Azure Kubernetes Service Security Deep Dive – Part 4 (Network Policies)

Published Jan 25 2022 05:56 AM 1,416 Views
Microsoft

By nature, and by default each pod can talk to all other pods within a Kubernetes cluster. This behaviour sometimes is not desirable as some application owners may not agree to share connectivity to other applications. Or would like to restrict access in or out of the backend applications running on certain pods. Network Policy comes to your rescue in those cases.


Network policies or network security policies are kind of firewall rules for Kubernetes cluster. These are implemented with the help of Network Plugin or Container Network Interface (CNI) and control traffic flow at the IP address or port level (OSI layer 3 or 4). These policies are applied at the Namespace level and can restrict ingress and egress to and from a pod or a group of pods based on how they are configured. Please read more about Network Policies in official documentation of Kubernetes.


Please read this article that describes how to set up network policy on your AKS cluster. It also gives detailed information on how to configure and test network policies on pods. Assuming you read through this article, let’s take a simple but practical example and try to explore how network policies can help us.

pranabpaul_0-1639378679594.png

The diagram above describes a very common requirement. We have 2 subnets within our virtual network. The AKS cluster within AKS subnet has 2 namespaces – Backend and Frontend. Backend namespace has one pod DB and Frontend namespace has 2 pods API and App. Subnet VM has only one VM called Test VM. The ingress and egress criteria are as followed:

1. DB Pod can only receive ingress request from API Pod and nothing else.
2. Egress from DB Pod is not allowed.
3. App Pod and API Pod can receive ingress request from anywhere within the VNET.
4. Egress from App Pod to API Pod and API Pod to Backend Namespace is only permitted.


Step1
Open Azure CLI and provision a new resource group, virtual network, and subnets:

 

 

az group create --name rgakstestnetworkpolicy --location northeurope
az network vnet create -g rgakstestnetworkpolicy -n aksvnet --address-prefix 10.0.0.0/16 --subnet-name vmsubnet --subnet-prefix 10.0.0.0/24
az network vnet subnet create --name akssubnet --vnet-name aksvnet --resource-group rgakstestnetworkpolicy --address-prefixes 10.0.1.0/24

 

 


Step2
Provision a VM within VM Subnet and ensure you can do SSH to it:

 

 

az vm create \
--resource-group rgakstestnetworkpolicy \
--name testvm \
--image UbuntuLTS\
--admin-username azureuser \
--ssh-key-value ~/.ssh/id_rsa.pub \
--subnet vmsubnet \
--vnet-name aksvnet
ssh -i ~/.ssh/id_rsa azureuser@<public IP of the VM>
exit

 

 


Step 3
Now create your AKS cluster. Remember to add the flag “network-policy”.

 

 

az aks create --resource-group rgakstestnetworkpolicy --enable-managed-identity --name akstestnetworkpolicy --zones 1 2 3 --node-count 3 --kubernetes-version 1.21.2 --network-plugin azure --network-policy azure --vnet-subnet-id "/subscriptions/<your subscriptionid>/resourceGroups/rgakstestnetworkpolicy/providers/Microsoft.Network/virtualNetworks/aksvnet/subnets/akssubnet" --service-cidr 10.1.0.0/24 --dns-service-ip 10.1.0.10 --docker-bridge-address 172.17.0.1/24 --enable-addons monitoring --generate-ssh-keys

 

 

Step 4
Connect to your AKS cluster and create the namespaces and pods. We are keeping all pods with simple image of nginx. This is for demo purpose only.

 

 

az account set --subscription <your subscriptionid>
az aks get-credentials --resource-group rgakstestnetworkpolicy --name akstestnetworkpolicy
kubectl create namespace backend
kubectl create namespace frontend
kubectl run dbpod --image=nginx --restart=Never -n backend
kubectl run apppod --image=nginx --restart=Never -n frontend
kubectl run apipod --image=nginx --restart=Never -n frontend

 

 


Step 5
Get the IP addresses of your pods

pranabpaul_1-1639378949530.png

 

Now try accessing dbpod using curl from apppod or the VM we created earlier. You will see we can access it all right and nginx web server default page shows up.

pranabpaul_2-1639379006413.png

You can check this with other pods as well. You will find all pods are accessible from the others as well as from the VM.


