Implementing Network Policies

Introduction

In Kubernetes, network policies are a powerful feature that allow you to control the traffic flow between pods within your cluster. By using network policies, you can define rules that specify which pods can communicate with each other and how they can do so. This tutorial will guide you through implementing network policies to secure your Kubernetes applications.

Concept

Network policies in Kubernetes are defined as YAML files that specify a set of rules for traffic flow between pods. These rules include:

• Pod Selector: Specifies the pods to which the policy applies.
• Ingress Rules: Define what incoming traffic is allowed to reach the selected pods.
• Egress Rules: Define what outgoing traffic from the selected pods is allowed.

Network policies are enforced by network plugins that support them, such as Calico, Cilium, and Weave Net. These plugins intercept traffic at the network layer and enforce the rules defined in your policies.

Examples

Basic Network Policy Example

Let's start with a basic example where we restrict access to a database pod so that only a specific application pod can communicate with it.

Step 1: Create the Database Pod

First, create a pod that acts as a database:

1apiVersion: v1
2kind: Pod
3metadata:
4name: db-pod
5labels:
6  app: db
7spec:
8containers:
9- name: db-container
10  image: postgres

Apply this configuration using the following command:

Step 3: Create a Network Policy

Now, create a network policy that restricts access to the database pod so that only the application pod can communicate with it:

1apiVersion: networking.k8s.io/v1
2kind: NetworkPolicy
3metadata:
4name: db-policy
5spec:
6podSelector:
7  matchLabels:
8    app: db
9policyTypes:
10- Ingress
11ingress:
12- from:
13  - podSelector:
14      matchLabels:
15        app: app

Apply this configuration using the following command:

Then, try to ping the database pod:

Exec into the test pod:

You should not receive any response, indicating that the connection is blocked by the network policy.

What's Next?

In this tutorial, you learned how to implement basic network policies to control traffic flow between pods in Kubernetes. For more advanced use cases, such as managing egress rules or using multiple selectors, refer to the Kubernetes documentation.

If you're interested in automating and managing your Kubernetes resources, consider exploring Helm for Package Management. Helm allows you to package, deploy, and manage Kubernetes applications with ease.