S&N Network Policies

Question 1

How is the network flow configured by default in Kubernetes, about what pod can communicate with what other pod?

Answer 1

• All Allow
• every pod can communicate with each other pod in the same cluster

Question 2

What do network policies enable

Answer 2

Allow you to specify, what pod can communicate with what other pod
- for instance if an application pod is only allowed to communicate with a database via api service but not directly

Question 3

What is a Network policy in Kubernetes?

Answer 3

Another object in kubernetes namespace.
- linked to pods
- define rules within
- like for a db pod: only allow ingress traffic from the api pod on port 3306
- blocks all other traffic

Question 4

How do we link Network Policies to pods?

Answer 4

Using labels and selectors

Question 5

How do you specify a Network policy?

Answer 5

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
 name: db-policy
spec:
 podSelector:
  matchLabels:
	  role: db
 policyTypes:
 - Ingress
 ingress:
 - from:
   - podSelector:
   matchLabels:
  	 name: api-pod
   ports:
	   - protocol: TCP
	     port: 3306

Question 6

What happens when inside the network policy definition there are no policyTypes defined?

Answer 6

• no restriction on data traffic
• even if ingress or egress for connected pods are defined

Question 7

What solutions support network policies?

Answer 7

• calico
• romana
• weave-net

BUT NOT
- Flannel

Question 8

When you define Network policy and ingress/egress restrictions, how are responses handled? How do they need to be considered?

Answer 8

Responses are always included in declared allowances.
When ingress traffic is allowed, responses to requests are also allowed.
Only the direction where the traffic goes needs to be considered in policyTypes

Question 9

How can we restrict what namespaces are allowed by the network policy?

Answer 9

ingress:
 - from:
  - podSelector:
   matchLabels:
	  name: api-pod
	namespaceSelector:
	 matchLabels:
	  name: prod
 ports:
  - protocol: TCP
    port: 3306

Question 10

What happens if you only use a namespaceSelector inside a Network Policy definition?

Answer 10

• only pods inside the namespace are allowed to communicate with the pod
• other namespaces are not allowed

Question 10

How can we allow connections to servers not inside the cluster, like a backup server, that we know the ip address of?

Answer 10

ingress:
- from: 
 - ipBlock:
   cidr: 192.168.5.10/32

Question 11

What is special about the -from section of a network policy definition file?

Answer 11

Contains rules that are to be applied.
A rule starts with ‘-‘. Allowed traffic needs to adhere to all criteria within at least one rule

Question 12

How do you define a egress network policy?

Answer 12

spec:
 podSelector:
  matchLabels:
	 role: db
policyTypes:
- egress
egress:
- to:
    - ipBlock:
        cidr: 192.168.4.10/32
  ports:
	  - protocol: TCP
	    port: 80