Step 6
We will now set up network policies to restrict ingress and egress based on the criteria given above. First create a policy for dbpod:

 

 

cat > dbpod-policy.yaml <<EOF

apiVersion: networking.k8s.io/v1

kind: NetworkPolicy

metadata:

  name: dbpod-policy

  namespace: backend

spec:

  podSelector:

    matchLabels:

      run: dbpod

  policyTypes:

  - Ingress

  - Egress

  ingress:

  - from:

    - namespaceSelector:

        matchLabels:

          kubernetes.io/metadata.name: frontend

      podSelector:

        matchLabels:

          run: apipod

    ports:

    - protocol: TCP

      port: 80

EOF

kubectl apply -f dbpod-policy.yaml

 

 


This network policy defines there is no egress allowed from dbpod and ingress is allowed from only apipod under frontend namespace and that too at port 80 only. Remember the ingress -from statement here is inclusive of both namespace and the pod selection. If you use the following instead

 

 

- from:

    - namespaceSelector:

        matchLabels:

          kubernetes.io/metadata.name: frontend

    - podSelector:

        matchLabels:

          run: apipod

 

 

This will mean any pod under namespace frontend and only apipod within current namespace (backend). So, one dash (-) can change the whole context.


Step 7

Now, it’s time to check the access. First try from apipod

pranabpaul_3-1639379118763.png

 

Then, from apppod

pranabpaul_4-1639379160777.png

Next, from testvm

pranabpaul_5-1639379201947.png

 

So, as you can see, we covered both criteria 1 and 2 and successfully tested those.

Step 8
We will create 2 more policies for apipod and apppod but we are not going to test those exclusively.

 

 

cat > apipod-policy.yaml <<EOF

apiVersion: networking.k8s.io/v1

kind: NetworkPolicy

metadata:

  name: apipod-policy

  namespace: frontend

spec:

  podSelector:

    matchLabels:

      run: apipod

  policyTypes:

  - Ingress

  - Egress

  egress:

  - to:

    - namespaceSelector:

        matchLabels:

          kubernetes.io/metadata.name: backend

  ingress:

  - from:

    - ipBlock:

        cidr: 10.0.0.0/16

    ports:

    - protocol: TCP

      port: 80

EOF

kubectl apply -f apipod-policy.yaml



cat > apppod-policy.yaml <<EOF

apiVersion: networking.k8s.io/v1

kind: NetworkPolicy

metadata:

  name: apppod-policy

  namespace: frontend

spec:

  podSelector:

    matchLabels:

      run: apppod

  policyTypes:

  - Ingress

  - Egress

  egress:

  - to:

    - podSelector:

        matchLabels:

          run: apipod

  ingress:

  - from:

    - ipBlock:

        cidr: 10.0.0.0/16

    ports:

    - protocol: TCP

      port: 80

EOF

kubectl apply -f apppod-policy.yaml

 

 


With this we covered criteria 3 and 4 as well. We saw how Network Policies can control traffic flow (ingress and egress) within your Kubernetes cluster and in some cases outside the cluster as well. One question persists, what happens when we use multiple instances of similar pods such as in ReplicaSet or Deployment. The answer is it remains the same. You restrict ingress or egress by either pod labels, namespace labels or IP ranges. And in case of a ReplicaSet, the pod lables remains same for all the pods within the ReplicaSet. You can use DNS name to check/test instead of IP address of the pod if you have exposed the pod/deployment through a Service. Additionally, we use Ingress Controller and User Defined Routes (UDR) to control traffic respectively towards and from the cluster in relation to the network outside.

 

That’s pretty much it. We will talk about security of ingress and egress in the context of network in the next part of this series.

 

