Skip to main content

Understanding Kubernetes Network Policies

03/08/2024

As container orchestration has become the standard for deploying and managing applications, securing communication between containers in a Kubernetes cluster is critical. Kubernetes Network Policies provide a way to enforce rules about which pods can communicate with each other. This blog post will explain the fundamentals of Kubernetes Network Policies, how they work, and provide examples to help you implement them in your own clusters.

What are Kubernetes Network Policies?

Kubernetes Network Policies are resources that define how groups of pods are allowed to communicate with each other and other network endpoints. These policies are essential for securing applications by controlling the traffic flow at the IP address or port level. Without Network Policies, any pod can communicate with any other pod within the cluster, which can pose significant security risks.

Key Concepts of Kubernetes Network Policies

  1. Pod Selector: This specifies the group of pods to which the policy applies. It uses labels to select the pods.
  2. Policy Types: Network Policies can define rules for both ingress (incoming traffic) and egress (outgoing traffic).
  3. Ingress and Egress Rules: These rules define the allowed or denied traffic. Ingress rules control incoming traffic to the pods, while egress rules control outgoing traffic from the pods.

Creating a Network Policy

Here’s a basic example of a Network Policy that restricts all incoming traffic to a specific group of pods.

yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: deny-all-ingress
namespace: default
spec:
podSelector:
matchLabels:
role: db
policyTypes:
- Ingress
ingress: []

In this example:

  • The podSelector matches pods with the label role: db.
  • The policyTypes field specifies that this policy applies to ingress traffic.
  • The empty ingress list means all incoming traffic to these pods is denied.

Allowing Specific Traffic

To allow specific traffic, you need to define ingress rules. Below is an example of a policy that allows incoming traffic only from pods with the label role: frontend.

yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-frontend
namespace: default
spec:
podSelector:
matchLabels:
role: db
policyTypes:
- Ingress
ingress:
- from:
- podSelector:
matchLabels:
role: frontend
ports:
- protocol: TCP
port: 5432

In this policy:

  • The podSelector still selects the pods with the label role: db.
  • The ingress rule allows traffic from pods with the label role: frontend on TCP port 5432.

Egress Traffic Control

Egress policies control the outgoing traffic from pods. Here’s an example that restricts outgoing traffic from the role: db pods to only the DNS service.

yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-dns
namespace: default
spec:
podSelector:
matchLabels:
role: db
policyTypes:
- Egress
egress:
- to:
- namespaceSelector:
matchLabels:
name: kube-system
ports:
- protocol: UDP
port: 53

In this policy:

  • The egress rule allows outgoing UDP traffic on port 53 (typically used for DNS) to any pod in the kube-system namespace.

Combining Ingress and Egress Policies

You can combine ingress and egress rules in a single Network Policy. Here’s an example:

yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: frontend-policy
namespace: default
spec:
podSelector:
matchLabels:
role: frontend
policyTypes:
- Ingress
- Egress
ingress:
- from:
- podSelector:
matchLabels:
role: backend
ports:
- protocol: TCP
port: 80
egress:
- to:
- podSelector:
matchLabels:
role: backend
ports:
- protocol: TCP
port: 8080

This policy allows role: frontend pods to:

  • Receive traffic on TCP port 80 from role: backend pods.
  • Send traffic on TCP port 8080 to role: backend pods.

Applying Network Policies

Network Policies are applied at the namespace level and only affect pods within the namespace they are created in. When defining Network Policies, ensure that your Kubernetes network provider supports them. Most popular network plugins like Calico, Cilium, and Weave Net support Network Policies.

Conclusion

Kubernetes Network Policies are a powerful tool for securing pod communication in your cluster. By defining granular rules for ingress and egress traffic, you can enhance the security posture of your applications and comply with best practices for container security.

Implementing Network Policies can be complex, but understanding the basics and experimenting with simple policies can help you get started. As you become more comfortable, you can create more sophisticated policies to meet your specific security needs.

Feel free to experiment with the examples provided and adapt them to your own use cases. Happy networking!

Close Menu