Restricting Network Traffic in K8s With NetworkPolicy

What does NetworkPolicy do?

Labels attached to a pod
A group of pods sharing the same namespace
An IP range (IP Block), e.g. 172.0.1.0/24

You can think of NetworkPolicy as defining "firewall rules" that check incoming and outgoing packets in front of each Pod.

Defining a NetworkPolicy

NetworkPolicy is a resource in k8s, so we define it in a Yaml file.

Network Policy controls both incoming (Ingress) and outgoing (Egress) network traffic

Ingress

By default, if you don't declare the Ingress field, all traffic into the pod gets allowed — the following example allows connections to a pod running a mysql service on port 3306

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: test-networkpolicy 								(1)
  namespace: default									(2)
spec:
  policyTypes:											(3)
  - Ingress
  ingress:
  - from:
    - ipBlock:											(4)
        cidr: 172.17.0.0/16
        except:
        - 172.17.1.0/24
      - podSelector:										(5)
          matchLabels:
            role: frontend
      - namespaceSelector:								(6)
          matchLabels:
            kubernetes.io/metadata.name: test-namespace
      ports:												(7)
      - port: 3306
        protocol: TCP
  podSelector:											(8)
    matchLabels:
      app.kubernetes.io/instance: mysql

Explanation:

(1) The name of the networkPolicy being created

(2) The namespace this NetworkPolicy applies to — if not declared, it defaults to the default namespace in the kube config.

(3) Lists the types of Policy being defined. (Ingress, Egress, or both)

(4) Lists the IP range allowed to connect (this example allows the range 172.17.0.0 to 172.17.255.255, except the range in between, 172.17.1.0 to 172.17.1.255)

(5) Allows pods with label role=frontend to connect.

(6) Allows pods from a namespace with label kubernetes.io/metadata.name=test-namespace to connect.

(7) Defines the destination ports allowed to connect along with the protocol — here it's MySQL's port 3306 with the TCP protocol.

(8) Selects pods with label app.kubernetes.io/instance: mysql in the default namespace to apply the policy to.

Egress:

Similar to Ingress, Egress defines rules for which packets are allowed to go out. Egress filters packets by Destination IP and Destination Port.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: test-network-policy
  namespace: default
spec:
  podSelector:
    matchLabels:
      role: db
  policyTypes:						(1)
  - Egress
  egress:
  - to:
    - ipBlock:						(2)
        cidr: 10.0.0.0/24
    ports:							(3)
    - protocol: TCP
      port: 5978
      endPort: 8000

Explanation:

(1) Defines the type of rule to apply (Ingress or Egress)

(2) Defines the destination IP allowed to communicate with

(3) Defines the destination port number(s) allowed to communicate with (as of K8s version 1.22, you can define a range of Ports by adding the endPort field)

A few special cases

Deny all Ingress traffic into every pod in the default namespace (if you don't declare a namespace, it applies to the default namespace)

---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
spec:
  podSelector: {}
  policyTypes:
  - Ingress

Allow all traffic into every pod

---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-all-ingress
spec:
  podSelector: {}
  ingress:
  - {}
  policyTypes:
  - Ingress

Deny all Egress traffic

---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-egress
spec:
  podSelector: {}
  policyTypes:
  - Egress

Allow all Egress traffic

---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-all-egress
spec:
  podSelector: {}
  egress:
  - {}
  policyTypes:
  - Egress

References

If you're running into technical challenges or need help with systems, DevOps tools, I'm confident I can help. Get in touch at hoangviet.io.vn

Thank you all! Have a nice day!