Other parts of these series:  Part1 | Part2 | Part3 | Part5

%3CLINGO-SUB%20id%3D%22%5C%26quot%3Blingo-sub-3037014%5C%26quot%3B%22%20slang%3D%22%5C%26quot%3Ben-US%5C%26quot%3B%22%3EAzure%20Kubernetes%20Service%20Security%20Deep%20Dive%20%E2%80%93%20Part%204%20(Network%20Policies)%26lt%3B%5C%2Flingo-sub%26gt%3B%3CLINGO-BODY%20id%3D%22%5C%26quot%3Blingo-body-3037014%5C%26quot%3B%22%20slang%3D%22%5C%26quot%3Ben-US%5C%26quot%3B%22%3E%3CP%3EBy%20nature%2C%20and%20by%20default%20each%20pod%20can%20talk%20to%20all%20other%20pods%20within%20a%20Kubernetes%20cluster.%20This%20behaviour%20sometimes%20is%20not%20desirable%20as%20some%20application%20owners%20may%20not%20agree%20to%20share%20connectivity%20to%20other%20applications.%20Or%20would%20like%20to%20restrict%20access%20in%20or%20out%20of%20the%20backend%20applications%20running%20on%20certain%20pods.%20Network%20Policy%20comes%20to%20your%20rescue%20in%20those%20cases.%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FP%3E%3CP%3E%3CBR%20%2F%3ENetwork%20policies%20or%20network%20security%20policies%20are%20kind%20of%20firewall%20rules%20for%20Kubernetes%20cluster.%20These%20are%20implemented%20with%20the%20help%20of%20Network%20Plugin%20or%20Container%20Network%20Interface%20(CNI)%20and%20control%20traffic%20flow%20at%20the%20IP%20address%20or%20port%20level%20(OSI%20layer%203%20or%204).%20These%20policies%20are%20applied%20at%20the%20Namespace%20level%20and%20can%20restrict%20ingress%20and%20egress%20to%20and%20from%20a%20pod%20or%20a%20group%20of%20pods%20based%20on%20how%20they%20are%20configured.%20Please%20read%20more%20about%20Network%20Policies%20in%20%3CA%20title%3D%22%5C%26quot%3BNetwork%22%20policies%3D%22%22%20target%3D%22_blank%22%3Eofficial%20documentation%20of%20Kubernetes%26lt%3B%5C%2FA%26gt%3B.%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FA%3E%3C%2FP%3E%3CP%3E%3CBR%20%2F%3EPlease%20read%20%3CA%20title%3D%22%5C%26quot%3BNetwork%22%20policy%3D%22%22%20in%3D%22%22%20aks%3D%22%22%20target%3D%22_blank%22%3Ethis%20article%26lt%3B%5C%2FA%26gt%3B%20that%20describes%20how%20to%20set%20up%20network%20policy%20on%20your%20AKS%20cluster.%20It%20also%20gives%20detailed%20information%20on%20how%20to%20configure%20and%20test%20network%20policies%20on%20pods.%20Assuming%20you%20read%20through%20this%20article%2C%20let%E2%80%99s%20take%20a%20simple%20but%20practical%20example%20and%20try%20to%20explore%20how%20network%20policies%20can%20help%20us.%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FA%3E%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22%5C%26quot%3Blia-inline-image-display-wrapper%22%20lia-image-align-inline%3D%22%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Fgxcuf89792%2F%5C%26quot%3Bhttps%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F333445i989123D46DF5F4E9%2Fimage-dimensions%2F627x400%3Fv%3Dv2%5C%26quot%3B%22%20width%3D%22%5C%26quot%3B627%5C%26quot%3B%22%20height%3D%22%5C%26quot%3B400%5C%26quot%3B%22%20role%3D%22%5C%26quot%3Bbutton%5C%26quot%3B%22%20title%3D%22pranabpaul_0-1639378679594.png%22%20alt%3D%22%5C%26quot%3Bpranabpaul_0-1639378679594.png%5C%26quot%3B%22%20%2F%3E%26lt%3B%5C%2Fspan%26gt%3B%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FSPAN%3E%3C%2FP%3E%3CP%3EThe%20diagram%20above%20describes%20a%20very%20common%20requirement.%20We%20have%202%20subnets%20within%20our%20virtual%20network.%20The%20AKS%20cluster%20within%20AKS%20subnet%20has%202%20namespaces%20%E2%80%93%20Backend%20and%20Frontend.%20Backend%20namespace%20has%20one%20pod%20DB%20and%20Frontend%20namespace%20has%202%20pods%20API%20and%20App.