千万别泄漏IP，否则Boom

k8s仅添加cdn的白名单。如果感兴趣可以仔细看下iptables的具体流向。
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: dk8s-svc-policy
spec:
  podSelector:
    matchLabels:
      app: dk8s-svc
  policyTypes:
    - Ingress
  ingress:
    - from:
      - ipBlock:
          cidr: 192.168.0.0/16
      - ipBlock:
          cidr: 172.16.0.0/12
      - ipBlock:
          cidr: 10.0.0.0/8
      - ipBlock:
          cidr: 101.33.1.0/24
      - ipBlock:
          cidr: 101.33.10.0/24
      - ipBlock:
          cidr: 101.33.12.0/24
# cdn网段
      ports:
        - protocol: TCP
          port: 80
        - protocol: TCP
          port: 443