Network policies

Exam tasks: 3.2 (define and enforce Network Policies), with 5.5 when a policy blocks too much

The decision: which Pods does this policy select, which direction does it isolate, and exactly which peers and ports should still get through?

How enforcement worksCopy Anchor Link

• Pods start non-isolated: everything is allowed. A Pod becomes isolated for a direction only when a policy selects it and lists that direction in policyTypes.
• Policies are allow-lists and additive. The result is the union of all rules that apply. There's no deny rule and no ordering, so one permissive policy can't be overridden by a stricter one.
• Policies are namespaced and select Pods in their own namespace only (podSelector).
• Replies to an allowed connection are allowed automatically. You don't write a return rule.
• The CNI plugin enforces them. On a plugin without support (plain Flannel), policies are accepted and do nothing.

The baseline: default denyCopy Anchor Link

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
  namespace: vault-svc
spec:
  podSelector: {}          # every Pod in vault-svc
  policyTypes:
  - Ingress
  - Egress                 # no ingress or egress rules listed, so nothing is allowed

• Ingress only: list just Ingress. Egress only: just Egress.
• If you omit policyTypes, it defaults to Ingress, plus Egress only if the policy has egress rules.
• "Allow all ingress" is ingress: [{}]: one empty rule matches every source.

Selecting peers: AND vs ORCopy Anchor Link

The single most tested detail. Each item in from (or to) is a separate peer, and items are ORed. Selectors inside the same item are ANDed.

ingress:
- from:
  - namespaceSelector:
      matchLabels:
        kubernetes.io/metadata.name: storefront
    podSelector:                 # no dash: same item as namespaceSelector
      matchLabels:
        tier: api

PortsCopy Anchor Link

  ports:
  - protocol: TCP
    port: 5432
  - protocol: TCP
    port: 30000
    endPort: 30100      # a range
  - port: metrics      # a named containerPort on the target Pod

• A rule with from and ports needs both to match. A rule with only ports allows those ports from anywhere.
• Ports are the Pod's port (the targetPort), not the Service port. Policies act after the Service IP is translated.

Egress and DNSCopy Anchor Link

Once you isolate egress, Pods can't resolve names, because CoreDNS is just another set of Pods. Allow it explicitly:

  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: kube-system
      podSelector:
        matchLabels:
          k8s-app: kube-dns
    ports:
    - protocol: UDP
      port: 53
    - protocol: TCP
      port: 53

Testing a policyCopy Anchor Link

k -n vault-svc get netpol
k -n vault-svc describe netpol allow-api      # shows the parsed selectors, check AND vs OR here
k -n storefront run t --rm -it --restart=Never --image=busybox:1.36 -l tier=api -- \
  wget -qO- -T 2 http://keeper.vault-svc:8200   # allowed peer: should answer
k -n storefront run t2 --rm -it --restart=Never --image=busybox:1.36 -- \
  wget -qO- -T 2 http://keeper.vault-svc:8200   # no label: should time out

ScenariosCopy Anchor Link

DrillCopy Anchor Link

kubectl config use-context lab-net

Namespace vault-svc runs Pods labelled app=keeper listening on TCP 8200. Make sure that:

1. All ingress to every Pod in vault-svc is denied by default (policy deny-ingress).
2. Pods labelled tier=api in namespace storefront can reach app=keeper Pods on TCP 8200 only (policy allow-api).

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-ingress
  namespace: vault-svc
spec:
  podSelector: {}
  policyTypes:
  - Ingress
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-api
  namespace: vault-svc
spec:
  podSelector:
    matchLabels:
      app: keeper
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: storefront
      podSelector:
        matchLabels:
          tier: api
    ports:
    - protocol: TCP
      port: 8200

k apply -f vault-policies.yaml
k -n vault-svc describe netpol allow-api
KEEPER=$(k -n vault-svc get pod -l app=keeper -o jsonpath='{.items[0].status.podIP}')
k -n storefront run ok --rm -it --restart=Never --image=busybox:1.36 -l tier=api -- nc -zv -w 2 $KEEPER 8200   # open
k -n storefront run no --rm -it --restart=Never --image=busybox:1.36 -- nc -zv -w 2 $KEEPER 8200              # timeout

Further readingCopy Anchor Link

• Network Policies
• Declare Network Policy
• NetworkPolicy API reference