Kubernetes network policies

• https://kubernetes.io/docs/concepts/services-networking/network-policies/
• kind: NetworkPolicy
• https://kubernetes.io/docs/concepts/services-networking/network-policies/#networkpolicy-resource

Official example

 apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: test-network-policy
  namespace: default
spec:
  podSelector:
    matchLabels:
      role: db
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - ipBlock:
            cidr: 172.17.0.0/16
            except:
              - 172.17.1.0/24
        - namespaceSelector:
            matchLabels:
              project: myproject
        - podSelector:
            matchLabels:
              role: frontend
      ports:
        - protocol: TCP
          port: 6379
  egress:
   - to: 
     -  ipBlock:
           cidr: 10.0.0.0/24
     ports:
       - protocol: TCP
         port: 5978

Other examples

networkPolicy:
  enabled: true
  provider: CALICO

News

• 08/2023 Amazon VPC CNI now supports Kubernetes Network Policies

Related

• CKA v1.21: Demonstrate basic understanding of NetworkPolicies
• kubectl get networkpolicy
• K8s Network Policy Provider: Calico, Weave Net
• Limit pod traffic with Kubernetes network policies

See also

• kind: NetworkPolicy, kubectl [ get | describe ] networkpolicy, Weave Net
• Kubernetes networking: network policies, Network Policy Providers, CNI, Calico, flannel, Service mesh, Istio, kube-proxy, coredns, AWS VPC CNI: vpc-cni, Kubernetes: Ingress controllers, IPVS, ServiceTypes: LoadBalancer, ClusterIP, NodePort, ExternalName, Endpoints, EndpointSlices, Kubernetes DNS, svc.cluster.local, Weave Net