examples-ingress-egress.md

Examples ingress / egress

Links

• https://github.com/ahmetb/kubernetes-network-policy-recipes
• https://k8s-examples.container-solutions.com/examples/NetworkPolicy/NetworkPolicy.html

Example with http (Cilium !!)

apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
description: "L7 policy to restrict access to specific HTTP call"
metadata:
  name: "rule1"
spec:
  endpointSelector:
    matchLabels:
      type: l7-test
  ingress:
  - fromEndpoints:
    - matchLabels:
        org: client-pod
    toPorts:
    - ports:
      - port: "8080"
        protocol: TCP
      rules:
        http:
        - method: "GET"
          path: "/discount"

Downside egress

• No valid api for anything other than IP's and/or Ports
• If you want more, you have to use CNI-Plugin specific, e.g.

Example egress with ip's

# Allow traffic of all pods having the label role:app
# egress only to a specific ip and port 
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: test-network-policy
  namespace: default
spec:
  podSelector:
    matchLabels:
      role: app
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr: 10.10.0.0/16
    ports:
    - protocol: TCP 
      port: 5432

Example Advanced Egress (cni-plugin specific)

Cilium

apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: "fqdn-pprof"
  namespace: msp
spec:
  endpointSelector:
    matchLabels:
      app: pprof
  egress:
  - toFQDNs:
    - matchPattern: '*.baidu.com'
  - toPorts:
    - ports:
      - port: "53"
        protocol: ANY
      rules:
        dns:
        - matchPattern: '*'

Calico

• Only Calico enterprise
  • Calico Enterprise extends Calico’s policy model so that domain names (FQDN / DNS) can be used to allow access from a pod or set of pods (via label selector) to external resources outside of your cluster.
  • https://projectcalico.docs.tigera.io/security/calico-enterprise/egress-access-controls

Using isitio as mesh (e.g. with cilium/calico )

Installation of sidecar in calico

• https://projectcalico.docs.tigera.io/getting-started/kubernetes/hardway/istio-integration

Example

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: test-network-policy
  namespace: default
spec:
  podSelector:
    matchLabels:
      role: app
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr: 10.10.0.0/16
    ports:
    - protocol: TCP 
      port: 5432