%20Subnet%20VM%20has%20only%20one%20VM%20called%20Test%20VM.%20The%20ingress%20and%20egress%20criteria%20are%20as%20followed%3A%3CBR%20%2F%3E%3CBR%20%2F%3E1.%20DB%20Pod%20can%20only%20receive%20ingress%20request%20from%20API%20Pod%20and%20nothing%20else.%3CBR%20%2F%3E2.%20Egress%20from%20DB%20Pod%20is%20not%20allowed.%3CBR%20%2F%3E3.%20App%20Pod%20and%20API%20Pod%20can%20receive%20ingress%20request%20from%20anywhere%20within%20the%20VNET.%3CBR%20%2F%3E4.%20Egress%20from%20App%20Pod%20to%20API%20Pod%20and%20API%20Pod%20to%20Backend%20Namespace%20is%20only%20permitted.%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FP%3E%3CP%3E%3CBR%20%2F%3E%3CSTRONG%3EStep1%26lt%3B%5C%2FSTRONG%26gt%3B%3CBR%20%2F%3EOpen%20Azure%20CLI%20and%20provision%20a%20new%20resource%20group%2C%20virtual%20network%2C%20and%20subnets%3A%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FP%3E%3CP%3E%26nbsp%3B%26lt%3B%5C%2FP%26gt%3B%5Cn%3CPRE%20class%3D%22%5C%26quot%3Blia-code-sample%22%20language-powershell%3D%22%22%3E%3CCODE%3Eaz%20group%20create%20--name%20rgakstestnetworkpolicy%20--location%20northeurope%5Cnaz%20network%20vnet%20create%20-g%20rgakstestnetworkpolicy%20-n%20aksvnet%20--address-prefix%2010.0.0.0%2F16%20--subnet-name%20vmsubnet%20--subnet-prefix%2010.0.0.0%2F24%5Cnaz%20network%20vnet%20subnet%20create%20--name%20akssubnet%20--vnet-name%20aksvnet%20--resource-group%20rgakstestnetworkpolicy%20--address-prefixes%2010.0.1.0%2F24%26lt%3B%5C%2Fcode%26gt%3B%26lt%3B%5C%2Fpre%26gt%3B%5Cn%3C%2FCODE%3E%3C%2FPRE%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FP%3E%3CP%3E%26nbsp%3B%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FP%3E%3CP%3E%3CBR%20%2F%3E%3CSTRONG%3EStep2%26lt%3B%5C%2FSTRONG%26gt%3B%3CBR%20%2F%3EProvision%20a%20VM%20within%20VM%20Subnet%20and%20ensure%20you%20can%20do%20SSH%20to%20it%3A%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FP%3E%3CP%3E%26nbsp%3B%26lt%3B%5C%2FP%26gt%3B%5Cn%3CPRE%20class%3D%22%5C%26quot%3Blia-code-sample%22%20language-powershell%3D%22%22%3E%3CCODE%3Eaz%20vm%20create%20%5C%5C%5Cn--resource-group%20rgakstestnetworkpolicy%20%5C%5C%5Cn--name%20testvm%20%5C%5C%5Cn--image%20UbuntuLTS%5C%5C%5Cn--admin-username%20azureuser%20%5C%5C%5Cn--ssh-key-value%20~%2F.ssh%2Fid_rsa.pub%20%5C%5C%5Cn--subnet%20vmsubnet%20%5C%5C%5Cn--vnet-name%20aksvnet%5Cnssh%20-i%20~%2F.ssh%2Fid_rsa%20azureuser%40%3CPUBLIC%20ip%3D%22%22%20of%3D%22%22%20the%3D%22%22%20vm%3D%22%22%3E%5Cnexit%26lt%3B%5C%2Fcode%26gt%3B%26lt%3B%5C%2Fpre%26gt%3B%5Cn%3C%2FPUBLIC%3E%3C%2FCODE%3E%3C%2FPRE%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FP%3E%3CP%3E%26nbsp%3B%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FP%3E%3CP%3E%3CBR%20%2F%3E%3CSTRONG%3EStep%203%26lt%3B%5C%2FSTRONG%26gt%3B%3CBR%20%2F%3ENow%20create%20your%20AKS%20cluster.%20Remember%20to%20add%20the%20flag%20%E2%80%9Cnetwork-policy%E2%80%9D.%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FP%3E%3CP%3E%26nbsp%3B%26lt%3B%5C%2FP%26gt%3B%5Cn%3CPRE%20class%3D%22%5C%26quot%3Blia-code-sample%22%20language-powershell%3D%22%22%3E%3CCODE%3Eaz%20aks%20create%20--resource-group%20rgakstestnetworkpolicy%20--enable-managed-identity%20--name%20akstestnetworkpolicy%20--zones%201%202%203%20--node-count%203%20--kubernetes-version%201.21.2%20--network-plugin%20azure%20--network-policy%20azure%20--vnet-subnet-id%20%5C%22%2Fsubscriptions%2F%3CYOUR%20subscriptionid%3D%22%22%3E%2FresourceGroups%2Frgakstestnetworkpolicy%2Fproviders%2FMicrosoft.Network%2FvirtualNetworks%2Faksvnet%2Fsubnets%2Fakssubnet%5C%22%20--service-cidr%2010.1.0.0%2F24%20--dns-service-ip%2010.1.0.10%20--docker-bridge-address%20172.17.0.1%2F24%20--enable-addons%20monitoring%20--generate-ssh-keys%26lt%3B%5C%2Fcode%26gt%3B%26lt%3B%5C%2Fpre%26gt%3B%5Cn%3C%2FYOUR%3E%3C%2FCODE%3E%3C%2FPRE%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FP%3E%3CP%3E%26nbsp%3B%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FP%3E%3CP%3E%3CSTRONG%3EStep%204%26lt%3B%5C%2FSTRONG%26gt%3B%3CBR%20%2F%3EConnect%20to%20your%20AKS%20cluster%20and%20create%20the%20namespaces%20and%20pods.