f6ff9-klkkj              1/1     Running   0             20s     172.16.103.150   w2-k8s   <none>           <none>
deploy-ipblock-ddb5f6ff9-l7fdx              1/1     Running   0             20s     172.16.132.37    w3-k8s   <none>           <none>
deploy-ipblock-ddb5f6ff9-q4r7m           1/1     Running   0             20s     172.16.221.154   w1-k8s   <none>           <none>

[root@m-k8s 8.6]# k exec net -it -- /bin/bash

[root@net /]# ping 172.16.103.150
PING 172.16.103.150 (172.16.103.150): 56 data bytes
^C
--- 172.16.103.150 ping statistics ---
5 packets transmitted, 0 packets received, 100% packet loss
[root@net /]# ping 172.16.132.37
PING 172.16.132.37 (172.16.132.37): 56 data bytes
^C
--- 172.16.132.37 ping statistics ---
5 packets transmitted, 0 packets received, 100% packet loss
[root@net /]# ping 172.16.221.154
PING 172.16.221.154 (172.16.221.154): 56 data bytes
^C
--- 172.16.221.154 ping statistics ---
4 packets transmitted, 0 packets received, 100% packet loss

ping을 보낼 시, 강의에서는 w3-k8s에만 ping이 안가야 정상이고 나머지 (w1-k8s / w2-k8s)에는 ping이 가야하지만 NetworkPolicy-ipBlock-except.yaml 적용 시, 어떠한 노드에도 핑이 가지 않습니다.

yaml 파일에서도 except를 172.16.132.0/24로 주었지만 되지 않습니다.

해당 IP 대역만 제외했는데 왜 다른 대역도 먹통이 되는지 이해가 안됩니다 ㅠㅠ

(NetworkPolicy-ipBlock-except.yaml 해제하면 모든 노드에 ping이 감)

[root@m-k8s 8.6]# k get po -o wide 
NAME                             READY   STATUS    RESTARTS   AGE     IP               NODE     NOMINATED NODE   READINESS GATES
deploy-ipblock-ddb5f6ff9-fsscv   1/1     Running   0          5m37s   172.16.103.130   w2-k8s   <none>           <none>
deploy-ipblock-ddb5f6ff9-n96lr   1/1     Running   0          5m37s   172.16.221.133   w1-k8s   <none>           <none>
deploy-ipblock-ddb5f6ff9-rw6dv   1/1     Running   0          5m37s   172.16.132.4     w3-k8s   <none>           <none>
net                              1/1     Running   0          46s     172.16.103.131   w2-k8s   <none>           <none>

[root@m-k8s ~]# k get po -o wide
NAME                                     READY   STATUS    RESTARTS        AGE     IP               NODE     NOMINATED NODE   READINESS GATES
net                                      1/1     Running   6 (5m29s ago)   7d12h   172.16.132.39    w3-k8s   <none>           <none>
nfs-client-provisioner-7884c4db4-kbg6r   1/1     Running   7 (4m4s ago)    7d12h   172.16.103.152   w2-k8s   <none>           <none>