%20We%20are%20keeping%20all%20pods%20with%20simple%20image%20of%20nginx.%20This%20is%20for%20demo%20purpose%20only.%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FP%3E%3CP%3E%26nbsp%3B%26lt%3B%5C%2FP%26gt%3B%5Cn%3CPRE%20class%3D%22%5C%26quot%3Blia-code-sample%22%20language-powershell%3D%22%22%3E%3CCODE%3Eaz%20account%20set%20--subscription%20%3CYOUR%20subscriptionid%3D%22%22%3E%5Cnaz%20aks%20get-credentials%20--resource-group%20rgakstestnetworkpolicy%20--name%20akstestnetworkpolicy%5Cnkubectl%20create%20namespace%20backend%5Cnkubectl%20create%20namespace%20frontend%5Cnkubectl%20run%20dbpod%20--image%3Dnginx%20--restart%3DNever%20-n%20backend%5Cnkubectl%20run%20apppod%20--image%3Dnginx%20--restart%3DNever%20-n%20frontend%5Cnkubectl%20run%20apipod%20--image%3Dnginx%20--restart%3DNever%20-n%20frontend%26lt%3B%5C%2Fcode%26gt%3B%26lt%3B%5C%2Fpre%26gt%3B%5Cn%3C%2FYOUR%3E%3C%2FCODE%3E%3C%2FPRE%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FP%3E%3CP%3E%26nbsp%3B%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FP%3E%3CP%3E%3CBR%20%2F%3E%3CSTRONG%3EStep%205%26lt%3B%5C%2FSTRONG%26gt%3B%3CBR%20%2F%3EGet%20the%20IP%20addresses%20of%20your%20pods%3CBR%20%2F%3E%3CBR%20%2F%3E%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22%5C%26quot%3Blia-inline-image-display-wrapper%22%20lia-image-align-inline%3D%22%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Fgxcuf89792%2F%5C%26quot%3Bhttps%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F333448iF37905B3449054BA%2Fimage-dimensions%2F789x148%3Fv%3Dv2%5C%26quot%3B%22%20width%3D%22%5C%26quot%3B789%5C%26quot%3B%22%20height%3D%22%5C%26quot%3B148%5C%26quot%3B%22%20role%3D%22%5C%26quot%3Bbutton%5C%26quot%3B%22%20title%3D%22pranabpaul_1-1639378949530.png%22%20alt%3D%22%5C%26quot%3Bpranabpaul_1-1639378949530.png%5C%26quot%3B%22%20%2F%3E%26lt%3B%5C%2Fspan%26gt%3B%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FP%3E%3CP%3ENow%20try%20accessing%20dbpod%20using%20curl%20from%20apppod%20or%20the%20VM%20we%20created%20earlier.%20You%20will%20see%20we%20can%20access%20it%20all%20right%20and%20nginx%20web%20server%20default%20page%20shows%20up.%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22%5C%26quot%3Blia-inline-image-display-wrapper%22%20lia-image-align-inline%3D%22%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Fgxcuf89792%2F%5C%26quot%3Bhttps%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F333450i7A0E8220CFCE75B1%2Fimage-dimensions%2F692x455%3Fv%3Dv2%5C%26quot%3B%22%20width%3D%22%5C%26quot%3B692%5C%26quot%3B%22%20height%3D%22%5C%26quot%3B455%5C%26quot%3B%22%20role%3D%22%5C%26quot%3Bbutton%5C%26quot%3B%22%20title%3D%22pranabpaul_2-1639379006413.png%22%20alt%3D%22%5C%26quot%3Bpranabpaul_2-1639379006413.png%5C%26quot%3B%22%20%2F%3E%26lt%3B%5C%2Fspan%26gt%3B%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FSPAN%3E%3C%2FP%3E%3CP%3EYou%20can%20check%20this%20with%20other%20pods%20as%20well.%20You%20will%20find%20all%20pods%20are%20accessible%20from%20the%20others%20as%20well%20as%20from%20the%20VM.%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FP%3E%3CP%3E%3CBR%20%2F%3E%3CSTRONG%3EStep%206%26lt%3B%5C%2FSTRONG%26gt%3B%3CBR%20%2F%3EWe%20will%20now%20set%20up%20network%20policies%20to%20restrict%20ingress%20and%20egress%20based%20on%20the%20criteria%20given%20above.%20First%20create%20a%20policy%20for%20dbpod%3A%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FP%3E%3CP%3E%26nbsp%3B%26lt%3B%5C%2FP%26gt%3B%5Cn%3CPRE%20class%3D%22%5C%26quot%3Blia-code-sample%22%20language-bash%3D%22%22%3E%3CCODE%3Ecat%20%26gt%3B%20dbpod-policy.yaml%20%26lt%3B%3CEOF%3E%26lt%3B%5C%2Fpre%26gt%3B%5Cn%3C%2FEOF%3E%3C%2FCODE%3E%3C%2FPRE%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FP%3E%3CP%3E%26nbsp%3B%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FP%3E%3CP%3E%3CBR%20%2F%3EThis%20network%20policy%20defines%20there%20is%20no%20egress%20allowed%20from%20dbpod%20and%20ingress%20is%20allowed%20from%20only%20apipod%20under%20frontend%20namespace%20and%20that%20too%20at%20port%2080%20only.%20Remember%20the%20ingress%20-from%20statement%20here%20is%20inclusive%20of%20both%20namespace%20and%20the%20pod%20selection.%20If%20you%20use%20the%20following%20instead%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FP%3E%3CP%3E%26nbsp%3B%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FP%3E%3CP%3E%26nbsp%3B%26lt%3B%5C%2FP%26gt%3B%5Cn%3CPRE%20class%3D%22%5C%26quot%3Blia-code-sample%22%20language-yaml%3D%22%22%3E%3CCODE%3E-%20from%3A%5Cn%5Cn%20%20%20%20-%20namespaceSelector%3A%5Cn%5Cn%20%20%20%20%20%20%20%20matchLabels%3A%5Cn%5Cn%20%20%20%20%20%20%20%20%20%20kubernetes.io%2Fmetadata.name%3A%20frontend%5Cn%5Cn%20%20%20%20-%20podSelector%3A%5Cn%5Cn%20%20%20%20%20%20%20%20matchLabels%3A%5Cn%5Cn%20%20%20%20%20%20%20%20%20%20run%3A%20apipod%26lt%3B%5C%2Fcode%26gt%3B%26lt%3B%5C%2Fpre%26gt%3B%5Cn%3C%2FCODE%3E%3C%2FPRE%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FP%3E%3CP%3E%26nbsp%3B%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FP%3E%3CP%3EThis%20will%20mean%20any%20pod%20under%20namespace%20frontend%20and%20only%20apipod%20within%20current%20namespace%20(backend).%20So%2C%20one%20dash%20(-)%20can%20change%20the%20whole%20context.%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FP%3E%3CP%3E%3CSTRONG%3E%3CBR%20%2F%3EStep%207%26lt%3B%5C%2FSTRONG%26gt%3B%3CBR%20%2F%3ENow%2C%20it%E2%80%99s%20time%20to%20check%20the%20access.%20First%20try%20from%20apipod%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22%5C%26quot%3Blia-inline-image-display-wrapper%22%20lia-image-align-inline%3D%22%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Fgxcuf89792%2F%5C%26quot%3Bhttps%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F333451i9231EB65A78C7F9E%2Fimage-dimensions%2F680x340%3Fv%3Dv2%5C%26quot%3B%22%20width%3D%22%5C%26quot%3B680%5C%26quot%3B%22%20height%3D%22%5C%26quot%3B340%5C%26quot%3B%22%20role%3D%22%5C%26quot%3Bbutton%5C%26quot%3B%22%20title%3D%22pranabpaul_3-1639379118763.png%22%20alt%3D%22%5C%26quot%3Bpranabpaul_3-1639379118763.png%5C%26quot%3B%22%20%2F%3E%26lt%3B%5C%2Fspan%26gt%3B%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FP%3E%3CP%3EThen%2C%20from%20apppod%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22%5C%26quot%3Blia-inline-image-display-wrapper%22%20lia-image-align-inline%3D%22%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Fgxcuf89792%2F%5C%26quot%3Bhttps%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F333452iEDCF385D6D418461%2Fimage-dimensions%2F676x115%3Fv%3Dv2%5C%26quot%3B%22%20width%3D%22%5C%26quot%3B676%5C%26quot%3B%22%20height%3D%22%5C%26quot%3B115%5C%26quot%3B%22%20role%3D%22%5C%26quot%3Bbutton%5C%26quot%3B%22%20title%3D%22pranabpaul_4-1639379160777.png%22%20alt%3D%22%5C%26quot%3Bpranabpaul_4-1639379160777.png%5C%26quot%3B%22%20%2F%3E%26lt%3B%5C%2Fspan%26gt%3B%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FSPAN%3E%3C%2FP%3E%3CP%3ENext%2C%20from%20testvm%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22%5C%26quot%3Blia-inline-image-display-wrapper%22%20lia-image-align-inline%3D%22%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Fgxcuf89792%2F%5C%26quot%3Bhttps%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F333453i3B471ACEB055EEE5%2Fimage-dimensions%2F702x151%3Fv%3Dv2%5C%26quot%3B%22%20width%3D%22%5C%26quot%3B702%5C%26quot%3B%22%20height%3D%22%5C%26quot%3B151%5C%26quot%3B%22%20role%3D%22%5C%26quot%3Bbutton%5C%26quot%3B%22%20title%3D%22pranabpaul_5-1639379201947.png%22%20alt%3D%22%5C%26quot%3Bpranabpaul_5-1639379201947.png%5C%26quot%3B%22%20%2F%3E%26lt%3B%5C%2Fspan%26gt%3B%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FP%3E%3CP%3ESo%2C%20as%20you%20can%20see%2C%20we%20covered%20both%20criteria%201%20and%202%20and%20successfully%20tested%20those.%3CBR%20%2F%3E%3CBR%20%2F%3E%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FP%3E%3CP%3E%3CSTRONG%3EStep%208%26lt%3B%5C%2FSTRONG%26gt%3B%3CBR%20%2F%3EWe%20will%20create%202%20more%20policies%20for%20apipod%20and%20apppod%20but%20we%20are%20not%20going%20to%20test%20those%20exclusively.%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FP%3E%3CP%3E%26nbsp%3B%26lt%3B%5C%2FP%26gt%3B%5Cn%3CPRE%20class%3D%22%5C%26quot%3Blia-code-sample%22%20language-yaml%3D%22%22%3E%3CCODE%3Ecat%20%26gt%3B%20apipod-policy.yaml%20%26lt%3B%3CEOF%3E%20apppod-policy.yaml%20%26lt%3B%3CEOF%3E%26lt%3B%5C%2Fpre%26gt%3B%5Cn%3C%2FEOF%3E%3C%2FEOF%3E%3C%2FCODE%3E%3C%2FPRE%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FP%3E%3CP%3E%26nbsp%3B%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FP%3E%3CP%3E%3CFONT%20color%3D%22%5C%26quot%3B%230000FF%5C%26quot%3B%22%3E%3CBR%20%2F%3E%26lt%3B%5C%2FFONT%26gt%3B%3CFONT%20color%3D%22%5C%26quot%3B%230000FF%5C%26quot%3B%22%3E%3CFONT%20color%3D%22%5C%26quot%3B%23000000%5C%26quot%3B%22%3EWith%20this%20we%20covered%20criteria%203%20and%204%20as%20well.%26lt%3B%5C%2FFONT%26gt%3B%26nbsp%3B%26lt%3B%5C%2FFONT%26gt%3BWe%20saw%20how%20Network%20Policies%20can%20control%20traffic%20flow%20(ingress%20and%20egress)%20within%20your%20Kubernetes%20cluster%20and%20in%20some%20cases%20outside%20the%20cluster%20as%20well.%20One%20question%20persists%2C%20what%20happens%20when%20we%20use%20multiple%20instances%20of%20similar%20pods%20such%20as%20in%20ReplicaSet%20or%20Deployment.%20The%20answer%20is%20it%20remains%20the%20same.%20You%20restrict%20ingress%20or%20egress%20by%20either%20pod%20labels%2C%20namespace%20labels%20or%20IP%20ranges.%20And%20in%20case%20of%20a%20ReplicaSet%2C%20the%20pod%20lables%20remains%20same%20for%20all%20the%20pods%20within%20the%20ReplicaSet.%20You%20can%20use%20DNS%20name%20to%20check%2Ftest%20instead%20of%20IP%20address%20of%20the%20pod%20if%20you%20have%20exposed%20the%20pod%2Fdeployment%20through%20a%20Service.%20Additionally%2C%20we%20use%20Ingress%20Controller%20and%20User%20Defined%20Routes%20(UDR)%20to%20control%20traffic%20respectively%20towards%20and%20from%20the%20cluster%20in%20relation%20to%20the%20network%20outside.%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FFONT%3E%3C%2FFONT%3E%3C%2FFONT%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FP%3E%3CP%3EThat%E2%80%99s%20pretty%20much%20it.%20We%20will%20talk%20about%20security%20of%20ingress%20and%20egress%20in%20the%20context%20of%20network%20in%20the%20next%20part%20of%20this%20series.%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FP%3E%3CP%3E%26nbsp%3B%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FP%3E%3CP%3E%3CSPAN%3EOther%20parts%20of%20these%20series%3A%26nbsp%3B%26nbsp%3B%26lt%3B%5C%2FSPAN%26gt%3B%3CA%20title%3D%22%5C%26quot%3BPart1%5C%26quot%3B%22%20href%3D%22%5C%26quot%3Bhttps%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fazure-architecture-blog%2Fazure-kubernetes-service-security-deep-dive-part-1-cis-benchmark%2Fba-p%2F3002525%5C%26quot%3B%22%20target%3D%22%5C%26quot%3B_blank%5C%26quot%3B%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3EPart1%26lt%3B%5C%2FA%26gt%3B%3CSPAN%3E%26nbsp%3B%7C%26nbsp%3B%3C%2FSPAN%3E%3C%2FA%3E%3CA%20title%3D%22%5C%26quot%3BPart2%5C%26quot%3B%22%20href%3D%22%5C%26quot%3Bhttps%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fazure-architecture-blog%2Fazure-kubernetes-service-security-deep-dive-part-2-apparmor-and%2Fba-p%2F3013977%5C%26quot%3B%22%20target%3D%22%5C%26quot%3B_blank%5C%26quot%3B%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3EPart2%26lt%3B%5C%2FA%26gt%3B%26lt%3B%5C%2FSPAN%26gt%3B%3CSPAN%3E%26nbsp%3B%7C%20%3C%2FSPAN%3E%3C%2FA%3E%3CA%20title%3D%22%5C%26quot%3BPart3%5C%26quot%3B%22%20href%3D%22%5C%26quot%3Bhttps%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fazure-architecture-blog%2Fazure-kubernetes-service-security-deep-dive-part-3-audit-logs%2Fba-p%2F3036977%5C%26quot%3B%22%20target%3D%22%5C%26quot%3B_blank%5C%26quot%3B%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3EPart3%26lt%3B%5C%2FA%26gt%3B%26lt%3B%5C%2FSPAN%26gt%3B%3CSPAN%3E%26nbsp%3B%7C%26nbsp%3B%26lt%3B%5C%2FSPAN%26gt%3B%3C%2FSPAN%3E%3C%2FA%3E%3CA%20title%3D%22%5C%26quot%3BPart5%5C%26quot%3B%22%20href%3D%22%5C%26quot%3Bhttps%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fazure-architecture-blog%2Fazure-kubernetes-service-security-deep-dive-part-5-securing%2Fba-p%2F3053769%5C%26quot%3B%22%20target%3D%22%5C%26quot%3B_blank%5C%26quot%3B%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3EPart5%26lt%3B%5C%2FA%26gt%3B%26lt%3B%5C%2FP%26gt%3B%26lt%3B%5C%2Flingo-body%26gt%3B%3CLINGO-TEASER%20id%3D%22%5C%26quot%3Blingo-teaser-3037014%5C%26quot%3B%22%20slang%3D%22%5C%26quot%3Ben-US%5C%26quot%3B%22%3E%3C%2FLINGO-TEASER%3E%3C%2FA%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22%5C%26quot%3Blia-inline-image-display-wrapper%22%20lia-image-align-inline%3D%22%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Fgxcuf89792%2F%5C%26quot%3Bhttps%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F333454iE6DCF8C56607FDD4%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%5C%26quot%3B%22%20role%3D%22%5C%26quot%3Bbutton%5C%26quot%3B%22%20title%3D%22logo.png%22%20alt%3D%22%5C%26quot%3Blogo.png%5C%26quot%3B%22%20%2F%3E%26lt%3B%5C%2Fspan%26gt%3B%26lt%3B%5C%2FP%26gt%3B%5Cn%3C%2FSPAN%3E%3C%2FP%3E%3CP%3EHow%20to%20use%20network%20security%20policies%20to%20restrict%20egress%20and%20ingress%20from%20and%20to%20AKS%20pods.%26lt%3B%5C%2FP%26gt%3B%26lt%3B%5C%2Flingo-teaser%26gt%3B%3CLINGO-LABS%20id%3D%22%5C%26quot%3Blingo-labs-3037014%5C%26quot%3B%22%20slang%3D%22%5C%26quot%3Ben-US%5C%26quot%3B%22%3E%3CLINGO-LABEL%3EApplication%26lt%3B%5C%2Flingo-label%26gt%3B%3CLINGO-LABEL%3EInfrastructure%26lt%3B%5C%2Flingo-label%26gt%3B%26lt%3B%5C%2Flingo-labs%26gt%3B%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3C%2FLINGO-SUB%3E
Co-Authors
Version history
Last update:
‎Jan 07 2022 09:20 AM
Updated by: